Merge pull request #194 from CycloneDX/fix-nil-pointer-deref

fix: `nil` pointer dereference during evidence conversion

Author: nscuro

convert.go

@@ -195,13 +195,15 @@ func convertEvidence(c *Component, specVersion SpecVersion) {
 	}
 
 	if specVersion < SpecVersion1_6 {
-		for i := range *c.Evidence.Occurrences {
-			occ := &(*c.Evidence.Occurrences)[i]
-
-			occ.Line = nil
-			occ.Offset = nil
-			occ.Symbol = ""
-			occ.AdditionalContext = ""
+		if c.Evidence.Occurrences != nil {
+			for i := range *c.Evidence.Occurrences {
+				occ := &(*c.Evidence.Occurrences)[i]
+
+				occ.Line = nil
+				occ.Offset = nil
+				occ.Symbol = ""
+				occ.AdditionalContext = ""
+			}
 		}
 	}
 

validate_json_test.go

@@ -18,6 +18,7 @@
 package cyclonedx
 
 import (
+	"errors"
 	"fmt"
 
 	"github.com/xeipuuv/gojsonschema"
@@ -60,5 +61,5 @@ func (jv jsonValidator) Validate(bom []byte, specVersion SpecVersion) error {
 		errSummary += fmt.Sprintf("\n  - %s", verr.String())
 	}
 
-	return fmt.Errorf(errSummary)
+	return errors.New(errSummary)
 }