The issue happens because StreamReader.Read() does not check for errors from the embedded Reader.Read().

Relevant code here:

A simple fix would be:

func (r StreamReader) Read(dst []byte) (n int, err error) {
    n, err = r.R.Read(dst)
    if n <= 0 { return }
    r.S.XORKeyStream(dst[:n], dst[:n])
    return
}

@minux It can happen, for example with syscall.Read due to the convention of returning negative numbers for errors.

Yeah, there's nothing to fix here. -1 is not a valid return value from an io.Reader, which has a different contract from the syscall package.

Normally when a function returns a value and an error, the value is ignored if the error is non-nil, but io.Reader specifically says that both the integer and error are used.

As @minux pointed out, it's documented as needing to be >= 0.