What version of Go are you using (go version)?

go version devel +4c98ecb Thu Jul 13 17:53:10 2017 +0000 linux/amd64

Also reproducible on 1.8

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/localdisk/itocar/gopath"
GORACE=""
GOROOT="/localdisk/itocar/golang"
GOTOOLDIR="/localdisk/itocar/golang/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build497666732=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"

What did you do?

Run following program:

package main

import (
        "crypto/aes"
        "crypto/cipher"
        "fmt"
        "syscall"
)

func main() {
        const pageSize = 4 << 10
        data, err := syscall.Mmap(0, 0, 2*pageSize, syscall.PROT_READ|syscall.PROT_WRITE, syscall.MAP_ANON|syscall.MAP_PRIVATE)
        if err != nil {
                panic(err)
        }
        if err := syscall.Mprotect(data[pageSize:], syscall.PROT_NONE); err != nil {
                panic(err)
        }
        buf1 := data[pageSize-3 : pageSize]
        buf2 := make([]byte, 32)
        var key [16]byte
        var iv [16]byte
        aes, _ := aes.NewCipher(key[:])
        ctr := cipher.NewCTR(aes, iv[:])
        ctr.XORKeyStream(buf1, buf2)
        fmt.Println(buf1[5])
}

What did you expect to see?

Out of bounds write is detected and program panics before write.

What did you see instead?

unexpected fault address 0x7fdedc27b000
fatal error: fault
[signal SIGSEGV: segmentation violation code=0x2 addr=0x7fdedc27b000 pc=0x459fb2]

goroutine 1 [running]:
runtime.throw(0x4a4dc7, 0x5)
/localdisk/itocar/golang/src/runtime/panic.go:605 +0x95 fp=0xc420045dc0 sp=0xc420045da0 pc=0x426f05
runtime.sigpanic()
/localdisk/itocar/golang/src/runtime/signal_unix.go:374 +0x227 fp=0xc420045e10 sp=0xc420045dc0 pc=0x439dd7
crypto/cipher.fastXORBytes(0x7fdedc27affd, 0x3, 0x1003, 0xc420014160, 0x20, 0x20, 0xc42008c000, 0x200, 0x200, 0x10)
/localdisk/itocar/golang/src/crypto/cipher/xor.go:29 +0x52 fp=0xc420045e20 sp=0xc420045e10 pc=0x459fb2
crypto/cipher.xorBytes(0x7fdedc27affd, 0x3, 0x1003, 0xc420014160, 0x20, 0x20, 0xc42008c000, 0x200, 0x200, 0xc4200800f0)
/localdisk/itocar/golang/src/crypto/cipher/xor.go:55 +0x8e fp=0xc420045e80 sp=0xc420045e20 pc=0x45a0ee
crypto/cipher.(*ctr).XORKeyStream(0xc4200800f0, 0x7fdedc27affd, 0x3, 0x1003, 0xc420014160, 0x20, 0x20)
/localdisk/itocar/golang/src/crypto/cipher/ctr.go:78 +0x18d fp=0xc420045ee8 sp=0xc420045e80 pc=0x459edd
main.main()
/localdisk/itocar/golang/src/foo.go:28 +0x22c fp=0xc420045f80 sp=0xc420045ee8 pc=0x47791c
runtime.main()
/localdisk/itocar/golang/src/runtime/proc.go:185 +0x20d fp=0xc420045fe0 sp=0xc420045f80 pc=0x4285dd
runtime.goexit()
/localdisk/itocar/golang/src/runtime/asm_amd64.s:2337 +0x1 fp=0xc420045fe8 sp=0xc420045fe0 pc=0x450cd1
exit status 2

This problem is due to fastXORBytes writing to dst using unsafe cast into []uintptr
Without protection syscalls fastXORBytes will happily write up-to len(dst)*8 - len(dst) bytes after dst and panic inside fastXORBytes on bound check or alternatively panic in XORKeyStream on
dst = dst[n:]
This isn't that bad unless dst is located at the end of page, in which case panic message is rather unhelpful or users tries to recover, in which case several uncaught out of bounds writes have already happened.