by ej@evanjones.ca:

crypto/aes/cipher_asm.go doesn't check the sizes of the input or output slices. If you
accidentally call this with a slice that is too small, it reads and writes memory past
the end of the slice, and occasionally crashes (see below).

The Go version for other platforms reliably panics with "index out of range".
Potential fix: Access dst[blockSize-1] and src[blockSize-1] before calling
encrypt/decryptBlockAsm to force the Go runtime to do the appropriate bounds checking?
I'm happy to write a patch and a test.


Relevant source:

http://golang.org/src/pkg/crypto/aes/cipher_asm.go


Crash output:

unexpected fault address 0x20904a000
fatal error: fault
[signal 0xa code=0x2 addr=0x20904a000 pc=0x2b2e7]

goroutine 16 [running]:
runtime.throw(0x1542a7)
    /usr/local/go/src/pkg/runtime/panic.c:520 +0x69 fp=0x2081c7d20
runtime.sigpanic()
    /usr/local/go/src/pkg/runtime/os_darwin.c:448 +0x25b fp=0x2081c7d38
runtime: unknown argument frame size for crypto/aes.encryptBlockAsm called from 0x2af1b
[crypto/aes.encryptBlock]
crypto/aes.encryptBlockAsm()
    /Users/ej/go-1.3beta1/src/pkg/crypto/aes/asm_amd64.s:25 +0x17 fp=0x2081c7d40
crypto/aes.encryptBlock(0x2081c00b0, 0x2c, 0x2c, 0x208238000, 0x10, 0x10, 0x209049ff8,
0x1, 0x1)
    /Users/ej/go-1.3beta1/src/pkg/crypto/aes/cipher_asm.go:19 +0x8b fp=0x2081c7d98
crypto/aes.(*aesCipher).Encrypt(0x2081ae180, 0x208238000, 0x10, 0x10, 0x209049ff8, 0x1,
0x1)
    /Users/ej/go-1.3beta1/src/pkg/crypto/aes/cipher.go:49 +0x7d fp=0x2081c7de8
main.main()
    /Users/ej/wtf.go:21 +0x2da fp=0x2081c7f50
runtime.main()
    /usr/local/go/src/pkg/runtime/proc.c:247 +0x11a fp=0x2081c7fa8
runtime.goexit()
    /usr/local/go/src/pkg/runtime/proc.c:1430 fp=0x2081c7fb0
created by _rt0_go
    /usr/local/go/src/pkg/runtime/asm_amd64.s:97 +0x120


Details:

go version devel +f8b50ad4cac4 Mon Apr 21 17:00:27 2014 -0700 + darwin/amd64


Program to reproduce this crash:

package main

import (
    "crypto/aes"
    "log"
)

func main() {
    key := make([]byte, aes.BlockSize)
    block, err := aes.NewCipher(key)
    if err != nil {
        log.Fatal("NewCipher:", err)
    }

    // keep old slices around to force allocation
    slices := [][]byte{}
    i := 0
    for {
        destination := make([]byte, aes.BlockSize)
        zeroLength := []byte{0x00}
        block.Encrypt(destination, zeroLength)
        slices = append(slices, zeroLength)

        i += 1
        log.Print(i)
    }
}