crypto/x509: SecPolicyCreateSSL returns null when binary is called with strange path

[radhus]

What version of Go are you using (go version)?

$ go version
go version go1.19 darwin/arm64

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="arm64"
GOBIN=""
GOCACHE="/Users/william/Library/Caches/go-build"
GOENV="/Users/william/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="arm64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/william/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/william/go"
GOPRIVATE=""
GOPROXY="direct"
GOROOT="/opt/homebrew/Cellar/go/1.19/libexec"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/opt/homebrew/Cellar/go/1.19/libexec/pkg/tool/darwin_arm64"
GOVCS=""
GOVERSION="go1.19"
GCCGO="gccgo"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/william/dev/oss/repro-go-1/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/cy/3r4j16gn1zv67w4pxmf7kwjr0000gn/T/go-build670127871=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

Running a compiled Go binary with a strange path causes crashes that are very similar to #51759, so perhaps the crash is rather in crypto/x509 than in net/http.

I can only reproduce it when calling the Go binary with a path that includes a double slash // and a directory that starts with a dot .. I have no idea why this is or how to further debug is.

This reproducing script sets up a minimal folder structure, build the tool and runs it in a way that causes crashes:

#!/bin/sh

cd $(mktemp -d)
go mod init repro

cat > main.go <<EOF
package main

import (
	"log"
	"net/http"
	"os"
)

func main() {
	res, err := http.Get("https://google.com")
	if err != nil {
		log.Fatal(err)
	}
	res.Write(os.Stdout)
}
EOF

mkdir -p dir .dot
go build -o ./.dot/repro .
$(pwd)/dir//../.dot/repro

Calling it e.g. with $(pwd)/dir/../.dot/repro, $(pwd)//.dot/repro, or $(pwd)/.dot/repro does not cause the same crash.

What did you expect to see?

HTML output from https://google.com.

What did you see instead?

Panic, see hidden long panic text below:

Full panic output

go: creating new go.mod: module repro
SIGTRAP: trace trap
PC=0x197eb5458 m=5 sigcode=0
goroutine 0 [idle]:

crypto/x509/internal/macos.syscall(0x14000100000?, 0x140000ba1e0?, 0x1400013b1e8?, 0x1027d7378?, 0x1400013b1b8?, 0x1028dfd20?, 0x102a34420?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/sys_darwin.go:99 +0x5c fp=0x1400013b150 sp=0x1400013b0b0 pc=0x102803d1c

crypto/x509/internal/macos.CFRelease(0x140000ba1e0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:156 +0x40 fp=0x1400013b1a0 sp=0x1400013b150 pc=0x1028df930

crypto/x509/internal/macos.ReleaseCFArray(0x1400013b228?)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:211 +0x30 fp=0x1400013b1d0 sp=0x1400013b1a0 pc=0x1028dfbc0

crypto/x509.(*Certificate).systemVerify.func2()

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:34 +0x28 fp=0x1400013b1f0 sp=0x1400013b1d0 pc=0x1028e77a8

runtime.deferreturn()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/panic.go:476 +0x34 fp=0x1400013b230 sp=0x1400013b1f0 pc=0x1027d7384

crypto/x509.(*Certificate).systemVerify(0x140000d8000, 0x1400013b5f0)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:40 +0x360 fp=0x1400013b490 sp=0x1400013b230 pc=0x1028e72a0

crypto/x509.(*Certificate).Verify(0x140000d8000, {{0x1400012e290, 0xa}, 0x140000927e0, 0x0, {0xc0b906432398fdc8, 0x327a142, 0x102bc0fe0}, {0x0, 0x0, ...}, ...})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/verify.go:768 +0x474 fp=0x1400013b5e0 sp=0x1400013b490 pc=0x1028eaca4

crypto/tls.(*Conn).verifyServerCertificate(0x14000098000, {0x140000914a0, 0x3, 0x4})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:874 +0x4fc fp=0x1400013b870 sp=0x1400013b5e0 pc=0x1029001ac

crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate(0x1400013bc78)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:461 +0x274 fp=0x1400013ba80 sp=0x1400013b870 pc=0x102902754

crypto/tls.(*clientHandshakeStateTLS13).handshake(0x1400013bc78)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:91 +0x1bc fp=0x1400013bac0 sp=0x1400013ba80 pc=0x102900b7c

crypto/tls.(*Conn).clientHandshake(0x14000098000, {0x102a5ca78, 0x140000a0040})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:224 +0x440 fp=0x1400013bd50 sp=0x1400013bac0 pc=0x1028fc7e0

crypto/tls.(*Conn).clientHandshake-fm({0x102a5ca78?, 0x140000a0040?})

:1 +0x3c fp=0x1400013bd80 sp=0x1400013bd50 pc=0x10291d9dc

crypto/tls.(*Conn).handshakeContext(0x14000098000, {0x102a5cab0, 0x1400012e008})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1462 +0x2dc fp=0x1400013bf60 sp=0x1400013bd80 pc=0x1028faf0c

crypto/tls.(*Conn).HandshakeContext(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1405

net/http.(*persistConn).addTLS.func2()

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1538 +0x6c fp=0x1400013bfd0 sp=0x1400013bf60 pc=0x10296cb8c

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x1400013bfd0 sp=0x1400013bfd0 pc=0x102807164

created by net/http.(*persistConn).addTLS

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1534 +0x2cc
goroutine 34 [syscall]:

crypto/x509/internal/macos.syscall(0x14000100000?, 0x140000ba1e0?, 0x1400013b1e8?, 0x1027d7378?, 0x1400013b1b8?, 0x1028dfd20?, 0x102a34420?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/sys_darwin.go:99 +0x5c fp=0x1400013b150 sp=0x1400013b0b0 pc=0x102803d1c

crypto/x509/internal/macos.CFRelease(0x140000ba1e0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:156 +0x40 fp=0x1400013b1a0 sp=0x1400013b150 pc=0x1028df930

crypto/x509/internal/macos.ReleaseCFArray(0x1400013b228?)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:211 +0x30 fp=0x1400013b1d0 sp=0x1400013b1a0 pc=0x1028dfbc0

crypto/x509.(*Certificate).systemVerify.func2()

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:34 +0x28 fp=0x1400013b1f0 sp=0x1400013b1d0 pc=0x1028e77a8

runtime.deferreturn()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/panic.go:476 +0x34 fp=0x1400013b230 sp=0x1400013b1f0 pc=0x1027d7384

crypto/x509.(*Certificate).systemVerify(0x140000d8000, 0x1400013b5f0)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:40 +0x360 fp=0x1400013b490 sp=0x1400013b230 pc=0x1028e72a0

crypto/x509.(*Certificate).Verify(0x140000d8000, {{0x1400012e290, 0xa}, 0x140000927e0, 0x0, {0xc0b906432398fdc8, 0x327a142, 0x102bc0fe0}, {0x0, 0x0, ...}, ...})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/x509/verify.go:768 +0x474 fp=0x1400013b5e0 sp=0x1400013b490 pc=0x1028eaca4

crypto/tls.(*Conn).verifyServerCertificate(0x14000098000, {0x140000914a0, 0x3, 0x4})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:874 +0x4fc fp=0x1400013b870 sp=0x1400013b5e0 pc=0x1029001ac

crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate(0x1400013bc78)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:461 +0x274 fp=0x1400013ba80 sp=0x1400013b870 pc=0x102902754

crypto/tls.(*clientHandshakeStateTLS13).handshake(0x1400013bc78)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:91 +0x1bc fp=0x1400013bac0 sp=0x1400013ba80 pc=0x102900b7c

crypto/tls.(*Conn).clientHandshake(0x14000098000, {0x102a5ca78, 0x140000a0040})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:224 +0x440 fp=0x1400013bd50 sp=0x1400013bac0 pc=0x1028fc7e0

crypto/tls.(*Conn).clientHandshake-fm({0x102a5ca78?, 0x140000a0040?})

:1 +0x3c fp=0x1400013bd80 sp=0x1400013bd50 pc=0x10291d9dc

crypto/tls.(*Conn).handshakeContext(0x14000098000, {0x102a5cab0, 0x1400012e008})

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1462 +0x2dc fp=0x1400013bf60 sp=0x1400013bd80 pc=0x1028faf0c

crypto/tls.(*Conn).HandshakeContext(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1405

net/http.(*persistConn).addTLS.func2()

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1538 +0x6c fp=0x1400013bfd0 sp=0x1400013bf60 pc=0x10296cb8c

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x1400013bfd0 sp=0x1400013bfd0 pc=0x102807164

created by net/http.(*persistConn).addTLS

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1534 +0x2cc
goroutine 1 [select]:

runtime.gopark(0x1400013f7b0?, 0x4?, 0xe8?, 0xf4?, 0x1400013f658?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xe4 fp=0x1400013f4c0 sp=0x1400013f4a0 pc=0x1027db014

runtime.selectgo(0x1400013f7b0, 0x1400013f650, 0x1400011ad20?, 0x0, 0x1400013f628?, 0x1)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/select.go:328 +0x688 fp=0x1400013f5e0 sp=0x1400013f4c0 pc=0x1027ead78

net/http.(*Transport).getConn(0x102bbb7c0, 0x140001581c0, {{}, 0x0, {0x102980a38, 0x5}, {0x1400012e290, 0xe}, 0x0})

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1376 +0x448 fp=0x1400013f800 sp=0x1400013f5e0 pc=0x10296b588

net/http.(*Transport).roundTrip(0x102bbb7c0, 0x1400017a000)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:582 +0x658 fp=0x1400013fa30 sp=0x1400013f800 pc=0x102967978

net/http.(*Transport).RoundTrip(0x10?, 0x102a5ab80?)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/roundtrip.go:17 +0x1c fp=0x1400013fa50 sp=0x1400013fa30 pc=0x10295f12c

net/http.send(0x1400017a000, {0x102a5ab80, 0x102bbb7c0}, {0x10293fd8c?, 0x8?, 0x0?})

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/client.go:251 +0x4f4 fp=0x1400013fc50 sp=0x1400013fa50 pc=0x10293e634

net/http.(*Client).send(0x102bc0d40, 0x1400017a000, {0x1400013fd08?, 0x1027b118c?, 0x0?})

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/client.go:175 +0x98 fp=0x1400013fcd0 sp=0x1400013fc50 pc=0x10293dfd8

net/http.(*Client).do(0x102bc0d40, 0x1400017a000)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/client.go:715 +0x6e8 fp=0x1400013fed0 sp=0x1400013fcd0 pc=0x10293fde8

net/http.(*Client).Do(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/client.go:581

net/http.(*Client).Get(0x1027a5514?, {0x102980a38?, 0x1400004a768?})

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/client.go:479 +0x78 fp=0x1400013ff30 sp=0x1400013fed0 pc=0x10293f5f8

net/http.Get(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/client.go:448

main.main()

/var/folders/cy/3r4j16gn1zv67w4pxmf7kwjr0000gn/T/tmp.ycttMIXQ/main.go:10 +0x34 fp=0x1400013ff70 sp=0x1400013ff30 pc=0x10297c834

runtime.main()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:250 +0x24c fp=0x1400013ffd0 sp=0x1400013ff70 pc=0x1027dac4c

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x1400013ffd0 sp=0x1400013ffd0 pc=0x102807164
goroutine 2 [force gc (idle)]:

runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xe4 fp=0x1400004afa0 sp=0x1400004af80 pc=0x1027db014

runtime.goparkunlock(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:369

runtime.forcegchelper()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:302 +0xac fp=0x1400004afd0 sp=0x1400004afa0 pc=0x1027daeac

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x1400004afd0 sp=0x1400004afd0 pc=0x102807164

created by runtime.init.6

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:290 +0x24
goroutine 3 [GC sweep wait]:

runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xe4 fp=0x1400004b770 sp=0x1400004b750 pc=0x1027db014

runtime.goparkunlock(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:369

runtime.bgsweep(0x0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgcsweep.go:278 +0xa4 fp=0x1400004b7b0 sp=0x1400004b770 pc=0x1027c8534

runtime.gcenable.func1()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgc.go:178 +0x28 fp=0x1400004b7d0 sp=0x1400004b7b0 pc=0x1027bcd78

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x1400004b7d0 sp=0x1400004b7d0 pc=0x102807164

created by runtime.gcenable

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgc.go:178 +0x74
goroutine 4 [GC scavenge wait]:

runtime.gopark(0x14000072000?, 0x1029f1850?, 0x1?, 0x0?, 0x0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xe4 fp=0x1400004bf50 sp=0x1400004bf30 pc=0x1027db014

runtime.goparkunlock(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:369

runtime.(*scavengerState).park(0x102bc1060)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgcscavenge.go:389 +0x5c fp=0x1400004bf80 sp=0x1400004bf50 pc=0x1027c64ec

runtime.bgscavenge(0x0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgcscavenge.go:617 +0x44 fp=0x1400004bfb0 sp=0x1400004bf80 pc=0x1027c6a94

runtime.gcenable.func2()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgc.go:179 +0x28 fp=0x1400004bfd0 sp=0x1400004bfb0 pc=0x1027bcd18

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x1400004bfd0 sp=0x1400004bfd0 pc=0x102807164

created by runtime.gcenable

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mgc.go:179 +0xb8
goroutine 18 [finalizer wait]:

runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xe4 fp=0x14000046580 sp=0x14000046560 pc=0x1027db014

runtime.goparkunlock(...)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:369

runtime.runfinq()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mfinal.go:180 +0x120 fp=0x140000467d0 sp=0x14000046580 pc=0x1027bbfa0

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x140000467d0 sp=0x140000467d0 pc=0x102807164

created by runtime.createfing

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/mfinal.go:157 +0x84
goroutine 19 [chan receive]:

runtime.gopark(0x102bf1c60?, 0x102cfc5e0?, 0x78?, 0x17?, 0x1027b133c?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xe4 fp=0x140001416f0 sp=0x140001416d0 pc=0x1027db014

runtime.chanrecv(0x14000090060, 0x140001418d8, 0x1)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/chan.go:583 +0x454 fp=0x14000141780 sp=0x140001416f0 pc=0x1027aaa54

runtime.chanrecv1(0x1400017e000?, 0x1400009a010?)

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/chan.go:442 +0x14 fp=0x140001417b0 sp=0x14000141780 pc=0x1027aa5f4

net/http.(*persistConn).addTLS(0x1400014c480, {0x102a5cab0?, 0x1400012e008}, {0x1400012e290, 0xa}, 0x0)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1544 +0x2dc fp=0x140001419a0 sp=0x140001417b0 pc=0x10296c93c

net/http.(*Transport).dialConn(0x102bbb7c0, {0x102a5cab0, 0x1400012e008}, {{}, 0x0, {0x102980a38, 0x5}, {0x1400012e290, 0xe}, 0x0})

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1618 +0x780 fp=0x14000141ec0 sp=0x140001419a0 pc=0x10296d3f0

net/http.(*Transport).dialConnFor(0x0?, 0x1400015c2c0)

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1450 +0x80 fp=0x14000141fb0 sp=0x14000141ec0 pc=0x10296bfd0

net/http.(*Transport).queueForDial.func1()

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1419 +0x2c fp=0x14000141fd0 sp=0x14000141fb0 pc=0x10296bf1c

runtime.goexit()

/opt/homebrew/Cellar/go/1.19/libexec/src/runtime/asm_arm64.s:1165 +0x4 fp=0x14000141fd0 sp=0x14000141fd0 pc=0x102807164

created by net/http.(*Transport).queueForDial

/opt/homebrew/Cellar/go/1.19/libexec/src/net/http/transport.go:1419 +0x398
r0      0x0

r1      0x0

r2      0x0

r3      0x0

r4      0x0

r5      0x14000102f30

r6      0x102bf0db1

r7      0x1

r8      0x1980dee91

r9      0x1edebb000

r10     0x6000137d1968

r11     0x1

r12     0x1028e0540

r13     0x16d886f00

r14     0x1029f1850

r15     0x1f06ed8d8

r16     0x102b84000

r17     0x197ce8290

r18     0x0

r19     0xc

r20     0x1400013b230

r21     0x3

r22     0xd

r23     0x5a

r24     0x4e7b8f8b91b24de2

r25     0xd265af7a4013c97f

r26     0x1400013b2e8

r27     0x848

r28     0x140001021a0

r29     0x16d886ed0

lr      0x197ce839c

sp      0x16d886ed0

pc      0x197eb5458

fault   0x197eb5458

/cc @bradfitz
as you reported the very similar ticket #51759, would be interesting to see if you can reproduce this the same way.

[rubda]

Crashes for me as well, running this on an Intel macOS.

go version
go version go1.19 darwin/amd64

Full panic output

go: creating new go.mod: module repro
SIGILL: illegal instruction
PC=0x7ff81e7a103a m=4 sigcode=1
instruction bytes: 0xf 0xb 0x48 0x8d 0x5 0x88 0xee 0x20 0x0 0x48 0x89 0x5 0xc6 0x29 0x59 0x41

goroutine 0 [idle]:
crypto/x509/internal/macos.syscall(0xc0000b21e0?, 0x0?, 0x1173a60?, 0xc000119208?, 0x100bb8b?, 0x1257b00?, 0xc0000b21e0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/sys_darwin.go:99 +0x95 fp=0xc0001191b8 sp=0xc000119118 pc=0x10617d5
crypto/x509/internal/macos.CFRelease(0xc000119260?)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:156 +0x34 fp=0xc000119200 sp=0xc0001191b8 pc=0x1172cf4
crypto/x509/internal/macos.ReleaseCFArray(0xc000119278?)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:211 +0x2c fp=0xc000119230 sp=0xc000119200 pc=0x1172f6c
crypto/x509.(*Certificate).systemVerify.func2()
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:34 +0x26 fp=0xc000119248 sp=0xc000119230 pc=0x117c146
runtime.deferreturn()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/panic.go:476 +0x33 fp=0xc000119288 sp=0xc000119248 pc=0x1034133
crypto/x509.(*Certificate).systemVerify(0xc0000d0000, 0xc000119620)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:40 +0x529 fp=0xc0001194e0 sp=0xc000119288 pc=0x117ba89
crypto/x509.(*Certificate).Verify(0xc0000d0000, {{0xc00001a320, 0xa}, 0xc0000927e0, 0x0, {0xc0b93c0d1196bb38, 0x1fef535, 0x1461f60}, {0x0, 0x0, ...}, ...})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/verify.go:768 +0x4e7 fp=0xc000119620 sp=0xc0001194e0 pc=0x117ff07
crypto/tls.(*Conn).verifyServerCertificate(0xc000098000, {0xc0000914a0, 0x3, 0x4})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:874 +0x679 fp=0xc0001198a8 sp=0xc000119620 pc=0x1197f39
crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate(0xc000119ca0)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:461 +0x2d2 fp=0xc000119ab8 sp=0xc0001198a8 pc=0x119a812
crypto/tls.(*clientHandshakeStateTLS13).handshake(0xc000119ca0)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:91 +0x1f3 fp=0xc000119af0 sp=0xc000119ab8 pc=0x1198933
crypto/tls.(*Conn).clientHandshake(0xc000098000, {0x12f3c78, 0xc0000a0040})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:224 +0x585 fp=0xc000119d80 sp=0xc000119af0 pc=0x1193885
crypto/tls.(*Conn).clientHandshake-fm({0x12f3c78?, 0xc0000a0040?})
	<autogenerated>:1 +0x39 fp=0xc000119da8 sp=0xc000119d80 pc=0x11b69b9
crypto/tls.(*Conn).handshakeContext(0xc000098000, {0x12f3cb0, 0xc00001a098})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1462 +0x32f fp=0xc000119f70 sp=0xc000119da8 pc=0x1191bcf
crypto/tls.(*Conn).HandshakeContext(...)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1405
net/http.(*persistConn).addTLS.func2()
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1538 +0x71 fp=0xc000119fe0 sp=0xc000119f70 pc=0x120b231
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc000119fe8 sp=0xc000119fe0 pc=0x1064a61
created by net/http.(*persistConn).addTLS
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1534 +0x345

goroutine 18 [syscall]:
crypto/x509/internal/macos.syscall(0xc0000b21e0?, 0x0?, 0x1173a60?, 0xc000119208?, 0x100bb8b?, 0x1257b00?, 0xc0000b21e0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/sys_darwin.go:99 +0x95 fp=0xc0001191b8 sp=0xc000119118 pc=0x10617d5
crypto/x509/internal/macos.CFRelease(0xc000119260?)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:156 +0x34 fp=0xc000119200 sp=0xc0001191b8 pc=0x1172cf4
crypto/x509/internal/macos.ReleaseCFArray(0xc000119278?)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/internal/macos/corefoundation.go:211 +0x2c fp=0xc000119230 sp=0xc000119200 pc=0x1172f6c
crypto/x509.(*Certificate).systemVerify.func2()
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:34 +0x26 fp=0xc000119248 sp=0xc000119230 pc=0x117c146
runtime.deferreturn()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/panic.go:476 +0x33 fp=0xc000119288 sp=0xc000119248 pc=0x1034133
crypto/x509.(*Certificate).systemVerify(0xc0000d0000, 0xc000119620)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/root_darwin.go:40 +0x529 fp=0xc0001194e0 sp=0xc000119288 pc=0x117ba89
crypto/x509.(*Certificate).Verify(0xc0000d0000, {{0xc00001a320, 0xa}, 0xc0000927e0, 0x0, {0xc0b93c0d1196bb38, 0x1fef535, 0x1461f60}, {0x0, 0x0, ...}, ...})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/x509/verify.go:768 +0x4e7 fp=0xc000119620 sp=0xc0001194e0 pc=0x117ff07
crypto/tls.(*Conn).verifyServerCertificate(0xc000098000, {0xc0000914a0, 0x3, 0x4})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:874 +0x679 fp=0xc0001198a8 sp=0xc000119620 pc=0x1197f39
crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate(0xc000119ca0)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:461 +0x2d2 fp=0xc000119ab8 sp=0xc0001198a8 pc=0x119a812
crypto/tls.(*clientHandshakeStateTLS13).handshake(0xc000119ca0)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client_tls13.go:91 +0x1f3 fp=0xc000119af0 sp=0xc000119ab8 pc=0x1198933
crypto/tls.(*Conn).clientHandshake(0xc000098000, {0x12f3c78, 0xc0000a0040})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/handshake_client.go:224 +0x585 fp=0xc000119d80 sp=0xc000119af0 pc=0x1193885
crypto/tls.(*Conn).clientHandshake-fm({0x12f3c78?, 0xc0000a0040?})
	<autogenerated>:1 +0x39 fp=0xc000119da8 sp=0xc000119d80 pc=0x11b69b9
crypto/tls.(*Conn).handshakeContext(0xc000098000, {0x12f3cb0, 0xc00001a098})
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1462 +0x32f fp=0xc000119f70 sp=0xc000119da8 pc=0x1191bcf
crypto/tls.(*Conn).HandshakeContext(...)
	/usr/local/Cellar/go/1.19/libexec/src/crypto/tls/conn.go:1405
net/http.(*persistConn).addTLS.func2()
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1538 +0x71 fp=0xc000119fe0 sp=0xc000119f70 pc=0x120b231
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc000119fe8 sp=0xc000119fe0 pc=0x1064a61
created by net/http.(*persistConn).addTLS
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1534 +0x345

goroutine 1 [select]:
runtime.gopark(0xc0001277e8?, 0x4?, 0x18?, 0x0?, 0xc000127690?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xd6 fp=0xc0001274e8 sp=0xc0001274c8 pc=0x1038116
runtime.selectgo(0xc0001277e8, 0xc000127688, 0xc000016d60?, 0x0, 0x0?, 0x1)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/select.go:328 +0x7bc fp=0xc000127628 sp=0xc0001274e8 pc=0x10473bc
net/http.(*Transport).getConn(0x145c740, 0xc000074200, {{}, 0x0, {0x12806da, 0x5}, {0xc00001a320, 0xe}, 0x0})
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1376 +0x5c6 fp=0xc000127840 sp=0xc000127628 pc=0x1209766
net/http.(*Transport).roundTrip(0x145c740, 0xc000154000)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:582 +0x75e fp=0xc000127a68 sp=0xc000127840 pc=0x120561e
net/http.(*Transport).RoundTrip(0x100e627?, 0x12f1b40?)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/roundtrip.go:17 +0x19 fp=0xc000127a88 sp=0xc000127a68 pc=0x11fc359
net/http.send(0xc000154000, {0x12f1b40, 0x145c740}, {0x1273f80?, 0x1?, 0x0?})
	/usr/local/Cellar/go/1.19/libexec/src/net/http/client.go:251 +0x5f7 fp=0xc000127c80 sp=0xc000127a88 pc=0x11d9997
net/http.(*Client).send(0x1461cc0, 0xc000154000, {0x0?, 0xc000127d28?, 0x0?})
	/usr/local/Cellar/go/1.19/libexec/src/net/http/client.go:175 +0x9b fp=0xc000127cf8 sp=0xc000127c80 pc=0x11d921b
net/http.(*Client).do(0x1461cc0, 0xc000154000)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/client.go:715 +0x8fc fp=0xc000127ee8 sp=0xc000127cf8 pc=0x11db55c
net/http.(*Client).Do(...)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/client.go:581
net/http.(*Client).Get(0x10049b1?, {0x12806da?, 0x0?})
	/usr/local/Cellar/go/1.19/libexec/src/net/http/client.go:479 +0x6a fp=0xc000127f40 sp=0xc000127ee8 pc=0x11dab2a
net/http.Get(...)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/client.go:448
main.main()
	/var/folders/ff/qvdhxnh558nfym1mwfclz1fc0000gp/T/tmp.GUyMDtQ0/main.go:10 +0x2c fp=0xc000127f80 sp=0xc000127f40 pc=0x121b28c
runtime.main()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:250 +0x212 fp=0xc000127fe0 sp=0xc000127f80 pc=0x1037d52
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc000127fe8 sp=0xc000127fe0 pc=0x1064a61

goroutine 2 [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xd6 fp=0xc00004afb0 sp=0xc00004af90 pc=0x1038116
runtime.goparkunlock(...)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:369
runtime.forcegchelper()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:302 +0xad fp=0xc00004afe0 sp=0xc00004afb0 pc=0x1037fad
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc00004afe8 sp=0xc00004afe0 pc=0x1064a61
created by runtime.init.6
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:290 +0x25

goroutine 3 [GC sweep wait]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xd6 fp=0xc00004b790 sp=0xc00004b770 pc=0x1038116
runtime.goparkunlock(...)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:369
runtime.bgsweep(0x0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgcsweep.go:278 +0x8e fp=0xc00004b7c8 sp=0xc00004b790 pc=0x102546e
runtime.gcenable.func1()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgc.go:178 +0x26 fp=0xc00004b7e0 sp=0xc00004b7c8 pc=0x101a326
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc00004b7e8 sp=0xc00004b7e0 pc=0x1064a61
created by runtime.gcenable
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgc.go:178 +0x6b

goroutine 4 [GC scavenge wait]:
runtime.gopark(0xc000072000?, 0x12f0900?, 0x1?, 0x0?, 0x0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xd6 fp=0xc00004bf70 sp=0xc00004bf50 pc=0x1038116
runtime.goparkunlock(...)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:369
runtime.(*scavengerState).park(0x1461fe0)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgcscavenge.go:389 +0x53 fp=0xc00004bfa0 sp=0xc00004bf70 pc=0x1023513
runtime.bgscavenge(0x0?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgcscavenge.go:617 +0x45 fp=0xc00004bfc8 sp=0xc00004bfa0 pc=0x1023ae5
runtime.gcenable.func2()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgc.go:179 +0x26 fp=0xc00004bfe0 sp=0xc00004bfc8 pc=0x101a2c6
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc00004bfe8 sp=0xc00004bfe0 pc=0x1064a61
created by runtime.gcenable
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mgc.go:179 +0xaa

goroutine 5 [finalizer wait]:
runtime.gopark(0x1462560?, 0xc000007860?, 0x0?, 0x0?, 0xc00004a770?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xd6 fp=0xc00004a628 sp=0xc00004a608 pc=0x1038116
runtime.goparkunlock(...)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:369
runtime.runfinq()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mfinal.go:180 +0x10f fp=0xc00004a7e0 sp=0xc00004a628 pc=0x101942f
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc00004a7e8 sp=0xc00004a7e0 pc=0x1064a61
created by runtime.createfing
	/usr/local/Cellar/go/1.19/libexec/src/runtime/mfinal.go:157 +0x45

goroutine 6 [chan receive]:
runtime.gopark(0x1492da0?, 0xc00011d7a0?, 0x3d?, 0xe4?, 0x15585b8?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/proc.go:363 +0xd6 fp=0xc00011d720 sp=0xc00011d700 pc=0x1038116
runtime.chanrecv(0xc000090060, 0xc00011d8f0, 0x1)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/chan.go:583 +0x49b fp=0xc00011d7b0 sp=0xc00011d720 pc=0x100791b
runtime.chanrecv1(0xc000158000?, 0xc00009a010?)
	/usr/local/Cellar/go/1.19/libexec/src/runtime/chan.go:442 +0x18 fp=0xc00011d7d8 sp=0xc00011d7b0 pc=0x1007458
net/http.(*persistConn).addTLS(0xc00012a480, {0x12f3cb0?, 0xc00001a098}, {0xc00001a320, 0xa}, 0x0)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1544 +0x365 fp=0xc00011d9c0 sp=0xc00011d7d8 pc=0x120af65
net/http.(*Transport).dialConn(0x145c740, {0x12f3cb0, 0xc00001a098}, {{}, 0x0, {0x12806da, 0x5}, {0xc00001a320, 0xe}, 0x0})
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1618 +0x9e5 fp=0xc00011ded8 sp=0xc00011d9c0 pc=0x120bd05
net/http.(*Transport).dialConnFor(0x0?, 0xc0001362c0)
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1450 +0xb0 fp=0xc00011dfc0 sp=0xc00011ded8 pc=0x120a3f0
net/http.(*Transport).queueForDial.func1()
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1419 +0x2a fp=0xc00011dfe0 sp=0xc00011dfc0 pc=0x120a30a
runtime.goexit()
	/usr/local/Cellar/go/1.19/libexec/src/runtime/asm_amd64.s:1594 +0x1 fp=0xc00011dfe8 sp=0xc00011dfe0 pc=0x1064a61
created by net/http.(*Transport).queueForDial
	/usr/local/Cellar/go/1.19/libexec/src/net/http/transport.go:1419 +0x3f2

rax    0x7ff81e9afea6
rbx    0xc000119128
rcx    0x0
rdx    0x0
rdi    0x0
rsi    0x0
rbp    0x70000c7d4ec0
rsp    0x70000c7d4eb8
r8     0x0
r9     0x0
r10    0x7ff85fb5cd38
r11    0x1173980
r12    0x0
r13    0x8
r14    0xc000148340
r15    0x220590f
rip    0x7ff81e7a103a
rflags 0x10246
cs     0x2b
fs     0x0
gs     0x0

[radhus]

I can only reproduce this with Go 1.18 and 1.19, not 1.17. Changed the title as it feels like the crash is in the crypto/x509 changes in 1.18 for macOS.

[dr2chase]

It also fails with tip. I agree this looks like some obscure bug in crypto/x509.
@golang/security

[gopherbot]

Change https://go.dev/cl/438135 mentions this issue: crypto/x509/internal/macos: handle unexpected null returns

[rolandshoemaker]

Extremely weird. This appears to be a macos bug(/behavior) in SecCreatePolicySSL returning null when called in a binary with a strange path. It can be simply repro'd in obj-c:

#import <Foundation/Foundation.h>
#include <Security/SecPolicy.h>

int main()
{
   NSString *str = @"google.com";
   const char *cname = [str UTF8String];
   SecPolicyRef policy = SecPolicyCreateSSL(
        true, CFStringCreateWithCString(NULL, cname, kCFStringEncodingUTF8));
   NSLog(@"Hello, World! %p", policy);
   return 0;
}

% clang -framework Foundation -framework Security obj.m && ./a.out
2022-10-03 09:23:42.122 a.out[90636:10152704] Hello, World! 0x7fea12005a00
% clang -framework Foundation -framework Security obj.m -o .dot/a.out && $(pwd)/dir//../.dot/a.out
2022-10-03 09:24:14.316 a.out[90709:10153187] Hello, World! 0x0

The 'fix' on our end is relatively simple, and will resolve the panic, but it'll still fail when called this way.

[rolandshoemaker]

For histories sake, this appears to be triggered in particular by //.. (i.e. $(pwd)//../$(basename $(pwd))/), but no clue why. I can't see any specific reason why in the apple source (OSX/sec/Security/SecPolicy.c). Filed a Feedback with Apple for this, FB11643282.

[aviramha]

This still happens on go 1.20. It doesn't crash, it just returns invalid cert.

[rolandshoemaker]

There is nothing we can do other than failing gracefully, the ball is in Apples court.