crypto/tls: panic: runtime error: slice bounds out of range [33554436:274]

[hktalent]

Go version

go version go1.21.4 darwin/amd64

What operating system and processor architecture are you using (go env)?

GO111MODULE='on'
GOARCH='amd64'
GOBIN=''
GOCACHE='/Users/51pwn/Library/Caches/go-build'
GOENV='/Users/51pwn/Library/Application Support/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFLAGS=''
GOHOSTARCH='amd64'
GOHOSTOS='darwin'
GOINSECURE=''
GOMODCACHE='/Users/51pwn/go/pkg/mod'
GONOPROXY='github.com/hktalent/zbServer'
GONOSUMDB='github.com/hktalent/zbServer'
GOOS='darwin'
GOPATH='/Users/51pwn/go'
GOPRIVATE='github.com/hktalent/zbServer'
GOPROXY='https://goproxy.cn'
GOROOT='/usr/local/go/'
GOSUMDB='sum.golang.org'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/darwin_amd64'
GOVCS=''
GOVERSION='go1.21.4'
GCCGO='gccgo'
GOAMD64='v1'
AR='ar'
CC='clang'
CXX='clang++'
CGO_ENABLED='1'
GOMOD='/dev/null'
GOWORK=''
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
PKG_CONFIG='pkg-config'
GOGCCFLAGS='-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -ffile-prefix-map=/var/folders/_l/pnb2t_9s0f192bqlz1348vpr0000gn/T/go-build598805700=/tmp/go-build -gno-record-gcc-switches -fno-common'

What did you do?

I compiled and ran a program to get ssl information, got ssl information for many targets, and sent errors after running many targets correctly

What did you expect to see?

panic: runtime error: slice bounds out of range [33554436:274]

goroutine 4377340 [running]:
internal/poll.(*FD).Write(0xc0267cee80, {0xc01f495400, 0x112, 0x500})
/usr/local/go/src/internal/poll/fd_unix.go:380 +0x469
net.(*netFD).Write(0xc0267cee80, {0xc01f495400?, 0x100?, 0x0?})
/usr/local/go/src/net/fd_posix.go:96 +0x25
net.(*conn).Write(0xc02b999010, {0xc01f495400?, 0x1002559c0?, 0xc03b519200?})
/usr/local/go/src/net/net.go:191 +0x45
crypto/tls.(*Conn).write(0xc009a8a700, {0xc01f495400?, 0x5?, 0xc03b519200?})
/usr/local/go/src/crypto/tls/conn.go:944 +0x109
crypto/tls.(*Conn).writeRecordLocked(0xc009a8a700, 0x16, {0xc02556a600, 0x10d, 0x180})
/usr/local/go/src/crypto/tls/conn.go:1025 +0x68e
crypto/tls.(*Conn).writeHandshakeRecord(0xc009a8a700, {0x1012df0e0?, 0xc03b519200?}, {0x0, 0x0})
/usr/local/go/src/crypto/tls/conn.go:1056 +0x146
crypto/tls.(*Conn).clientHandshake(0xc009a8a700, {0x1012e5748?, 0xc0295d4e10})
/usr/local/go/src/crypto/tls/handshake_client.go:208 +0x1ce
crypto/tls.(*Conn).handshakeContext(0xc009a8a700, {0x1012e57f0, 0x101d40a20})
/usr/local/go/src/crypto/tls/conn.go:1552 +0x3d3
crypto/tls.(*Conn).HandshakeContext(...)
/usr/local/go/src/crypto/tls/conn.go:1492
net/http.(*persistConn).addTLS.func2()
/usr/local/go/src/net/http/transport.go:1555 +0x6d
created by net/http.(*persistConn).addTLS in goroutine 4376218
/usr/local/go/src/net/http/transport.go:1551 +0x31b
(base) 51pwn@51pwn-2 zq $

What did you see instead?

I compiled and ran a program to get ssl information, got ssl information for many targets, and sent errors after running many targets correctly

[panjf2000]

Could you provide a reproducible code example for us to diagnose?

[hktalent]

The probability of occurrence is very low. I ran it several times with different target lists, and only one such exception occurred. Looking at the stack, it seems to have no connection with my code.

"github.com/projectdiscovery/fastdialer/fastdialer"

func GetFastTls(ss string) (*tls.Conn, context.CancelFunc) {
	ctx, cancel := context.WithTimeout(context.Background(), TimeOut*30)

	config := &tls.Config{}
	ServerName := strings.Split(ss, ":")[0]
	if !ipReg.Match([]byte(ServerName)) {
		config.ServerName = ServerName
	}
	conn, err := Fd.DialTLS(ctx, "tcp", ss)
	if err != nil || conn == nil {
		return nil, cancel
	}
	err = conn.SetReadDeadline(time.Now().Add(TimeOut * time.Second))
	if conn3, ok := conn.(*tls.Conn); !ok {
		return nil, cancel
	} else {
		return conn3, cancel
	}
}

[mateusz834]

Similar thing happens in #61060 (#61060 (comment)).
It even has the same left index: #61060 (comment)