package subtle

// XORBytes sets dst[i] = x[i] ^ y[i] for all i < n = min(len(x), len(y)),
// returning n, the number of bytes written to dst.
// If dst does not have length at least n,
// XORBytes panics without writing anything to dst.
func XORBytes(dst, x, y []byte) int {
	n := min(len(x), len(y))
	if n == 0 {
		return 0
	}
	if n > len(dst) {
		panic("subtle.XORBytes: dst too short")
	}

						want[alignD+i] = p[i] ^ q[i]
					}

					if XORBytes(d[alignD:], p, q); !bytes.Equal(d, want) {
						t.Fatalf("n=%d alignP=%d alignQ=%d alignD=%d:\n\tp = %x\n\tq = %x\n\td = %x\n\twant %x\n", n, alignP, alignQ, alignD, p, q, d, want)
					}
				}
			}
		}
	}
}

func TestXorBytesPanic(t *testing.T) {
	mustPanic(t, "subtle.XORBytes: dst too short", func() {
		XORBytes(nil, make([]byte, 1), make([]byte, 1))
	})

// Copyright 2018 The Go Authors. All rights reserved.
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build !purego

package subtle

//go:noescape

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build !purego

#include "textflag.h"

// func xorBytes(dst, a, b *byte, n int)
TEXT ·xorBytes(SB), NOSPLIT, $0
	MOVQ  dst+0(FP), BX
	MOVQ  a+8(FP), SI
	MOVQ  b+16(FP), CX
	MOVQ  n+24(FP), DX
	TESTQ $15, DX            // AND 15 & len, if not zero jump to not_aligned.
	JNZ   not_aligned

const supportsUnaligned = runtime.GOARCH == "386" ||
	runtime.GOARCH == "amd64" ||
	runtime.GOARCH == "ppc64" ||
	runtime.GOARCH == "ppc64le" ||
	runtime.GOARCH == "s390x"

func xorBytes(dstb, xb, yb *byte, n int) {
	// xorBytes assembly is written using pointers and n. Back to slices.
	dst := unsafe.Slice(dstb, n)
	x := unsafe.Slice(xb, n)
	y := unsafe.Slice(yb, n)

	if supportsUnaligned || aligned(dstb, xb, yb) {

var _ ctrAble = (*aesCipherAsm)(nil)

// xorBytes xors the contents of a and b and places the resulting values into
// dst. If a and b are not the same length then the number of bytes processed
// will be equal to the length of shorter of the two. Returns the number
// of bytes processed.
//
//go:noescape
func xorBytes(dst, a, b []byte) int

// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.

//go:build (ppc64 || ppc64le) && !purego

package subtle

//go:noescape

	}
	if alias.InexactOverlap(dst[:len(src)], src) {
		panic("crypto/cipher: invalid buffer overlap")
	}
	for len(src) > 0 {
		if x.outUsed >= len(x.out)-x.b.BlockSize() {
			x.refill()
		}
		n := subtle.XORBytes(dst, src, x.out[x.outUsed:])
		dst = dst[n:]
		src = src[n:]
		x.outUsed += n
	}

	if cpu.IsBigEndian {
		for i := 0; len(buf) >= 8; i++ {
			a := binary.LittleEndian.Uint64(buf)
			d.a[i] ^= a
			buf = buf[8:]
		}
	} else {
		ab := (*[25 * 64 / 8]byte)(unsafe.Pointer(&d.a))
		subtle.XORBytes(ab[:], ab[:], buf)
	}
}

// copyOut copies uint64s to a byte buffer.
func copyOut(d *state, b []byte) {
	if cpu.IsBigEndian {
		for i := 0; len(b) >= 8; i++ {
			binary.LittleEndian.PutUint64(b, d.a[i])

package main

import "crypto/subtle"

func main() {
	dst := make([]byte, 5)
	src := make([]byte, 5)
	for _, n := range []int{1024, 2048} { // just to make the size non-constant
		b := make([]byte, n)
		subtle.XORBytes(dst, src, b[n-5:])
	}