x/crypto/xts: bad length check in Decrypt

[aead]

What version of Go are you using (go version)?

go version go1.8 linux/amd64

What operating system and processor architecture are you using (go env)?

GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/home/andreas/go/"
GORACE=""
GOROOT="/home/andreas/.go/root"
GOTOOLDIR="/home/andreas/.go/root/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build198035070=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"

What did you do?

package main

import (
    "fmt"
    "bytes"
    "crypto/aes"
    "golang.org/x/crypto/xts"
)

func main() {
    c, err := xts.NewCipher(aes.NewCipher, make([]byte, 32))
	if err != nil {
		panic(fmt.Sprintf("NewCipher failed: %s", err))
	}

	plaintext := make([]byte, 32)
	ciphertext := make([]byte, 32)
	plaintext2 := make([]byte, 48)

	c.Encrypt(ciphertext, plaintext, 0)
	c.Decrypt(plaintext2, ciphertext, 0)

	if !bytes.Equal(plaintext, plaintext2[:32]) {
		panic("encryption - decryption is not inverse")
	}
}

The decryption panics because the Decrypt iterates over the plaintext argument (plaintext2).
That's probably a copy-paste error - the logic looks like copied from Encrypt.

What did you expect to see?

No panic

What did you see instead?

panic: runtime error: index out of range [recovered]
        panic: runtime error: index out of range

[gopherbot]

CL https://golang.org/cl/39954 mentions this issue.