code: func (c *Cipher) XORKeyStream(dst, src []byte) {
  	if len(dst) < len(src) {
  		panic("chacha20/chacha: dst buffer is to small")
  	}
  
  	if c.off > 0 {
  		n := len(c.block[c.off:])
  		if len(src) <= n {
  			for i, v := range src {
  				dst[i] = v ^ c.block[c.off]
  				c.off++
  			}
  			if c.off == 64 {
  				c.off = 0
  			}
  			return
  		}
  
  		for i, v := range c.block[c.off:] {
  			dst[i] = src[i] ^ v
  		}
  		src = src[n:]
  		dst = dst[n:]
  		c.off = 0
  	}
  
  	// check for counter overflow
  	blocksToXOR := len(src) / 64
  	if len(src)%64 != 0 {
  		blocksToXOR++
  	}
  	var overflow bool
  	if c.noncesize == INonceSize {
  		overflow = binary.LittleEndian.Uint32(c.state[48:]) > math.MaxUint32-uint32(blocksToXOR)
  	} else {
  		overflow = binary.LittleEndian.Uint64(c.state[48:]) > math.MaxUint64-uint64(blocksToXOR)
  	}
  	if overflow {
  		panic("chacha20/chacha: counter overflow")
  	}
  
  	c.off += xorKeyStream(dst, src, &(c.block), &(c.state), c.rounds)
  }
docs: // XORKeyStream crypts bytes from src to dst. Src and dst may be the same slice
  // but otherwise should not overlap. If len(dst) < len(src) the function panics.