What happens when output of chacha20 is also its input?

[al-caveman]

In the code below, ChaCha20 is told to encrypt input (read from mem) into output (written to the same mem):

/* allocate memories */
unsigned char *mem = sodium_malloc(mem_size);
unsigned char *nonce = sodium_malloc(crypto_..._NONCEBYTES);
unsigned char *key   = sodium_malloc(crypto_..._KEYBYTES);

... (e.g. initialise memories)

crypto_stream_chacha20_xor(mem, mem, mem_size, nonce, key);

... (e.g. increment nonce)

My thought: From my reading of chacha20_encrypt_bytes
in src/libsodium/crypto_stream/chacha20/ref/chacha20_ref.c, I think that operation is guaranteed to have the effect of as-if input was different than output, but then input = input ^ output was done next. I.e. output is written onto input by means of XORing former's bits against latter's.

My questions:

• Is my thought correct?
• How stable is this behaviour? Because my application requires this behaviour (implementing some key derivation function off libsodium).

[enkore]

This is guaranteed to work. The docs:

m and c can point to the same address (in-place encryption/decryption). If they don't, the regions should not overlap.