Fix out-of-bounds read in ctr_XOR