Add safe maskBytes

Fixes #200.

conn.go

@@ -10,6 +10,7 @@ import (
 	"errors"
 	"io"
 	"io/ioutil"
+	"math/rand"
 	"net"
 	"strconv"
 	"sync"
@@ -180,6 +181,11 @@ var (
 	errInvalidControlFrame = errors.New("websocket: invalid control frame")
 )
 
+func newMaskKey() [4]byte {
+	n := rand.Uint32()
+	return [4]byte{byte(n), byte(n >> 8), byte(n >> 16), byte(n >> 24)}
+}
+
 func hideTempErr(err error) error {
 	if e, ok := err.(net.Error); ok && e.Temporary() {
 		err = &netError{msg: e.Error(), timeout: e.Timeout()}

mask.go

@@ -2,20 +2,14 @@
 // this source code is governed by a BSD-style license that can be found in the
 // LICENSE file.
 
+// +build !appengine
+
 package websocket
 
-import (
-	"math/rand"
-	"unsafe"
-)
+import "unsafe"
 
 const wordSize = int(unsafe.Sizeof(uintptr(0)))
 
-func newMaskKey() [4]byte {
-	n := rand.Uint32()
-	return [4]byte{byte(n), byte(n >> 8), byte(n >> 16), byte(n >> 24)}
-}
-
 func maskBytes(key [4]byte, pos int, b []byte) int {
 
 	// Mask one byte at a time for small buffers.

mask_safe.go

@@ -0,0 +1,15 @@
+// Copyright 2016 The Gorilla WebSocket Authors. All rights reserved.  Use of
+// this source code is governed by a BSD-style license that can be found in the
+// LICENSE file.
+
+// +build appengine
+
+package websocket
+
+func maskBytes(key [4]byte, pos int, b []byte) int {
+	for i := range b {
+		b[i] ^= key[pos&3]
+		pos++
+	}
+	return pos & 3
+}

mask_test.go

@@ -3,7 +3,7 @@
 // LICENSE file.
 
 // Require 1.7 for sub-bencmarks
-// +build go1.7
+// +build go1.7,!appengine
 
 package websocket