Function __mutate_array_var

fuzz/fuzzparcel.cc:431–508

}

static size_t __mutate_array_var(ParcelData* entry, FuzzParcel* input, size_t MaxSize){
    uint32_t do_mutate_size = rand() % 10;
    VarSizeArrayEntry* varEntry = (VarSizeArrayEntry*)entry->buf;
    if(do_mutate_size == 0){
        //mutate the size of the array	
        uint32_t newSize = (rand() % 42) + 1;
        LOGD("__mutate_array_var new size: %d\n", newSize);
        if(newSize == varEntry->nrEntries){
            LOGD("__mutate_array_var size is the same: newSize %d, prev size: %d\n", newSize, varEntry->nrEntries);
            return newSize;
        }
        if(newSize < varEntry->nrEntries){
            LOGD("__mutate_array_var truncating array: newSize %d, prev size: %d\n", newSize, varEntry->nrEntries);
            varEntry->nrEntries = newSize;
            uint32_t new_data_size = 0;
            uint32_t offset = 0;
            for(int i=0; i<varEntry->nrEntries; i++){
                LenValData* lvd = (LenValData*)&varEntry->data[offset]; 
                new_data_size += lvd->size;
                offset += sizeof(uint32_t) + lvd->size;
            }
            varEntry->size = new_data_size;
            return newSize;
        } else {
            //terrible logic to add new entries
            uint32_t toAdd = newSize - varEntry->nrEntries ;
            LOGD("__mutate_array_var adding %d new entries\n", toAdd);
            uint32_t* sizes = (uint32_t*)malloc(toAdd*sizeof(uint32_t));
            uint32_t sizeNew = 0;
            for(int i=0; i<toAdd; i++){
                sizes[i] = rand() % 42 + 1;
                sizeNew += sizes[i];
            }
            uint32_t new_data_size = sizeNew + varEntry->size;
            if(input->buf_size - entry->buf_size + 2*sizeof(uint32_t) + ((2+varEntry->nrEntries)*sizeof(uint32_t)+new_data_size) > MaxSize){
                free(sizes);
                return -1;
            }
            varEntry = (VarSizeArrayEntry*)realloc(varEntry, new_data_size + (2+newSize)*sizeof(uint32_t));
            uint32_t offset = sizeof(uint32_t)*varEntry->nrEntries + varEntry->size;
            for(int i=0; i<toAdd; i++){
                LenValData* lvd = (LenValData*)&varEntry->data[offset];
                LOGD("adding new var buf entry at offset: %d, %p\n", offset, lvd);
                lvd->size = sizes[i];
                __random_fill_buffer(lvd->data, sizes[i]);
                offset += sizeof(uint32_t) + lvd->size;
            }
            varEntry->nrEntries = newSize;
            varEntry->size = new_data_size;
            entry->buf = (uint8_t*)varEntry;
            entry->buf_size = (2+varEntry->nrEntries)*sizeof(uint32_t)+varEntry->size; //nrentries,size,size for each entry + overall data size
            free(sizes);
            return entry->buf_size;
        }
    } else {
        //mutate single entry
        uint32_t idx = rand() % varEntry->nrEntries;
        //TODO support changing the size of individual entries