tree b73fe55c03bd301f6e0ecf919b5cbc310954efd3
parent 978a3f644af00159b9280009341cf881d2abdb03
author Fabian Meumertzheim <meumertzheim@code-intelligence.com> 1619799403 -0700
committer Copybara-Service <copybara-worker@google.com> 1620612661 -0700

[libFuzzer] Fix off-by-one error in ApplyDictionaryEntry

In the overwrite branch of MutationDispatcher::ApplyDictionaryEntry in
FuzzerMutate.cpp, the index Idx at which W.size() bytes are overwritten
with the word W is chosen uniformly at random in the interval
[0, Size - W.size()). This means that Idx + W.size() will always be
strictly less than Size, i.e., the last byte of the current unit will
never be overwritten.

This is fixed by adding 1 to the exclusive upper bound.

Addresses https://bugs.llvm.org/show_bug.cgi?id=49989.

Reviewed By: morehouse

Differential Revision: https://reviews.llvm.org/D101625

GitOrigin-RevId: 62e4dca94e25668c9f70abc7e524328fd5c6d5c9