From a6acd05e171be1d236f087ef7ab279cafb638109 Mon Sep 17 00:00:00 2001
From: Sam Hocevar <sam@hocevar.net>
Date: Fri, 15 Dec 2006 13:12:44 +0000
Subject: [PATCH]   * Handle percent < 100.0/CHUNK_SIZE a bit better.   * Fix a
 grave index bug in the fuzzer that made everything inconsistent.

---
 src/fuzz.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/src/fuzz.c b/src/fuzz.c
index 072572e..683c96d 100644
--- a/src/fuzz.c
+++ b/src/fuzz.c
@@ -37,33 +37,34 @@
 void zzuf_fuzz(int fd, uint8_t *buf, uint64_t len)
 {
     uint8_t bits[CHUNK_SIZE];
-    uint64_t pos;
+    uint64_t pos, offset;
     unsigned int i;
 
     pos = files[fd].pos;
+    offset = pos % CHUNK_SIZE;
 
     for(i = pos / CHUNK_SIZE; i < (pos + len) / CHUNK_SIZE + 1; i++)
     {
-        uint64_t offset;
         int todo;
 
-        offset = i * CHUNK_SIZE;
-        todo = _zzuf_percent * CHUNK_SIZE;
-
+        /* Add some random dithering to handle percent < 1.0/CHUNK_SIZE */
+        zzuf_srand(_zzuf_seed ^ (i * 0x23ea84f7));
+        todo = (int)((_zzuf_percent * CHUNK_SIZE + zzuf_rand(100)) / 100.0);
         zzuf_srand(_zzuf_seed ^ (i * 0x23ea84f7) ^ (todo * 0x783bc31f));
+
         memset(bits, 0, CHUNK_SIZE);
         while(todo--)
         {
             int idx = zzuf_rand(CHUNK_SIZE);
             uint8_t byte = (1 << zzuf_rand(8));
 
-            if(offset + idx < pos)
+            if(i * CHUNK_SIZE + idx < pos)
                 continue;
 
-            if(offset + idx >= pos + len)
+            if(i * CHUNK_SIZE + idx >= pos + len)
                 continue;
 
-            buf[idx] ^= byte;
+            buf[idx - offset] ^= byte;
         }
     }
 }