Fix bug in api_fuzzer

If the slices to unref array was expanded after returning a pointer to a
slice, that pointer becomes invalidated. Instead, allocate and store
pointers to slices in that array to keep stability.

test/core/end2end/fuzzers/api_fuzzer.c

@@ -564,7 +564,7 @@ typedef struct call_state {
   // array of slices to unref
   size_t num_slices_to_unref;
   size_t cap_slices_to_unref;
-  grpc_slice *slices_to_unref;
+  grpc_slice **slices_to_unref;
 
   struct call_state *next;
   struct call_state *prev;
@@ -605,7 +605,8 @@ static call_state *maybe_delete_call_state(call_state *call) {
   grpc_call_details_destroy(&call->call_details);
 
   for (size_t i = 0; i < call->num_slices_to_unref; i++) {
-    grpc_slice_unref(call->slices_to_unref[i]);
+    grpc_slice_unref(*call->slices_to_unref[i]);
+    gpr_free(call->slices_to_unref[i]);
   }
   for (size_t i = 0; i < call->num_to_free; i++) {
     gpr_free(call->to_free[i]);
@@ -634,8 +635,10 @@ static grpc_slice *add_slice_to_unref(call_state *call, grpc_slice s) {
         gpr_realloc(call->slices_to_unref,
                     sizeof(*call->slices_to_unref) * call->cap_slices_to_unref);
   }
-  call->slices_to_unref[call->num_slices_to_unref++] = s;
-  return &call->slices_to_unref[call->num_slices_to_unref - 1];
+  call->slices_to_unref[call->num_slices_to_unref] =
+      gpr_malloc(sizeof(grpc_slice));
+  *call->slices_to_unref[call->num_slices_to_unref++] = s;
+  return call->slices_to_unref[call->num_slices_to_unref - 1];
 }
 
 static void read_metadata(input_stream *inp, size_t *count,