stringstream :: write（）在C ++中引发了分段错误

Question

using namespace std;

void *gen_random(void *data, const int len) {
    for (int i = 0; i < len; ++i) {
        *((unsigned char *)data + i) = rand() % UCHAR_MAX;
    }
    return data;
}

void idx_sort_swap(unsigned long long &small, unsigned long long &big){
    unsigned long long tmp;
    if(small > big) {
        tmp = small;
        small = big;
        big = tmp;
    }
}

char *random_manipulate(char *const source, const unsigned long long size,
    unsigned long long &after_size, const unsigned long long max_rand_size){
    stringstream ss;
    char *data_tmp;
    unsigned long long idx_tmp0, idx_tmp1, size_tmp;

    after_size = 0;
    switch(rand() % 2){
        case 0:
        /* WRITE */
        idx_tmp0 = rand() % size;
        size_tmp = rand() % max_rand_size;

        ss.write(source, idx_tmp0);
        after_size += idx_tmp0;

        data_tmp = new char[size_tmp];
        gen_random(data_tmp, size_tmp);
        ss.write(data_tmp, size_tmp);
        delete data_tmp;
        after_size += size_tmp;

        if(size > after_size) {
            ss.write(source + after_size, size - after_size);
            after_size = size;
        }
        break;

        case 1:
        /* DELETE */
        idx_tmp0 = rand() % size;
        size_tmp = rand() % max_rand_size;

        ss.write(source, idx_tmp0);
        after_size += idx_tmp0;

        if(size - (idx_tmp1 = idx_tmp0 + size_tmp) > 0){
            ss.write(source + idx_tmp1, size - idx_tmp1);
            after_size += size - idx_tmp1;
        }
    }

    char *dest;
    dest = new char[after_size];
    ss.read(dest, after_size);
    return dest;
}

random_manipulate（）函数返回C样式字符串，该字符串随机操作char * const源作为源。

random_manipulate（）在第二次调用时总是会引起分段错误，并在两个切换案例中调用ss.write(source, idx_tmp0);。

我不知道为什么，因为逻辑本身似乎没有错。