Fixed a few places where uninitialized memory could have been read

src/core/SkBitmap.cpp

Index: src/core/SkBitmap.cpp
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index ad840c4390e0d2b93d0325b39cc2802ebaca9113..ed914e8018c4a2727b7b7944b80b8e1ecb29ed15 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1559,8 +1559,10 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
     buffer.validate((width >= 0) && (height >= 0) && (rowBytes >= 0) &&
                     SkIsValidConfig(config) && validate_alphaType(config, alphaType));
 
-    this->setConfig(config, width, height, rowBytes, alphaType);
-    buffer.validate(fRowBytes >= (fWidth * fBytesPerPixel));
+    buffer.validate(this->setConfig(config, width, height, rowBytes, alphaType));

[Stephen White, 2013/12/05 20:48:22]

Nit: this might be clearer if the result of setConfig() was stored in a
temporary, and we buffer.validate() that. Maybe someone else could chime in. My
thought was that the intent of the setConfig() was a little hidden.

+    // Note : Using (fRowBytes >= (fWidth * fBytesPerPixel)) in the following test can create false
+    //        positives if the multiplication causes an integer overflow. Use the division instead.
+    buffer.validate((fBytesPerPixel > 0) && ((fRowBytes / fBytesPerPixel) >= fWidth));
 
     int reftype = buffer.readInt();
     if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) ||