Fixed more fuzzer issues

include/core/SkFlattenableBuffers.h

 
 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #ifndef SkFlattenableBuffers_DEFINED
 #define SkFlattenableBuffers_DEFINED
@@ skipping 121 matching lines @@
 
     // helper function for classes with const SkPoint members
     SkPoint readPoint() {
         SkPoint point;
         this->readPoint(&point);
         return point;
     }
 
     SkData* readByteArrayAsData() {
         size_t len = this->getArrayCount();
-        void* buffer = sk_malloc_throw(len);
-        (void)this->readByteArray(buffer, len);
+        void* buffer = NULL;
+        if (this->validate(this->isAvailable(len))) {
+            buffer = sk_malloc_throw(len);
+            (void)this->readByteArray(buffer, len);
+        } else {
+            len = 0;
+        }
         return SkData::NewFromMalloc(buffer, len);
     }
 
     /** This function validates that the isValid input parameter is true
       * If isValidating() is false, then true is always returned
       * If isValidating() is true, then true is returned until validate() is called with isValid
       * set to false. When isValid is false, an error flag will be set internally and, from that
       * point on, validate() will return false. The error flag cannot be unset.
       *
       * @param isValid result of a test that is expected to be true
       */
     virtual bool validate(bool isValid);
 
     /** This function returns true by default
       * If isValidating() is true, it will return false if the internal error flag is set.
       * Otherwise, it will return true.
       */
     virtual bool isValid() const { return true; }
 
+    /** This function returns whether there's at least "size" memory left to read in the stream.
+      *
+      * @param size amount of memory that should still be available
+      */
+    virtual bool isAvailable(size_t size) const = 0;

[reed1, 2013/12/16 21:53:13]

Do we really need this as a vritual? Do any of our readbuffers not know their
exact length?

[sugoi, 2013/12/17 15:55:45]

They all know their exact length, but their length is provided by the SkReader32
member which is in each derived class, so I need some virtual functions
somewhere to access that data, unless I misunderstood something. Note that I'll
change this to another virtual function, validateAvailable, which will only be
implemented here and in SkValidatingReadBuffer, so this shouldn't be an issue
anymore.

+
 private:
     template <typename T> T* readFlattenableT();
     uint32_t fFlags;
 };
 
 ///////////////////////////////////////////////////////////////////////////////
 
 class SkFlattenableWriteBuffer {
 public:
     SkFlattenableWriteBuffer();
@@ skipping 65 matching lines @@
     }
 
 protected:
     // A helper function so that each subclass does not have to be a friend of SkFlattenable
     void flattenObject(const SkFlattenable* obj, SkFlattenableWriteBuffer& buffer);
 
     uint32_t fFlags;
 };
 
 #endif