Fixed more fuzzer issues

src/core/SkColorTable.cpp

 
 /*
  * Copyright 2009 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkColorTable.h"
@@ skipping 72 matching lines @@
 
 ///////////////////////////////////////////////////////////////////////////////
 
 SkColorTable::SkColorTable(SkFlattenableReadBuffer& buffer) {
     f16BitCache = NULL;
     SkDEBUGCODE(fColorLockCount = 0;)
     SkDEBUGCODE(f16BitCacheLockCount = 0;)
 
     fAlphaType = SkToU8(buffer.readUInt());
     fCount = buffer.getArrayCount();
-    fColors = (SkPMColor*)sk_malloc_throw(fCount * sizeof(SkPMColor));
-    SkDEBUGCODE(bool success =) buffer.readColorArray(fColors, fCount);
+    size_t allocSize = fCount * sizeof(SkPMColor);
+    SkDEBUGCODE(bool success = false;)
+    if (buffer.validateAvailable(allocSize)) {

[Stephen White, 2013/12/18 00:01:14]

Not new to this patch, but I'm really starting to wonder if we should get rid of
these constructors, and replace them with factory functions that take an
SkFlattenableReadBuffer& instead. Then we could early-out and return NULL
whenever validation fails, and not worry about partially-initialized objects.

+        fColors = (SkPMColor*)sk_malloc_throw(allocSize);
+        SkDEBUGCODE(success =) buffer.readColorArray(fColors, fCount);
+    } else {
+        fCount = 0;
+        fColors = NULL;
+    }
 #ifdef SK_DEBUG
     SkASSERT((unsigned)fCount <= 256);
     SkASSERT(success);
 #endif
 }
 
 void SkColorTable::writeToBuffer(SkFlattenableWriteBuffer& buffer) const {
     buffer.writeUInt(fAlphaType);
     buffer.writeColorArray(fColors, fCount);
 }