Fixed more fuzzer issues

src/images/SkImageRef.cpp

 
 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkImageRef.h"
 #include "SkBitmap.h"
 #include "SkFlattenableBuffers.h"
@@ skipping 147 matching lines @@
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
 SkImageRef::SkImageRef(SkFlattenableReadBuffer& buffer, SkBaseMutex* mutex)
         : INHERITED(buffer, mutex), fErrorInDecoding(false) {
     fSampleSize = buffer.readInt();
     fDoDither = buffer.readBool();
 
     size_t length = buffer.getArrayCount();
-    fStream = SkNEW_ARGS(SkMemoryStream, (length));
-    buffer.readByteArray((void*)fStream->getMemoryBase(), length);
+    if (buffer.validateAvailable(length)) {
+        fStream = SkNEW_ARGS(SkMemoryStream, (length));
+        buffer.readByteArray((void*)fStream->getMemoryBase(), length);
+    } else {
+        fStream = NULL;
+    }
 
     fPrev = fNext = NULL;
     fFactory = NULL;
 }
 
 void SkImageRef::flatten(SkFlattenableWriteBuffer& buffer) const {
     this->INHERITED::flatten(buffer);
 
     buffer.writeInt(fSampleSize);
     buffer.writeBool(fDoDither);
     // FIXME: Consider moving this logic should go into writeStream itself.
     // writeStream currently has no other callers, so this may be fine for
     // now.
     if (!fStream->rewind()) {
         SkDEBUGF(("Failed to rewind SkImageRef stream!"));
         buffer.write32(0);
     } else {
         // FIXME: Handle getLength properly here. Perhaps this class should
         // take an SkStreamAsset.
         buffer.writeStream(fStream, fStream->getLength());
     }
 }