Fixed more fuzzer issues

include/core/SkFlattenableBuffers.h

Index: include/core/SkFlattenableBuffers.h
diff --git a/include/core/SkFlattenableBuffers.h b/include/core/SkFlattenableBuffers.h
index 00cb77a8d35f1ba98e80493767c081764f4d51d0..e25f7fcf79c3ba5074edcb40df0a0e55ba867d51 100644
--- a/include/core/SkFlattenableBuffers.h
+++ b/include/core/SkFlattenableBuffers.h
@@ -139,8 +139,13 @@ public:
 
     SkData* readByteArrayAsData() {
         size_t len = this->getArrayCount();
-        void* buffer = sk_malloc_throw(len);
-        (void)this->readByteArray(buffer, len);
+        void* buffer = NULL;
+        if (this->validate(this->isAvailable(len))) {
+            buffer = sk_malloc_throw(len);
+            (void)this->readByteArray(buffer, len);
+        } else {
+            len = 0;
+        }
         return SkData::NewFromMalloc(buffer, len);
     }
 
@@ -160,6 +165,12 @@ public:
       */
     virtual bool isValid() const { return true; }
 
+    /** This function returns whether there's at least "size" memory left to read in the stream.
+      *
+      * @param size amount of memory that should still be available
+      */
+    virtual bool isAvailable(size_t size) const = 0;

[reed1, 2013/12/16 21:53:13]

Do we really need this as a vritual? Do any of our readbuffers not know their
exact length?

[sugoi, 2013/12/17 15:55:45]

They all know their exact length, but their length is provided by the SkReader32
member which is in each derived class, so I need some virtual functions
somewhere to access that data, unless I misunderstood something. Note that I'll
change this to another virtual function, validateAvailable, which will only be
implemented here and in SkValidatingReadBuffer, so this shouldn't be an issue
anymore.

+
 private:
     template <typename T> T* readFlattenableT();
     uint32_t fFlags;