Fix fuzzer-found deserialization bugs

src/core/SkBuffer.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBuffer.h"
 
 #include <string.h>
@@ skipping 17 matching lines @@
 
 size_t SkRBuffer::skipToAlign4()
 {
     size_t pos = this->pos();
     size_t n = SkAlign4(pos) - pos;
     fPos += n;
     return n;
 }
 
 bool SkRBufferWithSizeCheck::read(void* buffer, size_t size) {
-    fError = fError || (fPos + size > fStop);
+    fError = fError || (size > static_cast<size_t>(fStop - fPos));
     if (!fError && (size > 0)) {
         readNoSizeCheck(buffer, size);
     }
     return !fError;
 }
 
 void* SkWBuffer::skip(size_t size)
 {
     void* result = fPos;
     writeNoSizeCheck(nullptr, size);
@@ skipping 79 matching lines @@
 
 const void* sk_buffer_read_ptr(const void* buffer, void** ptr)
 {
     AssertBuffer32(buffer);
     if (ptr)
         *ptr = *(void**)buffer;
     return (const char*)buffer + sizeof(void*);
 }
 
 #endif