Fix fuzzer-found deserialization bugs

src/core/SkPaint.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkPaint.h"
 #include "SkAnnotation.h"
 #include "SkAutoKern.h"
@@ skipping 1928 matching lines @@
             buffer.writeBool(true);
             fAnnotation->writeToBuffer(buffer);
         } else {
             buffer.writeBool(false);
         }
     }
 }
 
 void SkPaint::unflatten(SkReadBuffer& buffer) {
     SkASSERT(SkAlign4(kPODPaintSize) == kPODPaintSize);
+    if (!buffer.validateAvailable(kPODPaintSize)) {
+        return;
+    }
     const void* podData = buffer.skip(kPODPaintSize);
     const uint32_t* pod = reinterpret_cast<const uint32_t*>(podData);
 
     // the order we read must match the order we wrote in flatten()
     this->setTextSize(read_scalar(pod));
     this->setTextScaleX(read_scalar(pod));
     this->setTextSkewX(read_scalar(pod));
     this->setStrokeWidth(read_scalar(pod));
     this->setStrokeMiter(read_scalar(pod));
     this->setColor(*pod++);
@@ skipping 461 matching lines @@
 }
 
 uint32_t SkPaint::getHash() const {
     // We're going to hash 10 pointers and 7 32-bit values, finishing up with fBitfields,
     // so fBitfields should be 10 pointers and 6 32-bit values from the start.
     static_assert(offsetof(SkPaint, fBitfields) == 10 * sizeof(void*) + 6 * sizeof(uint32_t),
                   "SkPaint_notPackedTightly");
     return SkChecksum::Murmur3(reinterpret_cast<const uint32_t*>(this),
                                offsetof(SkPaint, fBitfields) + sizeof(fBitfields));
 }