Fix fuzzer-found deserialization bugs

src/core/SkPathRef.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBuffer.h"
 #include "SkOncePtr.h"
 #include "SkPath.h"
@@ skipping 120 matching lines @@
     }
 
     ref->fIsFinite = (packed >> kIsFinite_SerializationShift) & 1;
     uint8_t segmentMask = (packed >> kSegmentMask_SerializationShift) & 0xF;
     bool isOval  = (packed >> kIsOval_SerializationShift) & 1;
     bool isRRect  = (packed >> kIsRRect_SerializationShift) & 1;
 
     int32_t verbCount, pointCount, conicCount;
     if (!buffer->readU32(&(ref->fGenerationID)) ||
         !buffer->readS32(&verbCount) ||
+        verbCount < 0 ||
         !buffer->readS32(&pointCount) ||
-        !buffer->readS32(&conicCount)) {
+        pointCount < 0 ||
+        !buffer->readS32(&conicCount) ||
+        conicCount < 0) {
         delete ref;
         return nullptr;
     }
 
     ref->resetToSize(verbCount, pointCount, conicCount);
     SkASSERT(verbCount == ref->countVerbs());
     SkASSERT(pointCount == ref->countPoints());
     SkASSERT(conicCount == ref->fConicWeights.count());
 
     if (!buffer->read(ref->verbsMemWritable(), verbCount * sizeof(uint8_t)) ||
@@ skipping 492 matching lines @@
                 break;
             default:
                 SkDEBUGFAIL("Unknown Verb");
                 break;
         }
     }
     SkASSERT(mask == fSegmentMask);
 #endif // SK_DEBUG_PATH
 }
 #endif