Fix fuzzer-found deserialization bugs

src/core/SkBuffer.cpp

Index: src/core/SkBuffer.cpp
diff --git a/src/core/SkBuffer.cpp b/src/core/SkBuffer.cpp
index 86c3bed3f14ad2272b0aa851308757f557c86b85..ffd90f7e2485f66a9c7e080ceda6ef46b453554b 100644
--- a/src/core/SkBuffer.cpp
+++ b/src/core/SkBuffer.cpp
@@ -35,7 +35,7 @@ size_t SkRBuffer::skipToAlign4()
 }
 
 bool SkRBufferWithSizeCheck::read(void* buffer, size_t size) {
-    fError = fError || (fPos + size > fStop);
+    fError = fError || (size > fStop - fPos);
     if (!fError && (size > 0)) {
         readNoSizeCheck(buffer, size);
     }