Fix fuzzer-found deserialization bugs

src/core/SkPath.cpp

Index: src/core/SkPath.cpp
diff --git a/src/core/SkPath.cpp b/src/core/SkPath.cpp
index ab8d7359d2271b5a15b531859f44379522a4b378..53ab8e346d3f9b90a434570e4d118fe0e0c11687 100644
--- a/src/core/SkPath.cpp
+++ b/src/core/SkPath.cpp
@@ -1909,6 +1909,18 @@ size_t SkPath::readFromMemory(const void* storage, size_t length) {
     uint8_t dir = (packed >> kDirection_SerializationShift) & 0x3;
     fIsVolatile = (packed >> kIsVolatile_SerializationShift) & 0x1;
     SkPathRef* pathRef = SkPathRef::CreateFromBuffer(&buffer);
+    if (!pathRef) {
+        return 0;
+    }
+
+    if (!buffer.isValid()) {
+        // If the buffer is not valid, pathRef should be nullptr.

[reed1, 2016/01/13 20:27:11]

why are we throwing, instead of just returning, as we do everywhere else we
encounter an invalid buffer?

[ajuma, 2016/01/13 20:47:54]

Looking at where this originated
(https://codereview.chromium.org/61913002#msg16), I believe the distinction is
that this should never be reached, even for an adversarially chosen buffer. The
other places where we just return are places that are reachable given particular
buffers.

[reed1, 2016/01/13 21:05:47]

Lets not add code in places that can never be reached. I think this makes the
code harder to understand, since it is so different from all other "checks" we
do on the buffer. 

I think we don't need a check at all, and we would still be ok.

[ajuma, 2016/01/13 21:11:41]

Removed the check.

+        sk_throw();
+    }
+
+    fPathRef.reset(pathRef);
+    SkDEBUGCODE(this->validate();)
+    buffer.skipToAlign4();
 
     // compatibility check
     if (version < kPathPrivFirstDirection_Version) {
@@ -1929,17 +1941,7 @@ size_t SkPath::readFromMemory(const void* storage, size_t length) {
         fFirstDirection = dir;
     }
 
-    size_t sizeRead = 0;
-    if (buffer.isValid()) {
-        fPathRef.reset(pathRef);
-        SkDEBUGCODE(this->validate();)
-        buffer.skipToAlign4();
-        sizeRead = buffer.pos();
-    } else if (pathRef) {
-        // If the buffer is not valid, pathRef should be nullptr
-        sk_throw();
-    }
-    return sizeRead;
+    return buffer.pos();
 }
 
 ///////////////////////////////////////////////////////////////////////////////