Fix fuzzer-found deserialization bugs

src/core/SkPathRef.cpp

Index: src/core/SkPathRef.cpp
diff --git a/src/core/SkPathRef.cpp b/src/core/SkPathRef.cpp
index 28bffcbde8a0d546d5009cdf12e8cac363130ac0..cf4e8ffba20477e471f53c454ebced02be523523 100644
--- a/src/core/SkPathRef.cpp
+++ b/src/core/SkPathRef.cpp
@@ -138,8 +138,11 @@ SkPathRef* SkPathRef::CreateFromBuffer(SkRBuffer* buffer) {
     int32_t verbCount, pointCount, conicCount;
     if (!buffer->readU32(&(ref->fGenerationID)) ||
         !buffer->readS32(&verbCount) ||
+        verbCount < 0 ||
         !buffer->readS32(&pointCount) ||
-        !buffer->readS32(&conicCount)) {
+        pointCount < 0 ||
+        !buffer->readS32(&conicCount) ||
+        conicCount < 0) {
         delete ref;
         return nullptr;
     }