Fixed clusterfuzz found crash

src/core/SkBitmap.cpp

Index: src/core/SkBitmap.cpp
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index 96d683c0e2592765351bcf5e9912085b660093a6..1d9405f4a4c6cfb443e51e7ac3b8c5ebfaa9fd6f 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1566,11 +1566,14 @@ void SkBitmap::unflatten(SkReadBuffer& buffer) {
     SkImageInfo info;
     info.unflatten(buffer);
     size_t rowBytes = buffer.readInt();
-    buffer.validate((info.width() >= 0) && (info.height() >= 0) &&
-                    SkColorTypeIsValid(info.fColorType) &&
-                    SkAlphaTypeIsValid(info.fAlphaType) &&
-                    validate_alphaType(info.fColorType, info.fAlphaType) &&
-                    info.validRowBytes(rowBytes));
+    if (!buffer.validate((info.width() >= 0) && (info.height() >= 0) &&
+                         SkColorTypeIsValid(info.fColorType) &&
+                         SkAlphaTypeIsValid(info.fAlphaType) &&
+                         validate_alphaType(info.fColorType, info.fAlphaType) &&
+                         info.validRowBytes(rowBytes))) {
+        // Clear info if it's invalid
+        sk_bzero(&info, sizeof(SkImageInfo));

[reed2, 2014/02/13 16:55:48]

Why not just

if (invalid) {
   return;
}

We've already zero'd the bitmap itself on line 1564.

[sugoi1, 2014/02/13 18:05:53]

Done.

+    }
 
     bool configIsValid = this->setConfig(info, rowBytes);
     buffer.validate(configIsValid);