Fix ImageFilter fuzzer issue

src/core/SkPicturePlayback.cpp

 /*
  * Copyright 2014 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkCanvas.h"
 #include "SkPatchUtils.h"
 #include "SkPictureData.h"
 #include "SkPicturePlayback.h"
 #include "SkPictureRecord.h"
-#include "SkReader32.h"
+#include "SkReadBuffer.h"
 #include "SkRSXform.h"
 #include "SkTextBlob.h"
 #include "SkTDArray.h"
 #include "SkTypes.h"
 
 // matches old SkCanvas::SaveFlags
 enum LegacySaveFlags {
     kHasAlphaLayer_LegacySaveFlags    = 0x04,
     kClipToLayer_LegacySaveFlags      = 0x10,
 };
@@ skipping 10 matching lines @@
     return layerFlags;
 }
 
 /*
  * Read the next op code and chunk size from 'reader'. The returned size
  * is the entire size of the chunk (including the opcode). Thus, the
  * offset just prior to calling ReadOpAndSize + 'size' is the offset
  * to the next chunk's op code. This also means that the size of a chunk
  * with no arguments (just an opcode) will be 4.
  */
-DrawType SkPicturePlayback::ReadOpAndSize(SkReader32* reader, uint32_t* size) {
+DrawType SkPicturePlayback::ReadOpAndSize(SkReadBuffer* reader, uint32_t* size) {
     uint32_t temp = reader->readInt();
     uint32_t op;
     if (((uint8_t)temp) == temp) {
         // old skp file - no size information
         op = temp;
         *size = 0;
     } else {
         UNPACK_8_24(temp, op, *size);
         if (MASK_24 == *size) {
             *size = reader->readInt();
         }
     }
     return (DrawType)op;
 }
 
 
-static const SkRect* get_rect_ptr(SkReader32* reader) {
+static const SkRect* get_rect_ptr(SkReadBuffer* reader, SkRect* storage) {
     if (reader->readBool()) {
-        return &reader->skipT<SkRect>();
+        reader->readRect(storage);
+        return storage;
     } else {
         return nullptr;
     }
 }
 
 class TextContainer {
 public:
     size_t length() { return fByteLength; }
     const void* text() { return (const void*)fText; }
     size_t fByteLength;
     const char* fText;
 };
 
-void get_text(SkReader32* reader, TextContainer* text) {
+void get_text(SkReadBuffer* reader, TextContainer* text) {
     size_t length = text->fByteLength = reader->readInt();
     text->fText = (const char*)reader->skip(length);
 }
 
 // FIXME: SkBitmaps are stateful, so we need to copy them to play back in multiple threads.
 static SkBitmap shallow_copy(const SkBitmap& bitmap) {
     return bitmap;
 }
 
 void SkPicturePlayback::draw(SkCanvas* canvas, SkPicture::AbortCallback* callback) {
     AutoResetOpID aroi(this);
     SkASSERT(0 == fCurOffset);
 
-    SkReader32 reader(fPictureData->opData()->bytes(), fPictureData->opData()->size());
+    SkReadBuffer reader(fPictureData->opData()->bytes(), fPictureData->opData()->size());
 
     // Record this, so we can concat w/ it if we encounter a setMatrix()
     SkMatrix initialMatrix = canvas->getTotalMatrix();
 
     SkAutoCanvasRestore acr(canvas, false);
 
     while (!reader.eof()) {
         if (callback && callback->abort()) {
             return;
         }
 
         fCurOffset = reader.offset();
         uint32_t size;
         DrawType op = ReadOpAndSize(&reader, &size);
 
         this->handleOp(&reader, op, size, canvas, initialMatrix);
     }
 }
 
-void SkPicturePlayback::handleOp(SkReader32* reader,
+void SkPicturePlayback::handleOp(SkReadBuffer* reader,
                                  DrawType op,
                                  uint32_t size,
                                  SkCanvas* canvas,
                                  const SkMatrix& initialMatrix) {
     switch (op) {
         case NOOP: {
             SkASSERT(size >= 4);
             reader->skip(size - 4);
         } break;
         case CLIP_PATH: {
             const SkPath& path = fPictureData->getPath(reader);
             uint32_t packed = reader->readInt();
             SkRegion::Op regionOp = ClipParams_unpackRegionOp(packed);
             bool doAA = ClipParams_unpackDoAA(packed);
             size_t offsetToRestore = reader->readInt();
             SkASSERT(!offsetToRestore || offsetToRestore >= reader->offset());
             canvas->clipPath(path, regionOp, doAA);
             if (canvas->isClipEmpty() && offsetToRestore) {
-                reader->setOffset(offsetToRestore);
+                reader->skip(offsetToRestore - reader->offset());
             }
         } break;
         case CLIP_REGION: {
             SkRegion region;
             reader->readRegion(&region);
             uint32_t packed = reader->readInt();
             SkRegion::Op regionOp = ClipParams_unpackRegionOp(packed);
             size_t offsetToRestore = reader->readInt();
             SkASSERT(!offsetToRestore || offsetToRestore >= reader->offset());
             canvas->clipRegion(region, regionOp);
             if (canvas->isClipEmpty() && offsetToRestore) {
-                reader->setOffset(offsetToRestore);
+                reader->skip(offsetToRestore - reader->offset());
             }
         } break;
         case CLIP_RECT: {
-            const SkRect& rect = reader->skipT<SkRect>();
+            SkRect rect;
+            reader->readRect(&rect);
             uint32_t packed = reader->readInt();
             SkRegion::Op regionOp = ClipParams_unpackRegionOp(packed);
             bool doAA = ClipParams_unpackDoAA(packed);
             size_t offsetToRestore = reader->readInt();
             SkASSERT(!offsetToRestore || offsetToRestore >= reader->offset());
             canvas->clipRect(rect, regionOp, doAA);
             if (canvas->isClipEmpty() && offsetToRestore) {
-                reader->setOffset(offsetToRestore);
+                reader->skip(offsetToRestore - reader->offset());
             }
         } break;
         case CLIP_RRECT: {
             SkRRect rrect;
             reader->readRRect(&rrect);
             uint32_t packed = reader->readInt();
             SkRegion::Op regionOp = ClipParams_unpackRegionOp(packed);
             bool doAA = ClipParams_unpackDoAA(packed);
             size_t offsetToRestore = reader->readInt();
             SkASSERT(!offsetToRestore || offsetToRestore >= reader->offset());
             canvas->clipRRect(rrect, regionOp, doAA);
             if (canvas->isClipEmpty() && offsetToRestore) {
-                reader->setOffset(offsetToRestore);
+                reader->skip(offsetToRestore - reader->offset());
             }
         } break;
         case PUSH_CULL: break;  // Deprecated, safe to ignore both push and pop.
         case POP_CULL:  break;
         case CONCAT: {
             SkMatrix matrix;
             reader->readMatrix(&matrix);
             canvas->concat(matrix);
             break;
         }
         case DRAW_ANNOTATION: {
-            const SkRect& rect = reader->skipT<SkRect>();
-            const char* key = reader->readString();
-            canvas->drawAnnotation(rect, key, reader->readData().get());
+            SkRect rect;
+            reader->readRect(&rect);
+            SkString key;
+            reader->readString(&key);
+            canvas->drawAnnotation(rect, key.c_str(), reader->readByteArrayAsData().get());
         } break;
         case DRAW_ATLAS: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkImage* atlas = fPictureData->getImage(reader);
-            const uint32_t flags = reader->readU32();
-            const int count = reader->readU32();
+            const uint32_t flags = reader->readUInt();
+            const int count = reader->readUInt();
             const SkRSXform* xform = (const SkRSXform*)reader->skip(count * sizeof(SkRSXform));
             const SkRect* tex = (const SkRect*)reader->skip(count * sizeof(SkRect));
             const SkColor* colors = nullptr;
             SkXfermode::Mode mode = SkXfermode::kDst_Mode;
             if (flags & DRAW_ATLAS_HAS_COLORS) {
                 colors = (const SkColor*)reader->skip(count * sizeof(SkColor));
-                mode = (SkXfermode::Mode)reader->readU32();
+                mode = (SkXfermode::Mode)reader->readUInt();
             }
             const SkRect* cull = nullptr;
             if (flags & DRAW_ATLAS_HAS_CULL) {
                 cull = (const SkRect*)reader->skip(sizeof(SkRect));
             }
             canvas->drawAtlas(atlas, xform, tex, colors, count, mode, cull, paint);
         } break;
         case DRAW_BITMAP: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkBitmap bitmap = shallow_copy(fPictureData->getBitmap(reader));
-            const SkPoint& loc = reader->skipT<SkPoint>();
+            SkPoint loc;
+            reader->readPoint(&loc);
             canvas->drawBitmap(bitmap, loc.fX, loc.fY, paint);
         } break;
         case DRAW_BITMAP_RECT: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkBitmap bitmap = shallow_copy(fPictureData->getBitmap(reader));
-            const SkRect* src = get_rect_ptr(reader);   // may be null
-            const SkRect& dst = reader->skipT<SkRect>();     // required
+            SkRect storage;
+            const SkRect* src = get_rect_ptr(reader, &storage);   // may be null
+            SkRect dst;
+            reader->readRect(&dst);     // required
             SkCanvas::SrcRectConstraint constraint = (SkCanvas::SrcRectConstraint)reader->readInt();
             canvas->legacy_drawBitmapRect(bitmap, src, dst, paint, constraint);
         } break;
         case DRAW_BITMAP_MATRIX: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkBitmap bitmap = shallow_copy(fPictureData->getBitmap(reader));
             SkMatrix matrix;
             reader->readMatrix(&matrix);
 
             SkAutoCanvasRestore acr(canvas, true);
             canvas->concat(matrix);
             canvas->drawBitmap(bitmap, 0, 0, paint);
         } break;
         case DRAW_BITMAP_NINE: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkBitmap bitmap = shallow_copy(fPictureData->getBitmap(reader));
-            const SkIRect& src = reader->skipT<SkIRect>();
-            const SkRect& dst = reader->skipT<SkRect>();
+            SkIRect src;
+            reader->readIRect(&src);
+            SkRect dst;
+            reader->readRect(&dst);
             canvas->drawBitmapNine(bitmap, src, dst, paint);
         } break;
         case DRAW_CLEAR:
             canvas->clear(reader->readInt());
             break;
         case DRAW_DATA: {
             // This opcode is now dead, just need to skip it for backwards compatibility
             size_t length = reader->readInt();
             (void)reader->skip(length);
             // skip handles padding the read out to a multiple of 4
         } break;
         case DRAW_DRRECT: {
             const SkPaint& paint = *fPictureData->getPaint(reader);
             SkRRect outer, inner;
             reader->readRRect(&outer);
             reader->readRRect(&inner);
             canvas->drawDRRect(outer, inner, paint);
         } break;
-        case BEGIN_COMMENT_GROUP:
-            reader->readString();
+        case BEGIN_COMMENT_GROUP: {
+            SkString tmp;
+            reader->readString(&tmp);
             // deprecated (M44)
             break;
-        case COMMENT:
-            reader->readString();
-            reader->readString();
+        }
+        case COMMENT: {
+            SkString tmp;
+            reader->readString(&tmp);
+            reader->readString(&tmp);
             // deprecated (M44)
             break;
+        }
         case END_COMMENT_GROUP:
             // deprecated (M44)
             break;
         case DRAW_IMAGE: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkImage* image = fPictureData->getImage(reader);
-            const SkPoint& loc = reader->skipT<SkPoint>();
+            SkPoint loc;
+            reader->readPoint(&loc);
             canvas->drawImage(image, loc.fX, loc.fY, paint);
         } break;
         case DRAW_IMAGE_NINE: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkImage* image = fPictureData->getImage(reader);
-            const SkIRect& center = reader->skipT<SkIRect>();
-            const SkRect& dst = reader->skipT<SkRect>();
+            SkIRect center;
+            reader->readIRect(&center);
+            SkRect dst;
+            reader->readRect(&dst);
             canvas->drawImageNine(image, center, dst, paint);
         } break;
         case DRAW_IMAGE_RECT_STRICT:
         case DRAW_IMAGE_RECT: {
             const SkPaint* paint = fPictureData->getPaint(reader);
             const SkImage* image = fPictureData->getImage(reader);
-            const SkRect* src = get_rect_ptr(reader);   // may be null
-            const SkRect& dst = reader->skipT<SkRect>();     // required
+            SkRect storage;
+            const SkRect* src = get_rect_ptr(reader, &storage);   // may be null
+            SkRect dst;
+            reader->readRect(&dst);     // required
             // DRAW_IMAGE_RECT_STRICT assumes this constraint, and doesn't store it
             SkCanvas::SrcRectConstraint constraint = SkCanvas::kStrict_SrcRectConstraint;
             if (DRAW_IMAGE_RECT == op) {
                 // newer op-code stores the constraint explicitly
                 constraint = (SkCanvas::SrcRectConstraint)reader->readInt();
             }
             canvas->legacy_drawImageRect(image, src, dst, paint, constraint);
         } break;
         case DRAW_OVAL: {
             const SkPaint& paint = *fPictureData->getPaint(reader);
-            canvas->drawOval(reader->skipT<SkRect>(), paint);
+            SkRect rect;
+            reader->readRect(&rect);
+            canvas->drawOval(rect, paint);
         } break;
         case DRAW_PAINT:
             canvas->drawPaint(*fPictureData->getPaint(reader));
             break;
         case DRAW_PATCH: {
             const SkPaint& paint = *fPictureData->getPaint(reader);
 
             const SkPoint* cubics = (const SkPoint*)reader->skip(SkPatchUtils::kNumCtrlPts *
                                                                  sizeof(SkPoint));
             uint32_t flag = reader->readInt();
@@ skipping 74 matching lines @@
             const SkScalar* xpos = (const SkScalar*)reader->skip((3 + xCount) * sizeof(SkScalar));
             const SkScalar top = *xpos++;
             const SkScalar bottom = *xpos++;
             const SkScalar constY = *xpos++;
             if (!canvas->quickRejectY(top, bottom)) {
                 canvas->drawPosTextH(text.text(), text.length(), xpos, constY, paint);
             }
         } break;
         case DRAW_RECT: {
             const SkPaint& paint = *fPictureData->getPaint(reader);
-            canvas->drawRect(reader->skipT<SkRect>(), paint);
+            SkRect rect;
+            reader->readRect(&rect);
+            canvas->drawRect(rect, paint);
         } break;
         case DRAW_RRECT: {
             const SkPaint& paint = *fPictureData->getPaint(reader);
             SkRRect rrect;
             reader->readRRect(&rrect);
             canvas->drawRRect(rrect, paint);
         } break;
         case DRAW_SPRITE: {
             /* const SkPaint* paint = */ fPictureData->getPaint(reader);
             /* const SkBitmap bitmap = */ shallow_copy(fPictureData->getBitmap(reader));
@@ skipping 76 matching lines @@
             break;
         case SAVE:
             // SKPs with version < 29 also store a SaveFlags param.
             if (size > 4) {
                 SkASSERT(8 == size);
                 reader->readInt();
             }
             canvas->save();
             break;
         case SAVE_LAYER_SAVEFLAGS_DEPRECATED: {
-            const SkRect* boundsPtr = get_rect_ptr(reader);
+            SkRect storage;
+            const SkRect* boundsPtr = get_rect_ptr(reader, &storage);
             const SkPaint* paint = fPictureData->getPaint(reader);
             auto flags = SkCanvas::LegacySaveFlagsToSaveLayerFlags(reader->readInt());
             canvas->saveLayer(SkCanvas::SaveLayerRec(boundsPtr, paint, flags));
         } break;
         case SAVE_LAYER_SAVELAYERFLAGS_DEPRECATED_JAN_2016: {
-            const SkRect* boundsPtr = get_rect_ptr(reader);
+            SkRect storage;
+            const SkRect* boundsPtr = get_rect_ptr(reader, &storage);
             const SkPaint* paint = fPictureData->getPaint(reader);
             canvas->saveLayer(SkCanvas::SaveLayerRec(boundsPtr, paint, reader->readInt()));
         } break;
         case SAVE_LAYER_SAVELAYERREC: {
             SkCanvas::SaveLayerRec rec(nullptr, nullptr, nullptr, 0);
             const uint32_t flatFlags = reader->readInt();
+            SkRect bounds;
             if (flatFlags & SAVELAYERREC_HAS_BOUNDS) {
-                rec.fBounds = &reader->skipT<SkRect>();
+                reader->readRect(&bounds);
+                rec.fBounds = &bounds;
             }
             if (flatFlags & SAVELAYERREC_HAS_PAINT) {
                 rec.fPaint = fPictureData->getPaint(reader);
             }
             if (flatFlags & SAVELAYERREC_HAS_BACKDROP) {
                 const SkPaint* paint = fPictureData->getPaint(reader);
                 rec.fBackdrop = paint->getImageFilter();
             }
             if (flatFlags & SAVELAYERREC_HAS_FLAGS) {
                 rec.fSaveLayerFlags = reader->readInt();
@@ skipping 18 matching lines @@
         } break;
         case TRANSLATE: {
             SkScalar dx = reader->readScalar();
             SkScalar dy = reader->readScalar();
             canvas->translate(dx, dy);
         } break;
         default:
             SkASSERTF(false, "Unknown draw type: %d", op);
     }
 }