Fix ImageFilter fuzzer issue

src/core/SkPictureData.h

 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #ifndef SkPictureData_DEFINED
 #define SkPictureData_DEFINED
 
@@ skipping 69 matching lines @@
     const sk_sp<SkData>& opData() const { return fOpData; }
 
 protected:
     explicit SkPictureData(const SkPictInfo& info);
 
     // Does not affect ownership of SkStream.
     bool parseStream(SkStream*, SkPicture::InstallPixelRefProc, SkTypefacePlayback*);
     bool parseBuffer(SkReadBuffer& buffer);
 
 public:
-    const SkBitmap& getBitmap(SkReader32* reader) const {
+    const SkBitmap& getBitmap(SkReadBuffer* reader) const {
         const int index = reader->readInt();
+        if (index < 0 || index >= fBitmaps.count()) {

[reed1, 2016/04/19 12:54:11]

Seems fine, but a little repetitive.

One condensation could be:

return reader->validate(index < 0 || index >= fBitmaps.count()) ?
fBitmaps[index] : fEmptyBitmap;

And/or, we might add a helper to ReadBuffer...

bool validateIndex(int index, int count) so it will just read

return reader->validateIndex(index, fBitmaps.count()) ? fBitmaps[index] :
fEmptyBitmap;

[robertphillips, 2016/04/19 14:34:42]

Done.

+            reader->makeInvalid();
+            return fEmptyBitmap;
+        }
         return fBitmaps[index];
     }
 
-    const SkImage* getImage(SkReader32* reader) const {
+    const SkImage* getImage(SkReadBuffer* reader) const {
         const int index = reader->readInt();
+        if (index < 0 || index >= fImageCount) {
+            reader->makeInvalid();
+            return nullptr;
+        }
         return fImageRefs[index];
     }
 
-    const SkPath& getPath(SkReader32* reader) const {
-        int index = reader->readInt() - 1;
+    const SkPath& getPath(SkReadBuffer* reader) const {
+        const int index = reader->readInt() - 1;
+        if (index < 0 || index >= fPaths.count()) {
+            reader->makeInvalid();
+            return fEmptyPath;
+        }
         return fPaths[index];
     }
 
-    const SkPicture* getPicture(SkReader32* reader) const {
-        int index = reader->readInt();
-        SkASSERT(index > 0 && index <= fPictureCount);
-        return fPictureRefs[index - 1];
+    const SkPicture* getPicture(SkReadBuffer* reader) const {
+        const int index = reader->readInt() - 1;
+        if (index < 0 || index >= fPictureCount) {
+            reader->makeInvalid();
+            return nullptr;
+        }
+        return fPictureRefs[index];
     }
 
-    const SkPaint* getPaint(SkReader32* reader) const {
-        int index = reader->readInt();
-        if (index == 0) {
+    const SkPaint* getPaint(SkReadBuffer* reader) const {
+        const int index = reader->readInt() - 1;
+        if (index < 0 || index >= fPaints.count()) {
+            reader->makeInvalid();
             return nullptr;
         }
-        return &fPaints[index - 1];
+        return &fPaints[index];
     }
 
-    const SkTextBlob* getTextBlob(SkReader32* reader) const {
-        int index = reader->readInt();
-        SkASSERT(index > 0 && index <= fTextBlobCount);
-        return fTextBlobRefs[index - 1];
+    const SkTextBlob* getTextBlob(SkReadBuffer* reader) const {
+        const int index = reader->readInt() - 1;
+        if (index < 0 || index >= fTextBlobCount) {
+            reader->makeInvalid();
+            return nullptr;
+        }
+        return fTextBlobRefs[index];
     }
 
 #if SK_SUPPORT_GPU
     /**
      * sampleCount is the number of samples-per-pixel or zero if non-MSAA.
      * It is defaulted to be zero.
      */
     bool suitableForGpuRasterization(GrContext* context, const char **reason,
                                      int sampleCount = 0) const;
 
@@ skipping 20 matching lines @@
     // Only used by getBitmap() if the passed in index is SkBitmapHeap::INVALID_SLOT. This empty
     // bitmap allows playback to draw nothing and move on.
     SkBitmap fBadBitmap;
 
     SkTArray<SkBitmap> fBitmaps;
     SkTArray<SkPaint>  fPaints;
     SkTArray<SkPath>   fPaths;
 
     sk_sp<SkData>   fOpData;    // opcodes and parameters
 
+    const SkPath    fEmptyPath;
+    const SkBitmap  fEmptyBitmap;
+
     const SkPicture** fPictureRefs;
     int fPictureCount;
     const SkTextBlob** fTextBlobRefs;
     int fTextBlobCount;
     const SkImage** fImageRefs;
     int fImageCount;
 
     SkPictureContentInfo fContentInfo;
 
     SkTypefacePlayback fTFPlayback;
     SkFactoryPlayback* fFactoryPlayback;
 
     const SkPictInfo fInfo;
 
     static void WriteFactories(SkWStream* stream, const SkFactorySet& rec);
     static void WriteTypefaces(SkWStream* stream, const SkRefCntSet& rec);
 
     void initForPlayback() const;
 };
 
 #endif