Detect an invalid intervalCount in SkRegion during deserialiation.

src/core/SkRegion.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkAtomics.h"
 #include "SkRegionPriv.h"
@@ skipping 1118 matching lines @@
 size_t SkRegion::readFromMemory(const void* storage, size_t length) {
     SkRBufferWithSizeCheck  buffer(storage, length);
     SkRegion                tmp;
     int32_t                 count;
 
     if (buffer.readS32(&count) && (count >= 0) && buffer.read(&tmp.fBounds, sizeof(tmp.fBounds))) {
         if (count == 0) {
             tmp.fRunHead = SkRegion_gRectRunHeadPtr;
         } else {
             int32_t ySpanCount, intervalCount;
-            if (buffer.readS32(&ySpanCount) && buffer.readS32(&intervalCount)) {
+            if (buffer.readS32(&ySpanCount) && buffer.readS32(&intervalCount) &&
+                intervalCount > 1) {
                 tmp.allocateRuns(count, ySpanCount, intervalCount);
                 buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType));
             }
         }
     }
     size_t sizeRead = 0;
     if (buffer.isValid()) {
         this->swap(tmp);
         sizeRead = buffer.pos();
     }
@@ skipping 319 matching lines @@
 bool SkRegion::debugSetRuns(const RunType runs[], int count) {
     // we need to make a copy, since the real method may modify the array, and
     // so it cannot be const.
 
     SkAutoTArray<RunType> storage(count);
     memcpy(storage.get(), runs, count * sizeof(RunType));
     return this->setRuns(storage.get(), count);
 }
 
 #endif