Address two fuzzer bugs

src/core/SkPicturePlayback.cpp

 /*
  * Copyright 2014 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkCanvas.h"
 #include "SkPatchUtils.h"
 #include "SkPictureData.h"
@@ skipping 525 matching lines @@
         } break;
         case RESTORE:
             canvas->restore();
             break;
         case ROTATE:
             canvas->rotate(reader->readScalar());
             break;
         case SAVE:
             // SKPs with version < 29 also store a SaveFlags param.
             if (size > 4) {
-                SkASSERT(8 == size);
-                reader->readInt();
+                if (reader->validate(8 == size)) {
+                    reader->readInt();
+                }
             }
             canvas->save();
             break;
         case SAVE_LAYER_SAVEFLAGS_DEPRECATED: {
             SkRect storage;
             const SkRect* boundsPtr = get_rect_ptr(reader, &storage);
             const SkPaint* paint = fPictureData->getPaint(reader);
             auto flags = SkCanvas::LegacySaveFlagsToSaveLayerFlags(reader->readInt());
             canvas->saveLayer(SkCanvas::SaveLayerRec(boundsPtr, paint, flags));
         } break;
@@ skipping 41 matching lines @@
         } break;
         case TRANSLATE: {
             SkScalar dx = reader->readScalar();
             SkScalar dy = reader->readScalar();
             canvas->translate(dx, dy);
         } break;
         default:
             SkASSERTF(false, "Unknown draw type: %d", op);
     }
 }