Fixed issue found by clusterfuzz

src/core/SkValidatingReadBuffer.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
 #include "SkValidatingReadBuffer.h"
@@ skipping 73 matching lines @@
 
 uint32_t SkValidatingReadBuffer::readUInt() {
     return this->readInt();
 }
 
 int32_t SkValidatingReadBuffer::read32() {
     return this->readInt();
 }
 
 void SkValidatingReadBuffer::readString(SkString* string) {
-    const size_t len = this->readInt();
+    const int32_t len32 = this->readInt();

[Stephen White, 2014/04/28 19:48:33]

I think we should be reading a uint32_t here (since we write one in
SkWriter32::writeString). Then it would be impossible to sign-extend this badly
into 64 bits.

[sugoi1, 2014/04/28 20:15:20]

Done.

+    // Make sure len32 is a positive number before it gets converted to an unsigned integer format
+    if (!this->validate(len32 >= 0)) {
+        return;
+    }
+
+    const size_t len(len32);
     const void* ptr = fReader.peek();
     const char* cptr = (const char*)ptr;
 
     // skip over the string + '\0' and then pad to a multiple of 4
     const size_t alignedSize = SkAlign4(len + 1);
     this->skip(alignedSize);
     if (!fError) {
         this->validate(cptr[len] == '\0');
     }
     if (!fError) {
@@ skipping 161 matching lines @@
             delete obj;
             obj = NULL;
         }
     } else {
         // we must skip the remaining data
         this->skip(sizeRecorded);
         SkASSERT(false);
     }
     return obj;
 }