Fixed issue found by clusterfuzz

src/core/SkValidatingReadBuffer.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
 #include "SkValidatingReadBuffer.h"
@@ skipping 73 matching lines @@
 
 uint32_t SkValidatingReadBuffer::readUInt() {
     return this->readInt();
 }
 
 int32_t SkValidatingReadBuffer::read32() {
     return this->readInt();
 }
 
 void SkValidatingReadBuffer::readString(SkString* string) {
-    const size_t len = this->readInt();
+    const size_t len = this->readUInt();
     const void* ptr = fReader.peek();
     const char* cptr = (const char*)ptr;
 
     // skip over the string + '\0' and then pad to a multiple of 4
     const size_t alignedSize = SkAlign4(len + 1);
     this->skip(alignedSize);
     if (!fError) {
         this->validate(cptr[len] == '\0');
     }
     if (!fError) {
@@ skipping 161 matching lines @@
             delete obj;
             obj = NULL;
         }
     } else {
         // we must skip the remaining data
         this->skip(sizeRecorded);
         SkASSERT(false);
     }
     return obj;
 }