Fixed issue found by clusterfuzz

src/core/SkWriter32.cpp

 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkReader32.h"
 #include "SkString.h"
 #include "SkWriter32.h"
 
 /*
  *  Strings are stored as: length[4-bytes] + string_data + '\0' + pad_to_mul_4
  */
 
 const char* SkReader32::readString(size_t* outLen) {
-    size_t len = this->readInt();
+    size_t len = this->readU32();
     const void* ptr = this->peek();
 
     // skip over the string + '\0' and then pad to a multiple of 4
     size_t alignedSize = SkAlign4(len + 1);
     this->skip(alignedSize);
 
     if (outLen) {
         *outLen = len;
     }
     return (const char*)ptr;
@@ skipping 68 matching lines @@
             // prepare us to do copy on write, by pretending the data buffer
             // is external and size limited
             mutable_this.fData = buffer;
             mutable_this.fCapacity = fUsed;
             mutable_this.fExternal = buffer;
         }
         mutable_this.fSnapshot.reset(SkData::NewFromMalloc(buffer, fUsed));
     }
     return SkRef(fSnapshot.get()); // Take an extra ref for the caller.
 }