Fixed issue found by clusterfuzz

src/core/SkValidatingReadBuffer.cpp

Index: src/core/SkValidatingReadBuffer.cpp
diff --git a/src/core/SkValidatingReadBuffer.cpp b/src/core/SkValidatingReadBuffer.cpp
index 95bf83c847d313fdd6af4dbb7ad5f6291f9eacdf..0dbe9deae46843a8bc9bc090bc74b9a563bd37b9 100644
--- a/src/core/SkValidatingReadBuffer.cpp
+++ b/src/core/SkValidatingReadBuffer.cpp
@@ -91,7 +91,13 @@ int32_t SkValidatingReadBuffer::read32() {
 }
 
 void SkValidatingReadBuffer::readString(SkString* string) {
-    const size_t len = this->readInt();
+    const int32_t len32 = this->readInt();

[Stephen White, 2014/04/28 19:48:33]

I think we should be reading a uint32_t here (since we write one in
SkWriter32::writeString). Then it would be impossible to sign-extend this badly
into 64 bits.

[sugoi1, 2014/04/28 20:15:20]

Done.

+    // Make sure len32 is a positive number before it gets converted to an unsigned integer format
+    if (!this->validate(len32 >= 0)) {
+        return;
+    }
+
+    const size_t len(len32);
     const void* ptr = fReader.peek();
     const char* cptr = (const char*)ptr;