Fixed issue found by clusterfuzz

include/core/SkReader32.h

Index: include/core/SkReader32.h
diff --git a/include/core/SkReader32.h b/include/core/SkReader32.h
index 7e8038d0ae3a7913cf3c5ee036b866b7720e0963..7e919b5baba50eb4569ca18dc9eb67b74ac0f8e9 100644
--- a/include/core/SkReader32.h
+++ b/include/core/SkReader32.h
@@ -40,7 +40,7 @@ public:
     const void* peek() const { return fCurr; }
 
     size_t available() const { return fStop - fCurr; }
-    bool isAvailable(size_t size) const { return fCurr + size <= fStop; }

[sugoi1, 2014/04/28 20:15:20]

"fCurr + size" can overflow easily since "size" can be a value read directly
from the stream, so any very large value will cause the integer overflow (sizes
are generally stored as 32 bit integers in the stream, so a 32 bit OS is more
likely to have this issue than a 64 bit OS). To avoid integer overflow, compare
size to available() instead, since fStop and fCurr are internal values to the
class and unlikely to be invalid.

+    bool isAvailable(size_t size) const { return size <= available(); }

[reed1, 2014/04/28 20:18:02]

nit: this->available()

[sugoi1, 2014/04/28 20:25:06]

Done.

 
     void rewind() { fCurr = fBase; }