Fixing another clusterfuzz issue

src/core/SkReadBuffer.cpp

 
 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
@@ skipping 112 matching lines @@
 void* SkReadBuffer::readEncodedString(size_t* length, SkPaint::TextEncoding encoding) {
     SkDEBUGCODE(int32_t encodingType = ) fReader.readInt();
     SkASSERT(encodingType == encoding);
     *length =  fReader.readInt();
     void* data = sk_malloc_throw(*length);
     memcpy(data, fReader.skip(SkAlign4(*length)), *length);
     return data;
 }
 
 void SkReadBuffer::readPoint(SkPoint* point) {
-    point->fX = fReader.readScalar();
-    point->fY = fReader.readScalar();
+    point->fX = this->readScalar();
+    point->fY = this->readScalar();
 }
 
 void SkReadBuffer::readMatrix(SkMatrix* matrix) {
     fReader.readMatrix(matrix);
 }
 
 void SkReadBuffer::readIRect(SkIRect* rect) {
     memcpy(rect, fReader.skip(sizeof(SkIRect)), sizeof(SkIRect));
 }
 
@@ skipping 47 matching lines @@
 }
 
 bool SkReadBuffer::readBitmap(SkBitmap* bitmap) {
     const int width = this->readInt();
     const int height = this->readInt();
     // The writer stored a boolean value to determine whether an SkBitmapHeap was used during
     // writing.
     if (this->readBool()) {
         // An SkBitmapHeap was used for writing. Read the index from the stream and find the
         // corresponding SkBitmap in fBitmapStorage.
-        const uint32_t index = fReader.readU32();
-        fReader.readU32(); // bitmap generation ID (see SkWriteBuffer::writeBitmap)
+        const uint32_t index = this->readUInt();
+        this->readUInt(); // bitmap generation ID (see SkWriteBuffer::writeBitmap)
         if (fBitmapStorage) {
             *bitmap = *fBitmapStorage->getBitmap(index);
             fBitmapStorage->releaseRef(index);
             return true;
         } else {
             // The bitmap was stored in a heap, but there is no way to access it. Set an error and
             // fall through to use a place holder bitmap.
             SkErrorInternals::SetError(kParseError_SkError, "SkWriteBuffer::writeBitmap "
                                        "stored the SkBitmap in an SkBitmapHeap, but "
                                        "SkReadBuffer has no SkBitmapHeapReader to "
                                        "retrieve the SkBitmap.");
         }
     } else {
         // The writer stored false, meaning the SkBitmap was not stored in an SkBitmapHeap.
         const size_t length = this->readUInt();
         if (length > 0) {
 #ifdef DEBUG_NON_DETERMINISTIC_ASSERT
             fDecodedBitmapIndex++;
 #endif // DEBUG_NON_DETERMINISTIC_ASSERT
             // A non-zero size means the SkBitmap was encoded. Read the data and pixel
             // offset.
             const void* data = this->skip(length);
-            const int32_t xOffset = fReader.readS32();
-            const int32_t yOffset = fReader.readS32();
+            const int32_t xOffset = this->readFixed();

[reed1, 2014/06/05 12:33:05]

These are ints, not fixed.

[sugoi, 2014/06/05 12:43:16]

readS32() is equivalent to readFixed(), so if I use readInt(), that'll change
the reading function, unless readS32() was wrong to begin with.

+            const int32_t yOffset = this->readFixed();
             if (fBitmapDecoder != NULL && fBitmapDecoder(data, length, bitmap)) {
                 if (bitmap->width() == width && bitmap->height() == height) {
 #ifdef DEBUG_NON_DETERMINISTIC_ASSERT
                     if (0 != xOffset || 0 != yOffset) {
                         SkDebugf("SkReadBuffer::readBitmap: heights match,"
                                  " but offset is not zero. \nInfo about the bitmap:"
                                  "\n\tIndex: %d\n\tDimensions: [%d %d]\n\tEncoded"
                                  " data size: %d\n\tOffset: (%d, %d)\n",
                                  fDecodedBitmapIndex, width, height, length, xOffset,
                                  yOffset);
@@ skipping 119 matching lines @@
             return;
         }
     } else {
         if (NULL == this->readFunctionPtr()) {
             return;
         }
     }
     uint32_t sizeRecorded = fReader.readU32();
     fReader.skip(sizeRecorded);
 }