Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

include/core/SkPathRef.h

 
 /*
  * Copyright 2012 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #ifndef SkPathRef_DEFINED
 #define SkPathRef_DEFINED
 
 #include "SkMatrix.h"
 #include "SkPoint.h"
 #include "SkRect.h"
 #include "SkRefCnt.h"
 #include "SkTDArray.h"
 #include <stddef.h> // ptrdiff_t
 
+class SkFlattenableReadBuffer;
 class SkRBuffer;
 class SkWBuffer;
 
 /**
  * Holds the path verbs and points. It is versioned by a generation ID. None of its public methods
  * modify the contents. To modify or append to the verbs/points wrap the SkPathRef in an
  * SkPathRef::Editor object. Installing the editor resets the generation ID. It also performs
  * copy-on-write if the SkPathRef is shared by multipls SkPaths. The caller passes the Editor's
  * constructor a SkAutoTUnref, which may be updated to point to a new SkPathRef after the editor's
  * constructor returns.
@@ skipping 122 matching lines @@
                                       const SkPathRef& src,
                                       const SkMatrix& matrix);
 
     static SkPathRef* CreateFromBuffer(SkRBuffer* buffer
 #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO
         , bool newFormat, int32_t oldPacked
 #endif
         );
 
     /**
+     * Returns the number of bytes that will be read in CreateFromBuffer()
+     */
+    static uint32_t SizeToRead(SkFlattenableReadBuffer& buffer
+#ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO
+        , bool newFormat
+#endif
+    );
+
+
+    /**
      * Rollsback a path ref to zero verbs and points with the assumption that the path ref will be
      * repopulated with approximately the same number of verbs and points. A new path ref is created
      * only if necessary.
      */
     static void Rewind(SkAutoTUnref<SkPathRef>* pathRef);
 
     virtual ~SkPathRef() {
         SkDEBUGCODE(this->validate();)
         sk_free(fPoints);
 
@@ skipping 242 matching lines @@
     enum {
         kEmptyGenID = 1, // GenID reserved for path ref with zero points and zero verbs.
     };
     mutable int32_t     fGenerationID;
     SkDEBUGCODE(int32_t fEditorsAttached;) // assert that only one editor in use at any time.
 
     typedef SkRefCnt INHERITED;
 };
 
 #endif