Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkPicturePlayback.cpp

 
 /*
  * Copyright 2011 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 #include "SkPicturePlayback.h"
 #include "SkPictureRecord.h"
 #include "SkTypeface.h"
@@ skipping 979 matching lines @@
                                         constY, paint);
                 }
             } break;
             case DRAW_RECT: {
                 const SkPaint& paint = *getPaint(reader);
                 canvas.drawRect(reader.skipT<SkRect>(), paint);
             } break;
             case DRAW_RRECT: {
                 const SkPaint& paint = *getPaint(reader);
                 SkRRect rrect;
-                canvas.drawRRect(*reader.readRRect(&rrect), paint);
+                reader.readRRect(&rrect);
+                canvas.drawRRect(rrect, paint);
             } break;
             case DRAW_SPRITE: {
                 const SkPaint* paint = getPaint(reader);
                 const SkBitmap& bitmap = getBitmap(reader);
                 int left = reader.readInt();
                 int top = reader.readInt();
                 canvas.drawSprite(bitmap, left, top, paint);
             } break;
             case DRAW_TEXT: {
                 const SkPaint& paint = *getPaint(reader);
@@ skipping 658 matching lines @@
     for (index = 0; index < fRegionCount; index++)
         bufferPtr += snprintf(bufferPtr, DUMP_BUFFER_SIZE - (bufferPtr - pBuffer),
             "region%p, ", &fRegions[index]);
     if (fRegionCount > 0)
         SkDebugf("%s0};\n", pBuffer);
 
     const_cast<SkPicturePlayback*>(this)->dumpStream();
 }
 
 #endif