Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkMatrix.cpp

 /*
  * Copyright 2006 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkMatrix.h"
 #include "Sk64.h"
 #include "SkFloatBits.h"
@@ skipping 1903 matching lines @@
                         SK_ScalarMax, SK_ScalarMax, SK_ScalarMax,
                         SK_ScalarMax, SK_ScalarMax, SK_ScalarMax);
         gInvalid.getType(); // force the type to be computed
         gOnce = true;
     }
     return gInvalid;
 }
 
 ///////////////////////////////////////////////////////////////////////////////
 
-uint32_t SkMatrix::writeToMemory(void* buffer) const {
+size_t SkMatrix::writeToMemory(void* buffer) const {
     // TODO write less for simple matrices
+    static const size_t sizeInMemory = 9 * sizeof(SkScalar);
     if (buffer) {
-        memcpy(buffer, fMat, 9 * sizeof(SkScalar));
+        memcpy(buffer, fMat, sizeInMemory);
     }
-    return 9 * sizeof(SkScalar);
+    return sizeInMemory;
 }
 
-uint32_t SkMatrix::readFromMemory(const void* buffer) {
+size_t SkMatrix::readFromMemory(const void* buffer, size_t length) {
+    static const size_t sizeInMemory = 9 * sizeof(SkScalar);
+    if (length < sizeInMemory) {
+        return 0;
+    }
     if (buffer) {
-        memcpy(fMat, buffer, 9 * sizeof(SkScalar));
+        memcpy(fMat, buffer, sizeInMemory);
         this->setTypeMask(kUnknown_Mask);
     }
-    return 9 * sizeof(SkScalar);
+    return sizeInMemory;
 }
 
 #ifdef SK_DEVELOPER
 void SkMatrix::dump() const {
     SkString str;
     this->toString(&str);
     SkDebugf("%s\n", str.c_str());
 }
 
 void SkMatrix::toString(SkString* str) const {
@@ skipping 155 matching lines @@
         rotation1->fX = cos1;
         rotation1->fY = sin1;
     }
     if (NULL != rotation2) {
         rotation2->fX = cos2;
         rotation2->fY = sin2;
     }
 
     return true;
 }