Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkValidatingReadBuffer.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
 #include "SkValidatingReadBuffer.h"
@@ skipping 100 matching lines @@
     }
     return data;
 }
 
 void SkValidatingReadBuffer::readPoint(SkPoint* point) {
     point->fX = fReader.readScalar();
     point->fY = fReader.readScalar();
 }
 
 void SkValidatingReadBuffer::readMatrix(SkMatrix* matrix) {
-    const size_t size = matrix->readFromMemory(fReader.peek());
-    this->validate(SkAlign4(size) == size);
+    size_t size = 0;
+    if (!fError) {
+        size = matrix->readFromMemory(fReader.peek(), fReader.available());
+        this->validate((SkAlign4(size) != size) || (0 == size));
+    }
     if (!fError) {
         (void)this->skip(size);
     }
 }
 
 void SkValidatingReadBuffer::readIRect(SkIRect* rect) {
     const void* ptr = this->skip(sizeof(SkIRect));
     if (!fError) {
         memcpy(rect, ptr, sizeof(SkIRect));
     }
 }
 
 void SkValidatingReadBuffer::readRect(SkRect* rect) {
     const void* ptr = this->skip(sizeof(SkRect));
     if (!fError) {
         memcpy(rect, ptr, sizeof(SkRect));
     }
 }
 
 void SkValidatingReadBuffer::readRegion(SkRegion* region) {
-    const size_t size = region->readFromMemory(fReader.peek());
-    this->validate(SkAlign4(size) == size);
+    size_t size = 0;
+    if (!fError) {
+        size = region->readFromMemory(fReader.peek(), fReader.available());
+        this->validate((SkAlign4(size) != size) || (0 == size));
+    }
     if (!fError) {
         (void)this->skip(size);
     }
 }
 
 void SkValidatingReadBuffer::readPath(SkPath* path) {
-    const size_t size = path->readFromMemory(fReader.peek());
-    this->validate(SkAlign4(size) == size);
+    size_t size = 0;
+    if (!fError) {
+        size = path->readFromMemory(fReader.peek(), fReader.available());
+        this->validate((SkAlign4(size) != size) || (0 == size));
+    }
     if (!fError) {
         (void)this->skip(size);
     }
 }
 
 bool SkValidatingReadBuffer::readArray(void* value, size_t size, size_t elementSize) {
     const uint32_t count = this->getArrayCount();
     this->validate(size == count);
     (void)this->skip(sizeof(uint32_t)); // Skip array count
     const size_t byteLength = count * elementSize;
@@ skipping 19 matching lines @@
 
 bool SkValidatingReadBuffer::readPointArray(SkPoint* points, size_t size) {
     return readArray(points, size, sizeof(SkPoint));
 }
 
 bool SkValidatingReadBuffer::readScalarArray(SkScalar* values, size_t size) {
     return readArray(values, size, sizeof(SkScalar));
 }
 
 uint32_t SkValidatingReadBuffer::getArrayCount() {
+    const size_t inc = sizeof(uint32_t);
+    fError = fError || !IsPtrAlign4(fReader.peek()) || !fReader.isAvailable(inc);
     return *(uint32_t*)fReader.peek();
 }
 
 void SkValidatingReadBuffer::readBitmap(SkBitmap* bitmap) {
     const int width = this->readInt();
     const int height = this->readInt();
     const size_t length = this->readUInt();
     // A size of zero means the SkBitmap was simply flattened.
     this->validate(length == 0);
     if (fError) {
@@ skipping 42 matching lines @@
             delete obj;
             obj = NULL;
         }
     } else {
         // we must skip the remaining data
         this->skip(sizeRecorded);
         SkASSERT(false);
     }
     return obj;
 }