Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

include/core/SkWriter32.h

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #ifndef SkWriter32_DEFINED
@@ skipping 111 matching lines @@
         rrect.writeToMemory(this->reserve(SkRRect::kSizeInMemory));
     }
 
     void writePath(const SkPath& path) {
         size_t size = path.writeToMemory(NULL);
         SkASSERT(SkAlign4(size) == size);
         path.writeToMemory(this->reserve(size));
     }
 
     void writeMatrix(const SkMatrix& matrix) {
-        size_t size = matrix.writeToMemory(NULL);
-        SkASSERT(SkAlign4(size) == size);
-        matrix.writeToMemory(this->reserve(size));
+        for (int i = 0; i < 9; ++i) {
+            this->writeScalar(matrix[i]);

[mtklein, 2013/10/25 18:11:49]

Were we just never writing the flags at all?

[sugoi1, 2013/10/25 18:27:20]

No, SkMatrix::writeToMemory() was only writing the SkScalar values.

+        }
+    }
+
+    uint32_t writeMatrixSize(const SkMatrix&) const {
+        return 9 * sizeof(SkScalar);
+    }
+
+    static uint32_t MaxWriteMatrixSize() {
+        return 9 * sizeof(SkScalar) + sizeof(uint32_t);
     }
 
     void writeRegion(const SkRegion& rgn) {
         size_t size = rgn.writeToMemory(NULL);
         SkASSERT(SkAlign4(size) == size);
         rgn.writeToMemory(this->reserve(size));
     }
 
     // write count bytes (must be a multiple of 4)
     void writeMul4(const void* values, size_t size) {
@@ skipping 151 matching lines @@
 
 private:
     union {
         void*   fPtrAlignment;
         double  fDoubleAlignment;
         char    fStorage[SIZE];
     } fData;
 };
 
 #endif