Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkRegion.cpp

Index: src/core/SkRegion.cpp
diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp
index 02994bffb0e96d50b64c204315673d024f018528..bf7df9125d2c6994ced311ed64db7d0fbdcb8c9c 100644
--- a/src/core/SkRegion.cpp
+++ b/src/core/SkRegion.cpp
@@ -1130,14 +1130,14 @@ uint32_t SkRegion::writeToMemory(void* storage) const {
                          fRunHead->fRunCount * sizeof(RunType));
         }
     }
-    return buffer.pos();
+    return SkToU32(buffer.pos());
 }
 
-uint32_t SkRegion::readFromMemory(const void* storage) {
-    SkRBuffer   buffer(storage);
+uint32_t SkRegion::readFromMemory(const void* storage, uint32_t length) {
+    SkRBuffer   buffer(storage, length);
     SkRegion    tmp;
     int32_t     count;
-
+    
     count = buffer.readS32();
     if (count >= 0) {
         buffer.read(&tmp.fBounds, sizeof(tmp.fBounds));
@@ -1151,7 +1151,7 @@ uint32_t SkRegion::readFromMemory(const void* storage) {
         }
     }
     this->swap(tmp);
-    return buffer.pos();
+    return SkToU32(buffer.pos());
 }
 
 ///////////////////////////////////////////////////////////////////////////////