Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

include/core/SkReader32.h

Index: include/core/SkReader32.h
diff --git a/include/core/SkReader32.h b/include/core/SkReader32.h
index 7a8d22a80c166c82539f05fe9d83186269416762..9efaa2f099a42d3808d6f2ce934c16888f0efcd2 100644
--- a/include/core/SkReader32.h
+++ b/include/core/SkReader32.h
@@ -107,15 +107,15 @@ public:
     uint32_t readU32() { return this->readInt(); }
 
     void readPath(SkPath* path) {
-        size_t size = path->readFromMemory(this->peek());
+        size_t size = path->readFromMemory(this->peek(), this->available());
         SkASSERT(SkAlign4(size) == size);
         (void)this->skip(size);
     }
 
     void readMatrix(SkMatrix* matrix) {
-        size_t size = matrix->readFromMemory(this->peek());
-        SkASSERT(SkAlign4(size) == size);
-        (void)this->skip(size);
+        matrix->setAll(this->readScalar(), this->readScalar(), this->readScalar(),

[mtklein, 2013/10/25 18:11:49]

Um, I think we've got to do this outside the setAll.  Those this->readScalar()s
don't execute in any particular order.

[sugoi1, 2013/10/25 18:27:20]

Ah, I always thought the arguments were processed in order, will fix.

+                       this->readScalar(), this->readScalar(), this->readScalar(),
+                       this->readScalar(), this->readScalar(), this->readScalar());
     }
 
     SkRRect* readRRect(SkRRect* rrect) {
@@ -124,7 +124,7 @@ public:
     }
 
     void readRegion(SkRegion* rgn) {
-        size_t size = rgn->readFromMemory(this->peek());
+        size_t size = rgn->readFromMemory(this->peek(), this->available());
         SkASSERT(SkAlign4(size) == size);
         (void)this->skip(size);
     }