Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkRegion.cpp

Index: src/core/SkRegion.cpp
diff --git a/src/core/SkRegion.cpp b/src/core/SkRegion.cpp
index 02994bffb0e96d50b64c204315673d024f018528..bf4c892db55a94f43015c6e6f6aa779c8eadd71d 100644
--- a/src/core/SkRegion.cpp
+++ b/src/core/SkRegion.cpp
@@ -1130,14 +1130,14 @@ uint32_t SkRegion::writeToMemory(void* storage) const {
                          fRunHead->fRunCount * sizeof(RunType));
         }
     }
-    return buffer.pos();
+    return SkToU32(buffer.pos());
 }
 
-uint32_t SkRegion::readFromMemory(const void* storage) {
-    SkRBuffer   buffer(storage);
-    SkRegion    tmp;
-    int32_t     count;
-
+uint32_t SkRegion::readFromMemory(const void* storage, uint32_t length) {
+    SkRBufferWithSizeCheck  buffer(storage, length);
+    SkRegion                tmp;
+    int32_t                 count;
+    
     count = buffer.readS32();
     if (count >= 0) {
         buffer.read(&tmp.fBounds, sizeof(tmp.fBounds));
@@ -1150,8 +1150,12 @@ uint32_t SkRegion::readFromMemory(const void* storage) {
             buffer.read(tmp.fRunHead->writable_runs(), count * sizeof(RunType));
         }
     }
-    this->swap(tmp);
-    return buffer.pos();
+    uint32_t sizeRead = 0;
+    if (buffer.isValid()) {
+        this->swap(tmp);
+        sizeRead = SkToU32(buffer.pos());
+    }
+    return sizeRead;
 }
 
 ///////////////////////////////////////////////////////////////////////////////