Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/core/SkValidatingReadBuffer.cpp

Index: src/core/SkValidatingReadBuffer.cpp
diff --git a/src/core/SkValidatingReadBuffer.cpp b/src/core/SkValidatingReadBuffer.cpp
index a0e1a4179f2cd18ff431203aa8b1091102a68ec7..b890c2653ed60d53db8d4a90c78f081d703042f0 100644
--- a/src/core/SkValidatingReadBuffer.cpp
+++ b/src/core/SkValidatingReadBuffer.cpp
@@ -113,11 +113,9 @@ void SkValidatingReadBuffer::readPoint(SkPoint* point) {
 }
 
 void SkValidatingReadBuffer::readMatrix(SkMatrix* matrix) {
-    const size_t size = matrix->readFromMemory(fReader.peek());
-    fError = fError || (SkAlign4(size) != size);
-    if (!fError) {
-        (void)this->skip(size);
-    }
+    matrix->setAll(this->readScalar(), this->readScalar(), this->readScalar(),
+                   this->readScalar(), this->readScalar(), this->readScalar(),
+                   this->readScalar(), this->readScalar(), this->readScalar());
 }
 
 void SkValidatingReadBuffer::readIRect(SkIRect* rect) {
@@ -135,16 +133,16 @@ void SkValidatingReadBuffer::readRect(SkRect* rect) {
 }
 
 void SkValidatingReadBuffer::readRegion(SkRegion* region) {
-    const size_t size = region->readFromMemory(fReader.peek());
-    fError = fError || (SkAlign4(size) != size);
+    const size_t size = region->readFromMemory(fReader.peek(), fReader.available());
+    fError = fError || (SkAlign4(size) != size) || (0 == size);
     if (!fError) {
         (void)this->skip(size);
     }
 }
 
 void SkValidatingReadBuffer::readPath(SkPath* path) {
-    const size_t size = path->readFromMemory(fReader.peek());
-    fError = fError || (SkAlign4(size) != size);
+    const size_t size = path->readFromMemory(fReader.peek(), fReader.available());
+    fError = fError || (SkAlign4(size) != size) || (0 == size);
     if (!fError) {
         (void)this->skip(size);
     }
@@ -205,6 +203,8 @@ uint32_t SkValidatingReadBuffer::readScalarArray(SkScalar* values) {
 }
 
 uint32_t SkValidatingReadBuffer::getArrayCount() {
+    const size_t inc = sizeof(uint32_t);
+    fError = fError || !IsPtrAlign4(fReader.peek()) || !fReader.isAvailable(inc);
     return *(uint32_t*)fReader.peek();
 }