Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

src/pipe/SkGPipeWrite.cpp

Index: src/pipe/SkGPipeWrite.cpp
diff --git a/src/pipe/SkGPipeWrite.cpp b/src/pipe/SkGPipeWrite.cpp
index 57d4a0fdc345ee57263420a44fb08ae19e7d6783..0e7884d801f9c179a51cf15556ef4694cb9d9718 100644
--- a/src/pipe/SkGPipeWrite.cpp
+++ b/src/pipe/SkGPipeWrite.cpp
@@ -609,7 +609,7 @@ bool SkGPipeCanvas::skew(SkScalar sx, SkScalar sy) {
 bool SkGPipeCanvas::concat(const SkMatrix& matrix) {
     if (!matrix.isIdentity()) {
         NOTIFY_SETUP(this);
-        if (this->needOpBytes(matrix.writeToMemory(NULL))) {
+        if (this->needOpBytes(fWriter.writeMatrixSize(matrix))) {
             this->writeOp(kConcat_DrawOp);
             fWriter.writeMatrix(matrix);
         }
@@ -619,7 +619,7 @@ bool SkGPipeCanvas::concat(const SkMatrix& matrix) {
 
 void SkGPipeCanvas::setMatrix(const SkMatrix& matrix) {
     NOTIFY_SETUP(this);
-    if (this->needOpBytes(matrix.writeToMemory(NULL))) {
+    if (this->needOpBytes(fWriter.writeMatrixSize(matrix))) {
         this->writeOp(kSetMatrix_DrawOp);
         fWriter.writeMatrix(matrix);
     }
@@ -801,7 +801,7 @@ void SkGPipeCanvas::drawBitmapRectToRect(const SkBitmap& bm, const SkRect* src,
 void SkGPipeCanvas::drawBitmapMatrix(const SkBitmap& bm, const SkMatrix& matrix,
                                      const SkPaint* paint) {
     NOTIFY_SETUP(this);
-    size_t opBytesNeeded = matrix.writeToMemory(NULL);
+    size_t opBytesNeeded = fWriter.writeMatrixSize(matrix);
 
     if (this->commonDrawBitmap(bm, kDrawBitmapMatrix_DrawOp, 0, opBytesNeeded, paint)) {
         fWriter.writeMatrix(matrix);
@@ -891,7 +891,7 @@ void SkGPipeCanvas::drawTextOnPath(const void* text, size_t byteLength,
         size_t size = 4 + SkAlign4(byteLength) + path.writeToMemory(NULL);
         if (matrix) {
             flags |= kDrawTextOnPath_HasMatrix_DrawOpFlag;
-            size += matrix->writeToMemory(NULL);
+            size += fWriter.writeMatrixSize(*matrix);
         }
         this->writePaint(paint);
         if (this->needOpBytes(size)) {