Checking structure sizes before reading them from memory to avoid overflowing the buffer's stream.

include/core/SkReader32.h

Index: include/core/SkReader32.h
diff --git a/include/core/SkReader32.h b/include/core/SkReader32.h
index 7a8d22a80c166c82539f05fe9d83186269416762..ef2098b9b2056ce50a49e17f01b0f0a5dc954757 100644
--- a/include/core/SkReader32.h
+++ b/include/core/SkReader32.h
@@ -107,26 +107,28 @@ public:
     uint32_t readU32() { return this->readInt(); }
 
     void readPath(SkPath* path) {

[reed1, 2013/10/30 15:37:07]

now it seems that all of these read-helpers must return a bool, or some other
way to indicate that we did or did not initialize the output parameter.

[sugoi1, 2013/10/30 18:07:03]

Done.

-        size_t size = path->readFromMemory(this->peek());
+        size_t size = path->readFromMemory(this->peek(), this->available());
         SkASSERT(SkAlign4(size) == size);
-        (void)this->skip(size);
+        (void)this->skip(size > 0 ? size : this->available());

[reed1, 2013/10/30 15:37:07]

I think a quick comment in the code would help here:

// if readFromMemory fails (available was too small), it returns 0, in which
case we want to skip to the end

[sugoi1, 2013/10/30 18:07:03]

Done.

     }
 
     void readMatrix(SkMatrix* matrix) {
-        size_t size = matrix->readFromMemory(this->peek());
+        size_t size = matrix->readFromMemory(this->peek(), this->available());
         SkASSERT(SkAlign4(size) == size);
-        (void)this->skip(size);
+        (void)this->skip(size > 0 ? size : this->available());
     }
 
     SkRRect* readRRect(SkRRect* rrect) {
-        rrect->readFromMemory(this->skip(SkRRect::kSizeInMemory));
+        size_t size = rrect->readFromMemory(this->peek(), this->available());
+        SkASSERT(SkAlign4(size) == size);
+        (void)this->skip(size > 0 ? size : this->available());
         return rrect;
     }
 
     void readRegion(SkRegion* rgn) {
-        size_t size = rgn->readFromMemory(this->peek());
+        size_t size = rgn->readFromMemory(this->peek(), this->available());
         SkASSERT(SkAlign4(size) == size);
-        (void)this->skip(size);
+        (void)this->skip(size > 0 ? size : this->available());
     }
 
     /**