Adding error checks to SkRBuffer

src/core/SkPathRef.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBuffer.h"
 #include "SkOnce.h"
 #include "SkPath.h"
@@ skipping 94 matching lines @@
 
 SkPathRef* SkPathRef::CreateFromBuffer(SkRBuffer* buffer
 #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO
                                    , bool newFormat, int32_t oldPacked
 #endif
     ) {
     SkPathRef* ref = SkNEW(SkPathRef);
 #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO
     if (newFormat) {
 #endif
-        int32_t packed = buffer->readU32();
+        int32_t packed;
+        if (!buffer->readS32(&packed)) {
+            SkDELETE(ref);
+            return NULL;
+        }
 
         ref->fIsFinite = (packed >> kIsFinite_SerializationShift) & 1;
 #ifndef DELETE_THIS_CODE_WHEN_SKPS_ARE_REBUILT_AT_V14_AND_ALL_OTHER_INSTANCES_TOO
     } else {
         ref->fIsFinite = (oldPacked >> SkPath::kOldIsFinite_SerializationShift) & 1;
     }
 #endif
 
-    ref->fGenerationID = buffer->readU32();
-    int32_t verbCount = buffer->readS32();
-    int32_t pointCount = buffer->readS32();
-    int32_t conicCount = buffer->readS32();
+    int32_t verbCount, pointCount, conicCount;
+    if (!buffer->readU32(&(ref->fGenerationID)) ||
+        !buffer->readS32(&verbCount) ||
+        !buffer->readS32(&pointCount) ||
+        !buffer->readS32(&conicCount)) {
+        SkDELETE(ref);
+        return NULL;
+    }
+
     ref->resetToSize(verbCount, pointCount, conicCount);
-
     SkASSERT(verbCount == ref->countVerbs());
     SkASSERT(pointCount == ref->countPoints());
     SkASSERT(conicCount == ref->fConicWeights.count());
-    buffer->read(ref->verbsMemWritable(), verbCount * sizeof(uint8_t));
-    buffer->read(ref->fPoints, pointCount * sizeof(SkPoint));
-    buffer->read(ref->fConicWeights.begin(), conicCount * sizeof(SkScalar));
-    buffer->read(&ref->fBounds, sizeof(SkRect));
+
+    if (!buffer->read(ref->verbsMemWritable(), verbCount * sizeof(uint8_t)) ||
+        !buffer->read(ref->fPoints, pointCount * sizeof(SkPoint)) ||
+        !buffer->read(ref->fConicWeights.begin(), conicCount * sizeof(SkScalar)) ||
+        !buffer->read(&ref->fBounds, sizeof(SkRect))) {
+        SkDELETE(ref);
+        return NULL;
+    }
     ref->fBoundsIsDirty = false;
     return ref;
 }
 
 void SkPathRef::Rewind(SkAutoTUnref<SkPathRef>* pathRef) {
     if ((*pathRef)->unique()) {
         SkDEBUGCODE((*pathRef)->validate();)
         (*pathRef)->fBoundsIsDirty = true;  // this also invalidates fIsFinite
         (*pathRef)->fVerbCnt = 0;
         (*pathRef)->fPointCnt = 0;
@@ skipping 183 matching lines @@
                      fPoints[i].fY - fBounds.fBottom < SK_ScalarNearlyZero);
             if (!fPoints[i].isFinite()) {
                 isFinite = false;
             }
         }
         SkASSERT(SkToBool(fIsFinite) == isFinite);
     }
 #endif
 }
 #endif