Fixed array read error

src/core/SkValidatingReadBuffer.cpp

 /*
  * Copyright 2013 Google Inc.
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 #include "SkBitmap.h"
 #include "SkErrorInternals.h"
 #include "SkValidatingReadBuffer.h"
@@ skipping 157 matching lines @@
     }
     if (!fError) {
         (void)this->skip(size);
     }
 }
 
 bool SkValidatingReadBuffer::readArray(void* value, size_t size, size_t elementSize) {
     const uint32_t count = this->getArrayCount();
     this->validate(size == count);
     (void)this->skip(sizeof(uint32_t)); // Skip array count
+    const uint64_t byteLength64 = sk_64_mul(count, elementSize);
     const size_t byteLength = count * elementSize;
+    this->validate(byteLength == byteLength64);
     const void* ptr = this->skip(SkAlign4(byteLength));
     if (!fError) {
         memcpy(value, ptr, byteLength);
         return true;
     }
     return false;
 }
 
 bool SkValidatingReadBuffer::readByteArray(void* value, size_t size) {
     return readArray(static_cast<unsigned char*>(value), size, sizeof(unsigned char));
@@ skipping 74 matching lines @@
 
 void SkValidatingReadBuffer::skipFlattenable() {
     SkString name;
     this->readString(&name);
     if (fError) {
         return;
     }
     uint32_t sizeRecorded = this->readUInt();
     this->skip(sizeRecorded);
 }