Fixed bad bitmap size crashes

src/core/SkBitmap.cpp

 
 /*
  * Copyright 2008 The Android Open Source Project
  *
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
 
 
 #include "SkBitmap.h"
@@ skipping 1550 matching lines @@
 
     this->setConfig(config, width, height, rowBytes, alphaType);
 
     int reftype = buffer.readInt();
     if (buffer.validate((SERIALIZE_PIXELTYPE_REF_DATA == reftype) ||
                         (SERIALIZE_PIXELTYPE_NONE == reftype))) {
         switch (reftype) {
             case SERIALIZE_PIXELTYPE_REF_DATA: {
                 size_t offset = buffer.readUInt();
                 SkPixelRef* pr = buffer.readPixelRef();
+                size_t cur_size = (fHeight == 0) ? 0 :
+                    ((fHeight - 1) * fRowBytes) + (fWidth * fBytesPerPixel);
+                if (!buffer.validate((NULL == pr) ||
+                                     (pr->getSize() >= (offset + cur_size)))) {
+                    offset = 0;
+                }
                 SkSafeUnref(this->setPixelRef(pr, offset));
                 break;
             }
             case SERIALIZE_PIXELTYPE_NONE:
                 break;
             default:
                 SkDEBUGFAIL("unrecognized pixeltype in serialized data");
                 sk_throw();
         }
     }
@@ skipping 70 matching lines @@
         if (NULL != uri) {
             str->appendf(" uri:\"%s\"", uri);
         } else {
             str->appendf(" pixelref:%p", pr);
         }
     }
 
     str->append(")");
 }
 #endif