Fixed bad bitmap size crashes

src/core/SkBitmap.cpp

Index: src/core/SkBitmap.cpp
diff --git a/src/core/SkBitmap.cpp b/src/core/SkBitmap.cpp
index 9d4aa87c857fa0bc62eb3bbf946b76e70940f70b..0aa3ac36cbbae8d8db615f474ec458c037682284 100644
--- a/src/core/SkBitmap.cpp
+++ b/src/core/SkBitmap.cpp
@@ -1568,6 +1568,12 @@ void SkBitmap::unflatten(SkFlattenableReadBuffer& buffer) {
             case SERIALIZE_PIXELTYPE_REF_DATA: {
                 size_t offset = buffer.readUInt();
                 SkPixelRef* pr = buffer.readPixelRef();
+                size_t cur_size = (fHeight == 0) ? 0 :
+                    ((fHeight - 1) * fRowBytes) + (fWidth * fBytesPerPixel);
+                if (!buffer.validate((NULL == pr) ||
+                                     (pr->getSize() >= (offset + cur_size)))) {
+                    offset = 0;
+                }
                 SkSafeUnref(this->setPixelRef(pr, offset));
                 break;
             }