Revert "Revert "Fix SkPathRef deserialization malloc crash""

This reverts commit a4ce4b1f6bef22e7ca5c7a952197fc2bc70923fc.

Fix SkPathRef deserialization malloc crash

If the path says it has more points/verbs/etc than the buffer could
be holding, then resetToSize could try to allocate something huge
and crash.

Bug: skia:
Change-Id: I23b8870e9f74386aca89fb8f9a60d3b452044094
Reviewed-on: https://skia-review.googlesource.com/26805
Commit-Queue: Mike Klein <mtklein@chromium.org>
Reviewed-by: Mike Klein <mtklein@chromium.org>

1 files changed, 7 insertions, 0 deletions

diff --git a/include/core/SkPath.h b/include/core/SkPath.h
index b36fa65a6d..d0841fd250 100644
--- a/include/core/SkPath.h
+++ b/include/core/SkPath.h
@@ -12,6 +12,7 @@
 #include "../private/SkPathRef.h"
 
 class SkAutoPathBoundsUpdate;
+class SkData;
 class SkRRect;
 class SkWStream;
 
@@ -1090,6 +1091,12 @@ public:
      *  If buffer is NULL, it still returns the number of bytes.
      */
     size_t writeToMemory(void* buffer) const;
+
+    /**
+     *  Write the path to a buffer. Can recreate the path by calling readFromMemory().
+     */
+    sk_sp<SkData> serialize() const;
+
     /**
      * Initializes the path from the buffer
      *