Avoid nullptr deference when deserializing SkPicture

Avoid resetting SkAutoSTArray values to negatives.

Additionally, clean up some misc logs that aren't helpful.

Bug: skia:7405
Change-Id: Ied353a4e415e2efd5ab8180e7f6c681248dd9134
Reviewed-on: https://skia-review.googlesource.com/93240
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Kevin Lubick <kjlubick@google.com>

1 files changed, 3 insertions, 0 deletions

diff --git a/src/core/SkPictureData.cpp b/src/core/SkPictureData.cpp
index d0b206e90a..247d16f6d2 100644
--- a/src/core/SkPictureData.cpp
+++ b/src/core/SkPictureData.cpp
@@ -511,6 +511,9 @@ bool SkPictureData::parseBufferTag(SkReadBuffer& buffer, uint32_t tag, uint32_t
         case SK_PICT_PATH_BUFFER_TAG:
             if (size > 0) {
                 const int count = buffer.readInt();
+                if (count < 0) {
+                    return false;
+                }
                 fPaths.reset(count);
                 for (int i = 0; i < count; i++) {
                     buffer.readPath(&fPaths[i]);