check for bad strings in readFlattenable

Bug:792815
Change-Id: I3b79d8b182bd129e9a17185991020d1dafb66a34
Reviewed-on: https://skia-review.googlesource.com/82060
Reviewed-by: Mike Klein <mtklein@chromium.org>
Commit-Queue: Mike Reed <reed@google.com>

1 files changed, 4 insertions, 3 deletions

diff --git a/src/core/SkReadBuffer.cpp b/src/core/SkReadBuffer.cpp
index b6d0d14f48..06457fa8d8 100644
--- a/src/core/SkReadBuffer.cpp
+++ b/src/core/SkReadBuffer.cpp
@@ -418,12 +418,13 @@ SkFlattenable* SkReadBuffer::readFlattenable(SkFlattenable::Type ft) {
             // Read the index.  We are guaranteed that the first byte
             // is zeroed, so we must shift down a byte.
             uint32_t index = fReader.readU32() >> 8;
-            if (0 == index) {
+            if (!this->validate(index > 0)) {
                 return nullptr; // writer failed to give us the flattenable
             }
-
             SkString* namePtr = fFlattenableDict.find(index);
-            SkASSERT(namePtr);
+            if (!this->validate(namePtr != nullptr)) {
+                return nullptr;
+            }
             name = *namePtr;
         }