Prevent SkBlockMemoryStream::skip from writing to low memory.

SkBlockMemoryStream::read was modeled on SkDynamicMemoryWStream::read.
However, SkDynamicMemoryWStream::read does not allow passing a NULL buffer
and SkBlockMemoryStream::read must correctly handle this case for skips.
In the current code, if a 'skip' crosses a block boundary, 'read' may
attempt to write to low memory.

R=robertphillips@google.com

Review URL: https://codereview.chromium.org/187683003

git-svn-id: http://skia.googlecode.com/svn/trunk@13671 2bbb7eff-a529-9590-31e7-b0007b416f81

1 files changed, 2 insertions, 3 deletions

diff --git a/src/core/SkStream.cpp b/src/core/SkStream.cpp
index 8b4b82af9a..0d30b5214c 100644
--- a/src/core/SkStream.cpp
+++ b/src/core/SkStream.cpp
@@ -694,10 +694,10 @@ public:
         size_t bytesLeftToRead = count;
         while (fCurrent != NULL) {
             size_t bytesLeftInCurrent = fCurrent->written() - fCurrentOffset;
-            size_t bytesFromCurrent = bytesLeftToRead <= bytesLeftInCurrent
-                                    ? bytesLeftToRead  : bytesLeftInCurrent;
+            size_t bytesFromCurrent = SkTMin(bytesLeftToRead, bytesLeftInCurrent);
             if (buffer) {
                 memcpy(buffer, fCurrent->start() + fCurrentOffset, bytesFromCurrent);
+                buffer = SkTAddOffset<void>(buffer, bytesFromCurrent);
             }
             if (bytesLeftToRead <= bytesFromCurrent) {
                 fCurrentOffset += bytesFromCurrent;
@@ -705,7 +705,6 @@ public:
                 return count;
             }
             bytesLeftToRead -= bytesFromCurrent;
-            buffer = SkTAddOffset<void>(buffer, bytesFromCurrent);
             fCurrent = fCurrent->fNext;
             fCurrentOffset = 0;
         }