A similar vulnerability is located at SkPipeInflator::getFactory. 

https://cs.chromium.org/chromium/src/third_party/skia/src/pipe/SkPipeReader.cpp?g=0&l=51

You also can use the PoC to test reproduce this case.

Patch for this case:
```
diff --git a/src/pipe/SkPipeReader.cpp b/src/pipe/SkPipeReader.cpp
index 78db581..f416a76 100644
--- a/src/pipe/SkPipeReader.cpp
+++ b/src/pipe/SkPipeReader.cpp
@@ -45,9 +45,13 @@ public:
         return fTypefaces->get(index - 1);
     }
     SkFlattenable::Factory getFactory(int index) override {
+        if (index < 1 || index > fFactories->count())
+            return nullptr;
         return index ? fFactories->getAt(index - 1) : nullptr;
     }
```

reed: would you mind taking a look at this when you have time or reassigning to a good owner?

Notice that, `SkASSERT` is always disabled in Release configuration. 
I have found many similar vulnerabilities in SkPipeInflator class. Developer doesn't validate `index` before using it. Let's check them:

https://cs.chromium.org/chromium/src/third_party/skia/src/pipe/SkPipeReader.cpp?g=0&l=41
```
    SkImage* getImage(int index) override {
        return index ? fImages->get(index - 1) : nullptr;
    }
    SkPicture* getPicture(int index) override {
        return index ? fPictures->get(index - 1) : nullptr;
    }
    SkTypeface* getTypeface(int index) override {
        return fTypefaces->get(index - 1);
    }
    SkFlattenable::Factory getFactory(int index) override {
        return index ? fFactories->getAt(index - 1) : nullptr;
    }

    bool setImage(int index, sk_sp<SkImage> img) {
        return fImages->set(index - 1, std::move(img));
    }
    bool setPicture(int index, sk_sp<SkPicture> pic) {
        return fPictures->set(index - 1, std::move(pic));
    }
    bool setTypeface(int index, sk_sp<SkTypeface> face) {
        return fTypefaces->set(index - 1, std::move(face));
    }
```

There is a patch for this issue. I also include a patch from https://bugs.chromium.org/p/chromium/issues/detail?id=887196:
```
diff --git a/src/pipe/SkPipeReader.cpp b/src/pipe/SkPipeReader.cpp
index 78db581..a2d523c 100644
--- a/src/pipe/SkPipeReader.cpp
+++ b/src/pipe/SkPipeReader.cpp
@@ -39,25 +39,39 @@ public:
     {}
 
     SkImage* getImage(int index) override {
+        if (index < 1 || (size_t)index > fImages->size())
+            return nullptr;
         return index ? fImages->get(index - 1) : nullptr;
     }
     SkPicture* getPicture(int index) override {
+        if (index < 1 || (size_t)index > fPictures->size())
+            return nullptr;
         return index ? fPictures->get(index - 1) : nullptr;
     }
     SkTypeface* getTypeface(int index) override {
+        if (index < 1 || (size_t)index > fTypefaces->size())
+            return nullptr;
         return fTypefaces->get(index - 1);
     }
     SkFlattenable::Factory getFactory(int index) override {
+        if (index < 1 || (size_t)index > fFactories->size())
+            return nullptr;
         return index ? fFactories->getAt(index - 1) : nullptr;
     }
 
     bool setImage(int index, sk_sp<SkImage> img) {
+        if (index < 1 || (size_t)index > fImages->size())
+             return false;
         return fImages->set(index - 1, std::move(img));
     }
     bool setPicture(int index, sk_sp<SkPicture> pic) {
+        if (index < 1 || (size_t)index > fPictures->size())
+             return false;
         return fPictures->set(index - 1, std::move(pic));
     }
     bool setTypeface(int index, sk_sp<SkTypeface> face) {
+        if (index < 1 || (size_t)index > fTypefaces->size())
+             return false;
         return fTypefaces->set(index - 1, std::move(face));
     }
     bool setFactory(int index, SkFlattenable::Factory factory) {
@@ -683,7 +697,9 @@ static void definePicture_handler(SkPipeReader& reader, uint32_t packedVerb, SkC
         if (!cull) {
             return;
         }
-        do_playback(reader, recorder.beginRecording(*cull), &pictureIndex);
+        if (!do_playback(reader, recorder.beginRecording(*cull), &pictureIndex)) {
+            return;
+        }
         SkASSERT(pictureIndex > 0);
         sk_sp<SkPicture> picture = recorder.finishRecordingAsPicture();
         inflator->setPicture(pictureIndex, std::move(picture));
diff --git a/src/pipe/SkRefSet.h b/src/pipe/SkRefSet.h
index e556196..522283d 100644
--- a/src/pipe/SkRefSet.h
+++ b/src/pipe/SkRefSet.h
@@ -31,6 +31,8 @@ public:
         return false;
     }
 
+    size_t size() { return (size_t)fArray.count();}
+
 private:
     SkTArray<sk_sp<T>> fArray;
 };
```

Deleted: SkPipeReader_SkPipeInflator_getPicture_oob 288 bytes

SkPipeReader_SkPipeInflator_getPicture_oob 288 bytes View Download

Deleted: SkPipeReader_SkPipeInflator_getImage_invalid_index 584 bytes

SkPipeReader_SkPipeInflator_getImage_invalid_index 584 bytes View Download

Deleted: SkPipeInflator_getTypeface_oob_2 236 bytes

SkPipeInflator_getTypeface_oob_2 236 bytes View Download

Bulk edit of recently filed skia pipe bugs.

See https://bugs.chromium.org/p/chromium/issues/detail?id=886713#c8

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot