int SkIcoCodec::onGetScanlines(void* dst, int count, size_t rowBytes) {
 SkASSERT(fCurrScanlineCodec);
 return fCurrScanlineCodec->getScanlines(dst, count, rowBytes);
}

The product writes data past the end, or before the beginning, of the intended buffer.