From 18a081e68441a098fe0a1a6283439913cfb6b0ca Mon Sep 17 00:00:00 2001
From: Owen Lin <owenlin@google.com>
Date: Wed, 29 Jul 2009 21:26:18 +0800
Subject: [PATCH] Fix OOB in arraycopy.

---
 core/java/android/view/MotionEvent.java | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/core/java/android/view/MotionEvent.java b/core/java/android/view/MotionEvent.java
index d46660c2e7ba5..ae84e1e633099 100644
--- a/core/java/android/view/MotionEvent.java
+++ b/core/java/android/view/MotionEvent.java
@@ -516,14 +516,14 @@ public final class MotionEvent implements Parcelable {
         }
         
         final int NS = (ev.mNumPointers=o.mNumPointers) * NT;
-        if (ev.mStateSamples.length < NS) {
+        if (ev.mStateSamples.length >= NS) {
             System.arraycopy(o.mStateSamples, 0, ev.mStateSamples, 0, NS);
         } else {
             ev.mStateSamples = (int[])o.mStateSamples.clone();
         }
         
         final int ND = NS * NUM_SAMPLE_DATA;
-        if (ev.mDataSamples.length < ND) {
+        if (ev.mDataSamples.length >= ND) {
             System.arraycopy(o.mDataSamples, 0, ev.mDataSamples, 0, ND);
         } else {
             ev.mDataSamples = (float[])o.mDataSamples.clone();