Merge "TIF: Check the CEC message length before copying the data" into nyc-dev

2016-02-12 20:50:43 +00:00
parent 242afb7809 d0efcbbbb5
commit b6748a2aec
1 changed files with 1 additions and 1 deletions
--- a/services/core/jni/com_android_server_hdmi_HdmiCecController.cpp
+++ b/services/core/jni/com_android_server_hdmi_HdmiCecController.cpp
@@ -330,7 +330,7 @@ static jint nativeSendCecCommand(JNIEnv* env, jclass clazz, jlong controllerPtr,
    jsize len = env->GetArrayLength(body);
    message.length = MIN(len, CEC_MESSAGE_BODY_MAX_LENGTH);
    ScopedByteArrayRO bodyPtr(env, body);
-    std::memcpy(message.body, bodyPtr.get(), len);
+    std::memcpy(message.body, bodyPtr.get(), message.length);

    HdmiCecController* controller =
            reinterpret_cast<HdmiCecController*>(controllerPtr);