From c84c5568a84cad72bf1aebcda2afd81e7feb71ef Mon Sep 17 00:00:00 2001
From: Andreas Huber <andih@google.com>
Date: Thu, 8 Sep 2016 13:52:36 -0700
Subject: [PATCH] char16 strings returned by JNIEnv::GetStringCritical are not
 '\0' terminated.

Properly construct String16s from both pointer and length instead.

Bug: 31373735
Change-Id: Ia89df7840a48c4fce06e08fc3ae373e0fadfb44e
---
 core/jni/android_os_HwBinder.cpp | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/core/jni/android_os_HwBinder.cpp b/core/jni/android_os_HwBinder.cpp
index 97833a078f4cc..7da03143087fe 100644
--- a/core/jni/android_os_HwBinder.cpp
+++ b/core/jni/android_os_HwBinder.cpp
@@ -213,7 +213,9 @@ static void JHwBinder_native_registerService(
     sp<hardware::IBinder> binder = JHwBinder::GetNativeContext(env, thiz);
 
     status_t err = hardware::defaultServiceManager()->addService(
-                String16(reinterpret_cast<const char16_t *>(serviceName)),
+                String16(
+                    reinterpret_cast<const char16_t *>(serviceName),
+                    env->GetStringLength(serviceNameObj)),
                 binder,
                 kVersion);
 
@@ -245,12 +247,15 @@ static jobject JHwBinder_native_getService(
 
     LOG(INFO) << "looking for service '"
               << String8(String16(
-                          reinterpret_cast<const char16_t *>(serviceName))).string()
+                          reinterpret_cast<const char16_t *>(serviceName),
+                          env->GetStringLength(serviceNameObj))).string()
               << "'";
 
     sp<hardware::IBinder> service =
         hardware::defaultServiceManager()->getService(
-                String16(reinterpret_cast<const char16_t *>(serviceName)),
+                String16(
+                    reinterpret_cast<const char16_t *>(serviceName),
+                    env->GetStringLength(serviceNameObj)),
                 kVersion);
 
     env->ReleaseStringCritical(serviceNameObj, serviceName);