TIF: Check the CEC message length before copying the data

Bug: 25768736 Change-Id: Ife46891e785fe816c0ee6ba65bd57512366ce84d
2016-02-12 00:12:36 -08:00
parent f61a847881
commit d0efcbbbb5
1 changed files with 1 additions and 1 deletions
--- a/services/core/jni/com_android_server_hdmi_HdmiCecController.cpp
+++ b/services/core/jni/com_android_server_hdmi_HdmiCecController.cpp
@@ -330,7 +330,7 @@ static jint nativeSendCecCommand(JNIEnv* env, jclass clazz, jlong controllerPtr,
    jsize len = env->GetArrayLength(body);
    message.length = MIN(len, CEC_MESSAGE_BODY_MAX_LENGTH);
    ScopedByteArrayRO bodyPtr(env, body);
-    std::memcpy(message.body, bodyPtr.get(), len);
+    std::memcpy(message.body, bodyPtr.get(), message.length);

    HdmiCecController* controller =
            reinterpret_cast<HdmiCecController*>(controllerPtr);