Merge "TIF: Check the CEC message length before copying the data" into nyc-dev (b6748a2a) · Commits · e / os / android_frameworks_base

services/core/jni/com_android_server_hdmi_HdmiCecController.cpp

+1 −1

Original line number	Diff line number	Diff line
		@@ -330,7 +330,7 @@ static jint nativeSendCecCommand(JNIEnv* env, jclass clazz, jlong controllerPtr,
		jsize len = env->GetArrayLength(body);
		message.length = MIN(len, CEC_MESSAGE_BODY_MAX_LENGTH);
		ScopedByteArrayRO bodyPtr(env, body);
		std::memcpy(message.body, bodyPtr.get(), len);
		std::memcpy(message.body, bodyPtr.get(), message.length);

		HdmiCecController* controller =
		reinterpret_cast<HdmiCecController*>(controllerPtr);