commit 18a081e68441a098fe0a1a6283439913cfb6b0ca
author Owen Lin <owenlin@google.com> Wed Jul 29 21:26:18 2009 +0800
committer Owen Lin <owenlin@google.com> Wed Jul 29 21:27:08 2009 +0800
tree 8b03ac8ab87a189d6b84fd71f0ff173a5a1e7a57
parent 59e2ad93bf37c7ded44c033d38fe7c972e2f4118

Fix OOB in arraycopy.

core/java/android/view/MotionEvent.java

diff --git a/core/java/android/view/MotionEvent.java b/core/java/android/view/MotionEvent.java
index d46660c..ae84e1e 100644
--- a/core/java/android/view/MotionEvent.java
+++ b/core/java/android/view/MotionEvent.java
@@ -516,14 +516,14 @@
         }
         
         final int NS = (ev.mNumPointers=o.mNumPointers) * NT;
-        if (ev.mStateSamples.length < NS) {
+        if (ev.mStateSamples.length >= NS) {
             System.arraycopy(o.mStateSamples, 0, ev.mStateSamples, 0, NS);
         } else {
             ev.mStateSamples = (int[])o.mStateSamples.clone();
         }
         
         final int ND = NS * NUM_SAMPLE_DATA;
-        if (ev.mDataSamples.length < ND) {
+        if (ev.mDataSamples.length >= ND) {
             System.arraycopy(o.mDataSamples, 0, ev.mDataSamples, 0, ND);
         } else {
             ev.mDataSamples = (float[])o.mDataSamples.clone();