Since CryptoSession::RewrapDeviceRSAKey takes a const std::string& nonce, the calling code implicitly constructa temporary std::string from a character array with undefined termination and sometimes bogus value when nonce.data() is passed in. Bug: 9016828 Merge of https://widevine-internal-review.googlesource.com/#/c/5690/ from the Widevine CDM repository Change-Id: Ia3beaa5f1a96924a8cc53a719f25af52217b8cc5