Fix a sign bug where memcpy was called with negative length.