diff --git a/media/libstagefright/foundation/AString.cpp b/media/libstagefright/foundation/AString.cpp
index fcd825f..f2d501e 100644
--- a/media/libstagefright/foundation/AString.cpp
+++ b/media/libstagefright/foundation/AString.cpp
@@ -197,64 +197,64 @@
 
 void AString::append(int x) {
     char s[16];
-    sprintf(s, "%d", x);
-
+    int result = snprintf(s, sizeof(s), "%d", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(unsigned x) {
     char s[16];
-    sprintf(s, "%u", x);
-
+    int result = snprintf(s, sizeof(s), "%u", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(long x) {
-    char s[16];
-    sprintf(s, "%ld", x);
-
+    char s[32];
+    int result = snprintf(s, sizeof(s), "%ld", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(unsigned long x) {
-    char s[16];
-    sprintf(s, "%lu", x);
-
+    char s[32];
+    int result = snprintf(s, sizeof(s), "%lu", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(long long x) {
     char s[32];
-    sprintf(s, "%lld", x);
-
+    int result = snprintf(s, sizeof(s), "%lld", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(unsigned long long x) {
     char s[32];
-    sprintf(s, "%llu", x);
-
+    int result = snprintf(s, sizeof(s), "%llu", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(float x) {
     char s[16];
-    sprintf(s, "%f", x);
-
+    int result = snprintf(s, sizeof(s), "%f", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(double x) {
     char s[16];
-    sprintf(s, "%f", x);
-
+    int result = snprintf(s, sizeof(s), "%f", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
 void AString::append(void *x) {
-    char s[16];
-    sprintf(s, "%p", x);
-
+    char s[32];
+    int result = snprintf(s, sizeof(s), "%p", x);
+    CHECK((result > 0) && ((size_t) result) < sizeof(s));
     append(s);
 }
 
diff --git a/services/camera/libcameraservice/api2/CameraDeviceClient.cpp b/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
index 3d85e90..5a48a62 100644
--- a/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
+++ b/services/camera/libcameraservice/api2/CameraDeviceClient.cpp
@@ -497,6 +497,7 @@
 
     if (!mDevice.get()) return DEAD_OBJECT;
 
+    mStreamingRequestList.clear();
     return mDevice->flush(lastFrameNumber);
 }
 
diff --git a/services/camera/libcameraservice/device3/Camera3Device.cpp b/services/camera/libcameraservice/device3/Camera3Device.cpp
index f965136..729020b 100644
--- a/services/camera/libcameraservice/device3/Camera3Device.cpp
+++ b/services/camera/libcameraservice/device3/Camera3Device.cpp
@@ -681,6 +681,8 @@
     }
     mInputStream = newStream;
 
+    mNeedConfig = true;
+
     *id = mNextStreamId++;
     *zslStream = newStream;
 
@@ -1749,13 +1751,14 @@
 
         gotResult = true;
 
-        if (frameNumber != mNextResultFrameNumber) {
+        // TODO: need to track errors for tighter bounds on expected frame number
+        if (frameNumber < mNextResultFrameNumber) {
             SET_ERR("Out-of-order capture result metadata submitted! "
                     "(got frame number %d, expecting %d)",
                     frameNumber, mNextResultFrameNumber);
             return;
         }
-        mNextResultFrameNumber++;
+        mNextResultFrameNumber = frameNumber + 1;
 
         CaptureResult captureResult;
         captureResult.mResultExtras = resultExtras;
@@ -1889,13 +1892,14 @@
             // Verify ordering of shutter notifications
             {
                 Mutex::Autolock l(mOutputLock);
-                if (frameNumber != mNextShutterFrameNumber) {
+                // TODO: need to track errors for tighter bounds on expected frame number.
+                if (frameNumber < mNextShutterFrameNumber) {
                     SET_ERR("Shutter notification out-of-order. Expected "
                             "notification for frame %d, got frame %d",
                             mNextShutterFrameNumber, frameNumber);
                     break;
                 }
-                mNextShutterFrameNumber++;
+                mNextShutterFrameNumber = frameNumber + 1;
             }
 
             CaptureResultExtras resultExtras;