diff --git a/camera/tests/Android.mk b/camera/tests/Android.mk
index 8019999..0978a81 100644
--- a/camera/tests/Android.mk
+++ b/camera/tests/Android.mk
@@ -21,6 +21,7 @@
 	CameraBinderTests.cpp
 
 LOCAL_SHARED_LIBRARIES := \
+	liblog \
 	libutils \
 	libcutils \
 	libcamera_metadata \
diff --git a/media/img_utils/src/Android.mk b/media/img_utils/src/Android.mk
index 4074849..c1f64ca 100644
--- a/media/img_utils/src/Android.mk
+++ b/media/img_utils/src/Android.mk
@@ -34,6 +34,7 @@
   StripSource.cpp \
 
 LOCAL_SHARED_LIBRARIES := \
+  liblog \
   libexpat \
   libutils \
   libcutils \
diff --git a/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp b/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
index 13716cf..978d360 100644
--- a/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
+++ b/media/libmediaplayerservice/nuplayer/NuPlayerCCDecoder.cpp
@@ -256,6 +256,12 @@
             payload_size += last_byte;
         } while (last_byte == 0xFF);
 
+        if (payload_size > SIZE_MAX / 8
+                || !br.atLeastNumBitsLeft(payload_size * 8)) {
+            ALOGV("Malformed SEI payload");
+            break;
+        }
+
         // sei_payload()
         if (payload_type == 4) {
             bool isCC = false;
diff --git a/media/libstagefright/SampleTable.cpp b/media/libstagefright/SampleTable.cpp
index f5d9ec7..3c14bf2 100644
--- a/media/libstagefright/SampleTable.cpp
+++ b/media/libstagefright/SampleTable.cpp
@@ -209,6 +209,11 @@
 status_t SampleTable::setSampleToChunkParams(
         off64_t data_offset, size_t data_size) {
     if (mSampleToChunkOffset >= 0) {
+        // already set
+        return ERROR_MALFORMED;
+    }
+
+    if (data_offset < 0) {
         return ERROR_MALFORMED;
     }
 
@@ -246,7 +251,7 @@
     for (uint32_t i = 0; i < mNumSampleToChunkOffsets; ++i) {
         uint8_t buffer[12];
 
-        if ((off64_t)(SIZE_MAX - 8 - (i * 12)) < mSampleToChunkOffset) {
+        if ((SIZE_MAX - 8 - (i * 12)) < (size_t)mSampleToChunkOffset) {
             return ERROR_MALFORMED;
         }
 
diff --git a/media/libstagefright/httplive/Android.mk b/media/libstagefright/httplive/Android.mk
index f904212..2c985fc 100644
--- a/media/libstagefright/httplive/Android.mk
+++ b/media/libstagefright/httplive/Android.mk
@@ -18,6 +18,7 @@
 LOCAL_SANITIZE := unsigned-integer-overflow signed-integer-overflow
 
 LOCAL_SHARED_LIBRARIES := \
+        liblog \
         libbinder \
         libcrypto \
         libcutils \
diff --git a/services/audioflinger/AudioFlinger.cpp b/services/audioflinger/AudioFlinger.cpp
index 016c25e..563c528 100644
--- a/services/audioflinger/AudioFlinger.cpp
+++ b/services/audioflinger/AudioFlinger.cpp
@@ -1364,11 +1364,15 @@
         mAudioFlinger(audioFlinger),
         mPid(pid)
 {
-    size_t heapSize = kClientSharedHeapSizeBytes;
-    // Increase heap size on non low ram devices to limit risk of reconnection failure for
-    // invalidated tracks
-    if (!audioFlinger->isLowRamDevice()) {
-        heapSize *= kClientSharedHeapSizeMultiplier;
+    size_t heapSize = property_get_int32("ro.af.client_heap_size_kbyte", 0);
+    heapSize *= 1024;
+    if (!heapSize) {
+        heapSize = kClientSharedHeapSizeBytes;
+        // Increase heap size on non low ram devices to limit risk of reconnection failure for
+        // invalidated tracks
+        if (!audioFlinger->isLowRamDevice()) {
+            heapSize *= kClientSharedHeapSizeMultiplier;
+        }
     }
     mMemoryDealer = new MemoryDealer(heapSize, "AudioFlinger::Client");
 }
diff --git a/services/audiopolicy/enginedefault/Android.mk b/services/audiopolicy/enginedefault/Android.mk
index 85d1822..b247e21 100755
--- a/services/audiopolicy/enginedefault/Android.mk
+++ b/services/audiopolicy/enginedefault/Android.mk
@@ -40,6 +40,7 @@
     libxml2
 
 LOCAL_SHARED_LIBRARIES += \
+    liblog \
     libcutils \
     libutils \
     libaudioutils \
diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index af8fc74..eacde99 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -102,7 +102,7 @@
     sp<CameraService> cs = const_cast<CameraService*>(
             static_cast<const CameraService*>(callbacks));
 
-    cs->onDeviceStatusChanged(static_cast<camera_device_status_t>(camera_id),
+    cs->onDeviceStatusChanged(camera_id,
             static_cast<camera_device_status_t>(new_status));
 }
 
@@ -271,12 +271,14 @@
 }
 
 sp<ICameraServiceProxy> CameraService::getCameraServiceProxy() {
+    sp<ICameraServiceProxy> proxyBinder = nullptr;
+#ifndef __BRILLO__
     sp<IServiceManager> sm = defaultServiceManager();
     sp<IBinder> binder = sm->getService(String16("media.camera.proxy"));
-    if (binder == nullptr) {
-        return nullptr;
+    if (binder != nullptr) {
+        proxyBinder = interface_cast<ICameraServiceProxy>(binder);
     }
-    sp<ICameraServiceProxy> proxyBinder = interface_cast<ICameraServiceProxy>(binder);
+#endif
     return proxyBinder;
 }
 
@@ -295,7 +297,7 @@
     gCameraService = nullptr;
 }
 
-void CameraService::onDeviceStatusChanged(camera_device_status_t  cameraId,
+void CameraService::onDeviceStatusChanged(int  cameraId,
         camera_device_status_t newStatus) {
     ALOGI("%s: Status changed for cameraId=%d, newStatus=%d", __FUNCTION__,
           cameraId, newStatus);
@@ -914,6 +916,46 @@
 Status CameraService::validateConnectLocked(const String8& cameraId,
         const String8& clientName8, /*inout*/int& clientUid, /*inout*/int& clientPid) const {
 
+#if !defined(__BRILLO__)
+    Status allowed = validateClientPermissionsLocked(cameraId, clientName8, clientUid, clientPid);
+    if (!allowed.isOk()) {
+        return allowed;
+    }
+#endif  // defined(__BRILLO__)
+
+    int callingPid = getCallingPid();
+
+    if (!mModule) {
+        ALOGE("CameraService::connect X (PID %d) rejected (camera HAL module not loaded)",
+                callingPid);
+        return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
+                "No camera HAL module available to open camera device \"%s\"", cameraId.string());
+    }
+
+    if (getCameraState(cameraId) == nullptr) {
+        ALOGE("CameraService::connect X (PID %d) rejected (invalid camera ID %s)", callingPid,
+                cameraId.string());
+        return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
+                "No camera device with ID \"%s\" available", cameraId.string());
+    }
+
+    status_t err = checkIfDeviceIsUsable(cameraId);
+    if (err != NO_ERROR) {
+        switch(err) {
+            case -ENODEV:
+            case -EBUSY:
+                return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
+                        "No camera device with ID \"%s\" currently available", cameraId.string());
+            default:
+                return STATUS_ERROR_FMT(ERROR_INVALID_OPERATION,
+                        "Unknown error connecting to ID \"%s\"", cameraId.string());
+        }
+    }
+    return Status::ok();
+}
+
+Status CameraService::validateClientPermissionsLocked(const String8& cameraId,
+        const String8& clientName8, int& clientUid, int& clientPid) const {
     int callingPid = getCallingPid();
     int callingUid = getCallingUid();
 
@@ -952,24 +994,6 @@
                 clientName8.string(), clientUid, clientPid, cameraId.string());
     }
 
-    // Only use passed in clientPid to check permission. Use calling PID as the client PID that's
-    // connected to camera service directly.
-    clientPid = callingPid;
-
-    if (!mModule) {
-        ALOGE("CameraService::connect X (PID %d) rejected (camera HAL module not loaded)",
-                callingPid);
-        return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
-                "No camera HAL module available to open camera device \"%s\"", cameraId.string());
-    }
-
-    if (getCameraState(cameraId) == nullptr) {
-        ALOGE("CameraService::connect X (PID %d) rejected (invalid camera ID %s)", callingPid,
-                cameraId.string());
-        return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
-                "No camera device with ID \"%s\" available", cameraId.string());
-    }
-
     userid_t clientUserId = multiuser_get_user_id(clientUid);
 
     // Only allow clients who are being used by the current foreground device user, unless calling
@@ -983,18 +1007,6 @@
                 clientUserId, cameraId.string());
     }
 
-    status_t err = checkIfDeviceIsUsable(cameraId);
-    if (err != NO_ERROR) {
-        switch(err) {
-            case -ENODEV:
-            case -EBUSY:
-                return STATUS_ERROR_FMT(ERROR_DISCONNECTED,
-                        "No camera device with ID \"%s\" currently available", cameraId.string());
-            default:
-                return STATUS_ERROR_FMT(ERROR_INVALID_OPERATION,
-                        "Unknown error connecting to ID \"%s\"", cameraId.string());
-        }
-    }
     return Status::ok();
 }
 
diff --git a/services/camera/libcameraservice/CameraService.h b/services/camera/libcameraservice/CameraService.h
index ab93218..b199f08 100644
--- a/services/camera/libcameraservice/CameraService.h
+++ b/services/camera/libcameraservice/CameraService.h
@@ -95,7 +95,7 @@
 
     /////////////////////////////////////////////////////////////////////
     // HAL Callbacks
-    virtual void        onDeviceStatusChanged(camera_device_status_t cameraId,
+    virtual void        onDeviceStatusChanged(int cameraId,
                                               camera_device_status_t newStatus);
     virtual void        onTorchStatusChanged(const String8& cameraId,
                                              int32_t newStatus);
@@ -489,7 +489,9 @@
 
     // Check if we can connect, before we acquire the service lock.
     binder::Status validateConnectLocked(const String8& cameraId, const String8& clientName8,
-          /*inout*/int& clientUid, /*inout*/int& clientPid) const;
+            /*inout*/int& clientUid, /*inout*/int& clientPid) const;
+    binder::Status validateClientPermissionsLocked(const String8& cameraId, const String8& clientName8,
+            /*inout*/int& clientUid, /*inout*/int& clientPid) const;
 
     // Handle active client evictions, and update service state.
     // Only call with with mServiceLock held.