Code: int append_camera_metadata(camera_metadata_t *dst,

         const camera_metadata_t *src) {
     if (dst == NULL || src == NULL ) return ERROR;
 
     if (dst->entry_capacity < src->entry_count + dst->entry_count) return ERROR;
     if (dst->data_capacity < src->data_count + dst->data_count) return ERROR;
 
    memcpy(get_entries(dst) + dst->entry_count, get_entries(src),
 sizeof(camera_metadata_buffer_entry_t[src->entry_count]));
    memcpy(get_data(dst) + dst->data_count, get_data(src),
 sizeof(uint8_t[src->data_count]));
 if (dst->data_count != 0) {
 camera_metadata_buffer_entry_t *entry = get_entries(dst) + dst->entry_count;
 for (size_t i = 0; i < src->entry_count; i++, entry++) {
 if ( calculate_camera_metadata_entry_data_size(entry->type,
                            entry->count) > 0 ) {
                entry->data.offset += dst->data_count;
 }
 }
 }
 if (dst->entry_count == 0) {
        dst->flags |= src->flags & FLAG_SORTED;
 } else if (src->entry_count != 0) {
        dst->flags &= ~FLAG_SORTED;
 } else {
 }
    dst->entry_count += src->entry_count;
    dst->data_count += src->data_count;

    assert(validate_camera_metadata_structure(dst, NULL) == OK);
 return OK;
}

Vulnerability Type: +Priv 
CWE ID: CWE-264
Summary: camera/src/camera_metadata.c in the Camera service in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 30591838.
Commit Message: Camera metadata: Check for inconsistent data count

Resolve merge conflict for nyc-release
Also check for overflow of data/entry count on append.

Bug: 30591838
Change-Id: Ibf4c3c6e236cdb28234f3125055d95ef0a2416a2
