Snap for 10269577 from 6316a79500a303cd642efc79ef9e134f3b3cb4d7 to udc-release

Change-Id: Id1c6d716535097edd13c85e7782dd7f2cba38fc3

common/hal/aidl_service/aidl_utils.cc

diff --git a/common/hal/aidl_service/aidl_utils.cc b/common/hal/aidl_service/aidl_utils.cc
index 6d5f201..332d1a1 100644
--- a/common/hal/aidl_service/aidl_utils.cc
+++ b/common/hal/aidl_service/aidl_utils.cc
@@ -728,6 +728,15 @@
 
       metadata =
           reinterpret_cast<const camera_metadata_t*>(request_settings.data());
+
+      size_t metadata_size = get_camera_metadata_size(metadata);
+      if (metadata_size != request_settings.size()) {
+        ALOGE(
+            "%s: Mismatch between camera metadata size (%zu) and request "
+            "setting size (%zu)",
+            __FUNCTION__, metadata_size, request_settings.size());
+        return BAD_VALUE;
+      }
     }
   } else {
     // Read the settings from request metadata queue.
@@ -751,6 +760,15 @@
 
     metadata = reinterpret_cast<const camera_metadata_t*>(
         metadata_queue_settings.data());
+
+    size_t metadata_size = get_camera_metadata_size(metadata);
+    if (metadata_size != message_queue_setting_size) {
+      ALOGE(
+          "%s: Mismatch between camera metadata size (%zu) and message "
+          "queue setting size (%u)",
+          __FUNCTION__, metadata_size, message_queue_setting_size);
+      return BAD_VALUE;
+    }
   }
 
   if (metadata == nullptr) {