diff --git a/drm/common/IDrmManagerService.cpp b/drm/common/IDrmManagerService.cpp
index c37b4f8..458f1b6 100644
--- a/drm/common/IDrmManagerService.cpp
+++ b/drm/common/IDrmManagerService.cpp
@@ -37,7 +37,7 @@
 
 using namespace android;
 
-static void writeDecrptHandleToParcelData(
+static void writeDecryptHandleToParcelData(
         const DecryptHandle* handle, Parcel* data) {
     data->writeInt32(handle->decryptId);
     data->writeString8(handle->mimeType);
@@ -46,14 +46,14 @@
 
     int size = handle->copyControlVector.size();
     data->writeInt32(size);
-    for(int i = 0; i < size; i++) {
+    for (int i = 0; i < size; i++) {
         data->writeInt32(handle->copyControlVector.keyAt(i));
         data->writeInt32(handle->copyControlVector.valueAt(i));
     }
 
     size = handle->extendedData.size();
     data->writeInt32(size);
-    for(int i = 0; i < size; i++) {
+    for (int i = 0; i < size; i++) {
         data->writeString8(handle->extendedData.keyAt(i));
         data->writeString8(handle->extendedData.valueAt(i));
     }
@@ -77,14 +77,14 @@
     handle->status = data.readInt32();
 
     int size = data.readInt32();
-    for (int i = 0; i < size; i ++) {
+    for (int i = 0; i < size; i++) {
         DrmCopyControl key = (DrmCopyControl)data.readInt32();
         int value = data.readInt32();
         handle->copyControlVector.add(key, value);
     }
 
     size = data.readInt32();
-    for (int i = 0; i < size; i ++) {
+    for (int i = 0; i < size; i++) {
         String8 key = data.readString8();
         String8 value = data.readString8();
         handle->extendedData.add(key, value);
@@ -416,7 +416,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     data.writeInt32(action);
     data.writeInt32(static_cast< int>(reserve));
@@ -433,7 +433,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     data.writeInt32(playbackStatus);
     data.writeInt64(position);
@@ -646,7 +646,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     remote()->transact(CLOSE_DECRYPT_SESSION, data, &reply);
 
@@ -662,7 +662,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     data.writeInt32(decryptUnitId);
 
@@ -682,7 +682,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     data.writeInt32(decryptUnitId);
     data.writeInt32((*decBuffer)->length);
@@ -715,7 +715,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     data.writeInt32(decryptUnitId);
 
@@ -733,7 +733,7 @@
     data.writeInterfaceToken(IDrmManagerService::getInterfaceDescriptor());
     data.writeInt32(uniqueId);
 
-    writeDecrptHandleToParcelData(decryptHandle, &data);
+    writeDecryptHandleToParcelData(decryptHandle, &data);
 
     data.writeInt32(numBytes);
     data.writeInt64(offset);
@@ -1244,7 +1244,7 @@
             = openDecryptSession(uniqueId, fd, data.readInt64(), data.readInt64());
 
         if (NULL != handle) {
-            writeDecrptHandleToParcelData(handle, reply);
+            writeDecryptHandleToParcelData(handle, reply);
             clearDecryptHandle(handle);
             delete handle; handle = NULL;
         }
@@ -1262,7 +1262,7 @@
         DecryptHandle* handle = openDecryptSession(uniqueId, uri.string());
 
         if (NULL != handle) {
-            writeDecrptHandleToParcelData(handle, reply);
+            writeDecryptHandleToParcelData(handle, reply);
 
             clearDecryptHandle(handle);
             delete handle; handle = NULL;
diff --git a/drm/libdrmframework/include/PlugInManager.h b/drm/libdrmframework/include/PlugInManager.h
index 8029138..7bb143f 100644
--- a/drm/libdrmframework/include/PlugInManager.h
+++ b/drm/libdrmframework/include/PlugInManager.h
@@ -202,7 +202,7 @@
     Vector<String8> getPlugInPathList(const String8& rsDirPath) {
         Vector<String8> fileList;
         DIR* pDir = opendir(rsDirPath.string());
-        struct dirent* pEntry = new dirent();
+        struct dirent* pEntry;
 
         while (NULL != pDir && NULL != (pEntry = readdir(pDir))) {
             if (!isPlugIn(pEntry)) {
@@ -219,8 +219,6 @@
         if (NULL != pDir) {
             closedir(pDir);
         }
-        delete pEntry;
-        pEntry = NULL;
 
         return fileList;
     }
diff --git a/media/libeffects/factory/EffectsFactory.c b/media/libeffects/factory/EffectsFactory.c
index b0e8585..a3e76d9 100644
--- a/media/libeffects/factory/EffectsFactory.c
+++ b/media/libeffects/factory/EffectsFactory.c
@@ -257,7 +257,7 @@
     }
 
     // create effect in library
-    l->desc->create_effect(uuid, sessionId, ioId, &itfe);
+    ret = l->desc->create_effect(uuid, sessionId, ioId, &itfe);
     if (ret != 0) {
         LOGW("EffectCreate() library %s: could not create fx %s, error %d", l->name, d->name, ret);
         goto exit;
diff --git a/media/libstagefright/MPEG4Writer.cpp b/media/libstagefright/MPEG4Writer.cpp
index 9ad1d4a..58f6699 100644
--- a/media/libstagefright/MPEG4Writer.cpp
+++ b/media/libstagefright/MPEG4Writer.cpp
@@ -1974,7 +1974,17 @@
     int64_t previousPausedDurationUs = 0;
     int64_t timestampUs = 0;
     int64_t cttsDeltaTimeUs = 0;
+    bool hasBFrames = false;
 
+#if 1
+    // XXX: Samsung's video encoder's output buffer timestamp
+    // is not correct. see bug 4724339
+    char value[PROPERTY_VALUE_MAX];
+    if (property_get("rw.media.record.hasb", value, NULL) &&
+        (!strcasecmp(value, "true") || !strcasecmp(value, "1"))) {
+        hasBFrames = true;
+    }
+#endif
     if (mIsAudio) {
         prctl(PR_SET_NAME, (unsigned long)"AudioTrackEncoding", 0, 0, 0);
     } else {
@@ -2117,7 +2127,7 @@
 
         timestampUs -= previousPausedDurationUs;
         CHECK(timestampUs >= 0);
-        if (!mIsAudio) {
+        if (!mIsAudio && hasBFrames) {
             /*
              * Composition time: timestampUs
              * Decoding time: decodingTimeUs
diff --git a/media/mtp/MtpServer.cpp b/media/mtp/MtpServer.cpp
index 4a8fd3e..9ec73c4 100644
--- a/media/mtp/MtpServer.cpp
+++ b/media/mtp/MtpServer.cpp
@@ -533,12 +533,10 @@
     MtpStorageID storageID = mRequest.getParameter(1);      // 0xFFFFFFFF for all storage
     MtpObjectFormat format = mRequest.getParameter(2);      // 0 for all formats
     MtpObjectHandle parent = mRequest.getParameter(3);      // 0xFFFFFFFF for objects with no parent
-                                                            // 0x00000000 for all objects?
+                                                            // 0x00000000 for all objects
 
     if (!hasStorage(storageID))
         return MTP_RESPONSE_INVALID_STORAGE_ID;
-    if (parent == 0xFFFFFFFF)
-        parent = 0;
 
     MtpObjectHandleList* handles = mDatabase->getObjectList(storageID, format, parent);
     mData.putAUInt32(handles);
@@ -552,11 +550,9 @@
     MtpStorageID storageID = mRequest.getParameter(1);      // 0xFFFFFFFF for all storage
     MtpObjectFormat format = mRequest.getParameter(2);      // 0 for all formats
     MtpObjectHandle parent = mRequest.getParameter(3);      // 0xFFFFFFFF for objects with no parent
-                                                            // 0x00000000 for all objects?
+                                                            // 0x00000000 for all objects
     if (!hasStorage(storageID))
         return MTP_RESPONSE_INVALID_STORAGE_ID;
-    if (parent == 0xFFFFFFFF)
-        parent = 0;
 
     int count = mDatabase->getNumObjects(storageID, format, parent);
     if (count >= 0) {
diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index 1e8c30b..a011ae2 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -147,6 +147,14 @@
         return NULL;
     }
 
+    char value[PROPERTY_VALUE_MAX];
+    property_get("sys.secpolicy.camera.disabled", value, "0");
+    if (strcmp(value, "1") == 0) {
+        // Camera is disabled by DevicePolicyManager.
+        LOGI("Camera is disabled. connect X (pid %d) rejected", callingPid);
+        return NULL;
+    }
+
     Mutex::Autolock lock(mServiceLock);
     if (mClient[cameraId] != 0) {
         client = mClient[cameraId].promote();