diff --git a/camera/metadata/BUILD.gn b/camera/metadata/BUILD.gn
index a2e2bf700bcd9891d2fe6b502269ceb7d31dbb40..356d12686fcdfe2f7f0c117f1d940a49bc97f342 100644
--- a/camera/metadata/BUILD.gn
+++ b/camera/metadata/BUILD.gn
@@ -27,7 +27,6 @@ ohos_shared_library("metadata") {
     "-Wall",
   ]
   cflags_cc = cflags
-  cflags_cc += [ "-fstack-protector-strong" ]
 
   if (drivers_interface_camera_feature_coverage) {
     cflags += [ "--coverage" ]
diff --git a/camera/metadata/include/camera_metadata_info.h b/camera/metadata/include/camera_metadata_info.h
index be3c3275224f14d8643339a48c6a8fb48b9f6ee7..409dcc9dc45b3d62b2138451ae349fd7158f6fc7 100644
--- a/camera/metadata/include/camera_metadata_info.h
+++ b/camera/metadata/include/camera_metadata_info.h
@@ -18,6 +18,7 @@
 
 #include <cstdio>
 #include <cstdint>
+#include <map>
 #include <string>
 #include "camera_metadata_operator.h"
 
@@ -58,6 +59,7 @@ private:
         camera_metadata_item_entry_t *itemToDelete, size_t dataBytes);
     static int copyMetadataMemory(common_metadata_header_t *dst, camera_metadata_item_entry_t *item,
         size_t dataPayloadSize, const void *data);
+    static bool CheckItemDataType(camera_metadata_item_entry_t &item, std::map<uint32_t, uint32_t> &itemDataType);
 
 public:
     // Allocate a new camera metadata buffer and return the metadata header
diff --git a/camera/metadata/src/camera_metadata_info.cpp b/camera/metadata/src/camera_metadata_info.cpp
index b43d668c8d59a5779ff52c890e02057fb52682f9..932de02df3c9b862cb0721604080d465d8141189 100644
--- a/camera/metadata/src/camera_metadata_info.cpp
+++ b/camera/metadata/src/camera_metadata_info.cpp
@@ -377,6 +377,14 @@ std::map<uint32_t, uint32_t> g_metadataSectionMap = {
     {OHOS_LIGHT_STATUS, OHOS_SECTION_LIGHT_STATUS},
 };
 
+std::map<uint32_t, uint32_t> g_itemDataTypeMap {
+    { OHOS_ABILITY_STREAM_AVAILABLE_BASIC_CONFIGURATIONS, META_TYPE_INT32 },
+    { OHOS_ABILITY_STREAM_AVAILABLE_EXTEND_CONFIGURATIONS, META_TYPE_INT32 },
+    { OHOS_SENSOR_INFO_MAX_FRAME_DURATION, META_TYPE_INT64 },
+    { OHOS_JPEG_MAX_SIZE, META_TYPE_INT32 },
+    { OHOS_ABILITY_CAMERA_CONNECTION_TYPE, META_TYPE_BYTE }
+};
+
 CameraMetadata::CameraMetadata(size_t itemCapacity, size_t dataCapacity)
 {
     metadata_ = AllocateCameraMetadataBuffer(itemCapacity, AlignTo(dataCapacity, DATA_ALIGNMENT));
@@ -963,6 +971,10 @@ int CameraMetadata::FindCameraMetadataItemIndex(const common_metadata_header_t *
         }
     }
 
+    if (!CheckItemDataType(*searchItem, g_itemDataTypeMap)) {
+        return CAM_META_INVALID_PARAM;
+    }
+
     if (index == src->item_count) {
         if (isPrintLog) {
             METADATA_ERR_LOG("FindCameraMetadataItemIndex item: %{public}u not found", item);
@@ -1639,4 +1651,16 @@ int32_t CameraMetadata::GetAllVendorTags(std::vector<vendorTag_t>& tagVec)
     g_vendorTagImpl->GetAllVendorTags(tagVec);
     return CAM_META_SUCCESS;
 }
+
+bool CameraMetadata::CheckItemDataType(camera_metadata_item_entry_t &item, std::map<uint32_t, uint32_t> &itemDataType)
+{
+    auto iter = itemDataType.find(item.item);
+    if (iter != itemDataType.end()) {
+        if (iter->second != item.data_type) {
+            METADATA_ERR_LOG("Invalid data type :%{public}u, item :%{public}u", item.data_type, item.item);
+            return false;
+        }
+    }
+    return true;
+}
 } // Camera
diff --git a/camera/metadata/src/metadata_utils.cpp b/camera/metadata/src/metadata_utils.cpp
index 576fc97e947541aa5d39112d07b4ccd5ba9edff4..8cedd2b587ca8885f3a703a11d369ace365e9f7f 100644
--- a/camera/metadata/src/metadata_utils.cpp
+++ b/camera/metadata/src/metadata_utils.cpp
@@ -483,7 +483,8 @@ std::shared_ptr<CameraMetadata> MetadataUtils::DecodeFromString(std::string sett
 
     IF_COND_PRINT_MSG_AND_RETURN(ret != EOK,
         "MetadataUtils::DecodeFromString Failed to copy memory for metadata header")
-    bool isItemsStartInvalid = meta->items_start >= actualMemSize || meta->items_start < headerLength;
+    bool isItemsStartInvalid = meta->items_start >= actualMemSize || meta->items_start < headerLength ||
+        meta->item_count == 0;
     bool isDataStartInvalid = meta->data_start >= actualMemSize || meta->data_start < headerLength;
     bool isMetadataCountInvaild = (actualMemSize - meta->items_start) < (uint64_t)meta->item_count * itemLen ||
         (actualMemSize - meta->data_start) < meta->data_count;
diff --git a/camera/sequenceable/buffer_handle/BUILD.gn b/camera/sequenceable/buffer_handle/BUILD.gn
index ecff4cfccca197bf1557c6221d18d5696266a692..858e2a2a00f75c9532751d35674d74a4d9ad1ac1 100644
--- a/camera/sequenceable/buffer_handle/BUILD.gn
+++ b/camera/sequenceable/buffer_handle/BUILD.gn
@@ -33,7 +33,7 @@ ohos_shared_library("libbuffer_handle_sequenceable_1.0") {
     "ipc:ipc_single",
   ]
   public_external_deps = [ "graphic_surface:buffer_handle" ]
-  cflags_cc = [ "-fstack-protector-strong" ]
+  branch_protector_ret = "pac_ret"
 
   if (drivers_interface_camera_feature_coverage) {
     cflags_cc += [ "--coverage" ]
diff --git a/camera/sequenceable/buffer_producer/BUILD.gn b/camera/sequenceable/buffer_producer/BUILD.gn
index e730e9140ac569bda656c865beacd6eed5569650..3dc22acca8a382dc82788472dc63145f8710682d 100644
--- a/camera/sequenceable/buffer_producer/BUILD.gn
+++ b/camera/sequenceable/buffer_producer/BUILD.gn
@@ -36,7 +36,7 @@ ohos_shared_library("libbuffer_producer_sequenceable_1.0") {
     "ipc:ipc_single",
   ]
   public_external_deps = [ "graphic_surface:buffer_handle" ]
-  cflags_cc = [ "-fstack-protector-strong" ]
+  branch_protector_ret = "pac_ret"
 
   if (drivers_interface_camera_feature_coverage) {
     cflags_cc += [ "--coverage" ]
diff --git a/camera/sequenceable/map_data/BUILD.gn b/camera/sequenceable/map_data/BUILD.gn
index 06e9f68b98ed20bb590098c41947cd9d0c913f7d..88af2b0bab48011081b79f0f7efa772920472c66 100644
--- a/camera/sequenceable/map_data/BUILD.gn
+++ b/camera/sequenceable/map_data/BUILD.gn
@@ -33,7 +33,7 @@ ohos_shared_library("libmap_data_sequenceable_1.0") {
     "hilog:libhilog",
     "ipc:ipc_single",
   ]
-  cflags_cc = [ "-fstack-protector-strong" ]
+  branch_protector_ret = "pac_ret"
 
   if (drivers_interface_camera_feature_coverage) {
     cflags_cc += [ "--coverage" ]