commit c14502c0076a552f1cd9b0ab4ca6dd13991e96a5
author android-build-team Robot <android-build-team-robot@google.com> Fri Jun 08 07:21:06 2018 +0000
committer android-build-team Robot <android-build-team-robot@google.com> Fri Jun 08 07:21:06 2018 +0000
tree 69f40cf73a203d781e8707c34530f9124529fa05
parent 7101b2be6a3a1b9bb19d2b90eac0d6227a441e0a
parent fc56cb1c021b449878435012687272d71a6c04b7

Snap for 4829593 from fc56cb1c021b449878435012687272d71a6c04b7 to pi-release

Change-Id: I41b2e01f9fedf7e0be72d9e2a8ec924e2fd30498

stack/avrc/avrc_api.cc

diff --git a/stack/avrc/avrc_api.cc b/stack/avrc/avrc_api.cc
index 7e3fbd7..69534e9 100644
--- a/stack/avrc/avrc_api.cc
+++ b/stack/avrc/avrc_api.cc
@@ -423,15 +423,15 @@
   }
 
   if (status != AVRC_STS_NO_ERROR) {
-    /* use the current GKI buffer to build/send the reject message */
-    p_data = (uint8_t*)(p_pkt + 1) + p_pkt->offset;
+    p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE);
+    p_rsp->offset = p_pkt->offset;
+    p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset;
     *p_data++ = AVRC_RSP_REJ;
     p_data += AVRC_VENDOR_HDR_SIZE; /* pdu */
     *p_data++ = 0;                  /* pkt_type */
     UINT16_TO_BE_STREAM(p_data, 1); /* len */
     *p_data++ = status;             /* error code */
-    p_pkt->len = AVRC_VENDOR_HDR_SIZE + 5;
-    p_rsp = p_pkt;
+    p_rsp->len = AVRC_VENDOR_HDR_SIZE + 5;
   }
 
   return p_rsp;
@@ -572,6 +572,7 @@
     p_rsp = avrc_proc_vendor_command(handle, label, *pp_pkt, p_msg);
     if (p_rsp) {
       AVCT_MsgReq(handle, label, AVCT_RSP, p_rsp);
+      osi_free_and_reset((void**)pp_pkt);
       drop_code = 3;
     } else if (p_msg->hdr.opcode == AVRC_OP_DROP) {
       drop_code = 1;