Fix the processing of AVRCP Rcvd Pass Through messages
The assignment and handling of the optional tAVRC_MSG_PASS.p_pass_data
data buffer pointer was inconsistent:
- For originating AVRCP packets, it was assigned to osi_getbuf()
allocated memory.
- For received AVRCP packets, it was a pointer in the middle of the
received data buffer.
However, in the common function avrc_pass_msg(), the p_pass_data pointer
was deallocated by osi_freebuf(). This triggered an assert when processing
AVRCP Rcvd Pass Through messages with non-zero Data Length field.
Bug:
26865159
Change-Id: I1b2eb6713636c290caca16e77226c114d99dcb8e