From 9bbce8603846159dec0d506ba867b7616557a303 Mon Sep 17 00:00:00 2001 From: Ajay Panicker Date: Tue, 5 Jun 2018 16:08:06 -0700 Subject: [PATCH] DO NOT MERGE: Don't reuse buffer when building response Bug: 79541338 Test: Compile and connect to remote headset Change-Id: I2d808f941d3c71fcb6306c733717624be10478e0 --- stack/avrc/avrc_api.cc | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/stack/avrc/avrc_api.cc b/stack/avrc/avrc_api.cc index 2fba78c53..07629a472 100644 --- a/stack/avrc/avrc_api.cc +++ b/stack/avrc/avrc_api.cc @@ -426,15 +426,15 @@ static BT_HDR* avrc_proc_vendor_command(uint8_t handle, uint8_t label, } if (status != AVRC_STS_NO_ERROR) { - /* use the current GKI buffer to build/send the reject message */ - p_data = (uint8_t*)(p_pkt + 1) + p_pkt->offset; + p_rsp = (BT_HDR*)osi_malloc(BT_DEFAULT_BUFFER_SIZE); + p_rsp->offset = p_pkt->offset; + p_data = (uint8_t*)(p_rsp + 1) + p_pkt->offset; *p_data++ = AVRC_RSP_REJ; p_data += AVRC_VENDOR_HDR_SIZE; /* pdu */ *p_data++ = 0; /* pkt_type */ UINT16_TO_BE_STREAM(p_data, 1); /* len */ *p_data++ = status; /* error code */ - p_pkt->len = AVRC_VENDOR_HDR_SIZE + 5; - p_rsp = p_pkt; + p_rsp->len = AVRC_VENDOR_HDR_SIZE + 5; } return p_rsp; @@ -575,6 +575,7 @@ static uint8_t avrc_proc_far_msg(uint8_t handle, uint8_t label, uint8_t cr, p_rsp = avrc_proc_vendor_command(handle, label, *pp_pkt, p_msg); if (p_rsp) { AVCT_MsgReq(handle, label, AVCT_RSP, p_rsp); + osi_free_and_reset((void**)pp_pkt); drop_code = 3; } else if (p_msg->hdr.opcode == AVRC_OP_DROP) { drop_code = 1; -- 2.11.0