AVRCP: Fix crash when registering unsupported notification

Reject command if notification is not supported otherwise this can
cause crashes.
AVCTP: Fix coding style

Fix unnecessary extra tabs
AVCTP: Call callback in case the request timeout

If the request timeout deliver a empty PDU to the callback so it
can take proper action.
AVRCP: Fix crash while listing available settings in TG role

Invalid read of size 1
   at 0x41AFD0: attrval_to_val (avrcp.c:492)
   by 0x41B0E1: avrcp_handle_list_player_attributes (avrcp.c:931)
   by 0x41D606: handle_vendordep_pdu (avrcp.c:1620)
   by 0x4185F8: session_cb (avctp.c:985)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40A2E5: main (main.c:595)
 Address 0x0 is not stack'd, malloc'd or (recently) free'd
AVRCP: Add additional protocol discriptor list for Browsing channel

This is documented in the spec and is checked by PTS when testing the
browsing channel.
AVRCP: Fix crash when current addressed player is removed

In some stacks e.g. iOS the addressed player is removed before a new
player is set which leaves the session poiting to invalid player.
AVRCP: Fix crash if player status is NULL

Assume status is 'stopped' in case the status is NULL.
AVRCP: Fix setting reserved bit in GetCapabilities response

EventID 0x00 is reserved:

< ACL data: handle 12 flags 0x00 dlen 25
    L2CAP(d): cid 0x0541 len 21 [psm 23]
      AVCTP Control: Response : pt 0x00 transaction 2 pid 0x110e
        AV/C: Stable: address 0x48 opcode 0x00
          Subunit: Panel
          Opcode: Vendor Dependent
          Company ID: 0x001958
          AVRCP: GetCapabilities: pt Single len 0x0008
            CapabilityID: 0x03 (EventsID)
            CapabilityCount: 0x06
            EventsID: 0x00 (Reserved)
            EventsID: 0x01 (EVENT_PLAYBACK_STATUS_CHANGED)
            EventsID: 0x02 (EVENT_TRACK_CHANGED)
            EventsID: 0x03 (EVENT_TRACK_REACHED_END)
            EventsID: 0x04 (EVENT_TRACK_REACHED_START)
            EventsID: 0x08 (EVENT_PLAYER_APPLICATION_SETTING_CHANGED)
AVRCP: Fix crash when connecting role without a record

Invalid read of size 4
   at 0x469310: btd_service_connecting_complete (service.c:315)
   by 0x41B29F: session_ct_init_control (avrcp.c:3208)
   by 0x41AD70: state_changed (avrcp.c:3356)
   by 0x417B84: avctp_set_state (avctp.c:550)
   by 0x419E04: avctp_connect_cb (avctp.c:1222)
   by 0x450869: accept_cb (btio.c:202)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40A335: main (main.c:595)
 Address 0x20 is not stack'd, malloc'd or (recently) free'd
AVRCP: Fix crash while setting player volume

Invalid read of size 8
   at 0x41A4EA: avrcp_handle_set_volume (avrcp.c:3619)
   by 0x418598: session_cb (avctp.c:790)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40A335: main (main.c:595)
 Address 0x48 is not stack'd, malloc'd or (recently) free'd
core: Fix not been able to cancel Device.Connect with Device.Disconnect

Device.Disconnect should be able to interrupt the connection attempt
started by Device.Connect.
AVRCP: Fix sending invalid attributes when responding to GetElementAttributes

The list returned by media.c contains the attributes in string format not
the binary format which cause us to send wrong/reserved attributes as can
be observed bellow:

> ACL data: handle 12 flags 0x02 dlen 58
    L2CAP(d): cid 0x0041 len 54 [psm 23]
      AVCTP Control: Response : pt 0x00 transaction 14 pid 0x110e
        AV/C: Stable: address 0x48 opcode 0x00
          Subunit: Panel
          Opcode: Vendor Dependent
          Company ID: 0x001958
          AVRCP: GetElementAttributes: pt Single len 0x0029
            AttributeCount: 0x05
            Attribute: 0x00df9490 (Reserved)
            CharsetID: 0x006a (UTF-8)
            AttributeValueLength: 0x0000
            AttributeValue:
            Attribute: 0x00e0e880 (Reserved)
            CharsetID: 0x006a (UTF-8)
            AttributeValueLength: 0x0000
            AttributeValue:
            Attribute: 0x00e07b00 (Reserved)
            CharsetID: 0x006a (UTF-8)
            AttributeValueLength: 0x0000
            AttributeValue:
            Attribute: 0x00e16bc0 (Reserved)
            CharsetID: 0x006a (UTF-8)
            AttributeValueLength: 0x0000
            AttributeValue:
            Attribute: 0x00e07bc0 (Reserved)
            CharsetID: 0x006a (UTF-8)
            AttributeValueLength: 0x0000
            AttributeValue:
AVRCP: Allways fallback to GetElementAttributes if GetItemAttributes fails

Although GetItemAttributes is mandatory when browsing is supported this
depend on the actual browsed player which may still not support it.
AVRCP: Fix sending SetPlayerApplicationSettingValue using notify command type

The command type for SetPlayerApplicationSettingValue is control
obexd: Fix crash when resetting OPP session without a transfer

Invalid read of size 8
   at 0x42A570: manager_emit_transfer_completed (manager.c:863)
   by 0x42A76A: os_reset_session (obex.c:206)
   by 0x42A8BB: disconn_func (obex.c:1085)
   by 0x419C55: incoming_data (gobex.c:1224)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40DDB2: main (main.c:319)
 Address 0x10 is not stack'd, malloc'd or (recently) free'd

Invalid read of size 1
   at 0x42A231: manager_unregister_transfer (manager.c:672)
   by 0x420F8B: opp_disconnect (opp.c:158)
   by 0x42A8EC: disconn_func (obex.c:1088)
   by 0x419C55: incoming_data (gobex.c:1224)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40DDB2: main (main.c:319)
 Address 0x0 is not stack'd, malloc'd or (recently) free'd
obexd: Fix not checking for valid fd on NewConnection

The fd needs to be checked as it may not be valid which cause the
following warnings:

==8162== Warning: invalid file descriptor 1031 in syscall fcntl(DUPFD_CLOEXEC)()

(obexd:8162): GLib-WARNING **: giounix.c:412Error while getting flags for FD: Bad file descriptor (9)
audio: Fix memory leak while creating SDP records

Fix these leaks:

==674== 8 bytes in 1 blocks are definitely lost in loss record 45 of 201
==674==    at 0x402BE68: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==674==    by 0x80DF653: sdp_list_append (sdp.c:1742)
==674==    by 0x8063974: avrcp_ct_record (avrcp.c:297)
==674==    by 0x8068A6D: avrcp_remote_register (avrcp.c:3149)
==674==    by 0x805F31C: avrcp_remote_server_probe (manager.c:320)
==674==    by 0x80BCB4E: probe_profile (adapter.c:2629)
==674==    by 0x80C5880: btd_profile_foreach (profile.c:639)
==674==    by 0x80C3FD4: adapter_register (adapter.c:5619)
==674==    by 0x80C4A01: read_info_complete (adapter.c:5894)
==674==    by 0x80D489A: request_complete (mgmt.c:221)
==674==    by 0x80D4BA8: received_data (mgmt.c:319)
==674==    by 0x40BF17D: ??? (in
/lib/i386-linux-gnu/libglib-2.0.so.0.3200.3)
==674==
==674== 32 bytes in 1 blocks are definitely lost in loss record 127 of
201
==674==    at 0x402BE68: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==674==    by 0x80DCE49: sdp_data_alloc_with_length (sdp.c:360)
==674==    by 0x80DD33F: sdp_data_alloc (sdp.c:497)
==674==    by 0x806379D: avrcp_ct_record (avrcp.c:272)
==674==    by 0x8068A6D: avrcp_remote_register (avrcp.c:3149)
==674==    by 0x805F31C: avrcp_remote_server_probe (manager.c:320)
==674==    by 0x80BCB4E: probe_profile (adapter.c:2629)
==674==    by 0x80C5880: btd_profile_foreach (profile.c:639)
==674==    by 0x80C3FD4: adapter_register (adapter.c:5619)
==674==    by 0x80C4A01: read_info_complete (adapter.c:5894)
==674==    by 0x80D489A: request_complete (mgmt.c:221)
==674==    by 0x80D4BA8: received_data (mgmt.c:319)
tools/bluetooth-player: Fix crash when using search command

Invalid read of size 8
   at 0x3F34619C4A: dbus_message_iter_append_basic (in /usr/lib64/libdbus-1.so.3.7.2)
   by 0x40B764: search_setup (bluetooth-player.c:893)
   by 0x4094FC: g_dbus_proxy_method_call (client.c:742)
   by 0x40C2A4: cmd_search (bluetooth-player.c:941)
   by 0x40B307: rl_handler (bluetooth-player.c:1099)
   by 0x3733E2AFDA: rl_callback_read_char (in /usr/lib64/libreadline.so.6.2)
   by 0x40BC0D: input_handler (bluetooth-player.c:1216)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40445F: main (bluetooth-player.c:1434)
 Address 0x4d4beb0 is 0 bytes inside a block of size 4 alloc'd
   at 0x4A0887C: malloc (vg_replace_malloc.c:270)
   by 0x3F31A4D68E: g_malloc (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A63F0B: g_strdup (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40C281: cmd_search (bluetooth-player.c:939)
   by 0x40B307: rl_handler (bluetooth-player.c:1099)
   by 0x3733E2AFDA: rl_callback_read_char (in /usr/lib64/libreadline.so.6.2)
   by 0x40BC0D: input_handler (bluetooth-player.c:1216)
   by 0x3F31A47A54: g_main_context_dispatch (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A47D87: ??? (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x3F31A48181: g_main_loop_run (in /usr/lib64/libglib-2.0.so.0.3400.2)
   by 0x40445F: main (bluetooth-player.c:1434)
emulator: Fix typo in supported command comment
core: Only page device once per connect attempt

In case of EHOSTDOWN/page timeout the code should not proceed with the
next profile as it is very likely it will fail again, moreover the page
timeout is configurable and should be enough for getting a response from
the remote device in a reasonable time.