diff --git a/media/java/android/media/tv/AdBuffer.java b/media/java/android/media/tv/AdBuffer.java
index 230d763a948d4..f2b772fff1d3e 100644
--- a/media/java/android/media/tv/AdBuffer.java
+++ b/media/java/android/media/tv/AdBuffer.java
@@ -22,6 +22,8 @@ import android.os.Parcel;
 import android.os.Parcelable;
 import android.os.SharedMemory;
 
+import java.io.IOException;
+
 /**
  * Buffer for advertisement data.
  */
@@ -57,6 +59,16 @@ public final class AdBuffer implements Parcelable {
         this.mFlags = flags;
     }
 
+    /** @hide **/
+    public static AdBuffer dupAdBuffer(AdBuffer buffer) throws IOException {
+        if (buffer == null) {
+            return null;
+        }
+        return new AdBuffer(buffer.mId, buffer.mMimeType,
+                SharedMemory.fromFileDescriptor(buffer.mBuffer.getFdDup()), buffer.mOffset,
+                buffer.mLength, buffer.mPresentationTimeUs, buffer.mFlags);
+    }
+
     /**
      * Gets corresponding AD request ID.
      *
diff --git a/media/java/android/media/tv/AdRequest.java b/media/java/android/media/tv/AdRequest.java
index d8cddfcbcb9ef..5f6b2b5edee64 100644
--- a/media/java/android/media/tv/AdRequest.java
+++ b/media/java/android/media/tv/AdRequest.java
@@ -72,6 +72,22 @@ public final class AdRequest implements Parcelable {
     private final Bundle mMetadata;
     private final Uri mUri;
 
+    /**
+     * The key for video metadata.
+     *
+     * @see #getMetadata()
+     * @hide
+     */
+    public static final String KEY_VIDEO_METADATA = "key_video_metadata";
+
+    /**
+     * The key for audio metadata.
+     *
+     * @see #getMetadata()
+     * @hide
+     */
+    public static final String KEY_AUDIO_METADATA = "key_audio_metadata";
+
     public AdRequest(int id, @RequestType int requestType,
             @Nullable ParcelFileDescriptor fileDescriptor, long startTime, long stopTime,
             long echoInterval, @Nullable String mediaFileType, @NonNull Bundle metadata) {
diff --git a/media/java/android/media/tv/TvInputManager.java b/media/java/android/media/tv/TvInputManager.java
index f344fd3e797b2..631ab9a2693de 100644
--- a/media/java/android/media/tv/TvInputManager.java
+++ b/media/java/android/media/tv/TvInputManager.java
@@ -3737,6 +3737,10 @@ public final class TvInputManager {
                 mService.notifyAdBufferReady(mToken, buffer, mUserId);
             } catch (RemoteException e) {
                 throw e.rethrowFromSystemServer();
+            } finally {
+                if (buffer != null) {
+                    buffer.getSharedMemory().close();
+                }
             }
         }
 
diff --git a/media/java/android/media/tv/interactive/TvInteractiveAppManager.java b/media/java/android/media/tv/interactive/TvInteractiveAppManager.java
index 06d1acd4567cd..7cce84a1ee16d 100755
--- a/media/java/android/media/tv/interactive/TvInteractiveAppManager.java
+++ b/media/java/android/media/tv/interactive/TvInteractiveAppManager.java
@@ -1608,6 +1608,10 @@ public final class TvInteractiveAppManager {
                 mService.notifyAdBufferConsumed(mToken, buffer, mUserId);
             } catch (RemoteException e) {
                 throw e.rethrowFromSystemServer();
+            } finally {
+                if (buffer != null) {
+                    buffer.getSharedMemory().close();
+                }
             }
         }
 
diff --git a/media/java/android/media/tv/interactive/TvInteractiveAppService.java b/media/java/android/media/tv/interactive/TvInteractiveAppService.java
index 06dfe4fffefeb..ec85cc7af4992 100755
--- a/media/java/android/media/tv/interactive/TvInteractiveAppService.java
+++ b/media/java/android/media/tv/interactive/TvInteractiveAppService.java
@@ -69,6 +69,7 @@ import android.widget.FrameLayout;
 
 import com.android.internal.os.SomeArgs;
 
+import java.io.IOException;
 import java.lang.annotation.Retention;
 import java.lang.annotation.RetentionPolicy;
 import java.util.ArrayList;
@@ -1973,9 +1974,9 @@ public abstract class TvInteractiveAppService extends Service {
                                     "notifyAdBufferReady(buffer=" + buffer + ")");
                         }
                         if (mSessionCallback != null) {
-                            mSessionCallback.onAdBufferReady(buffer);
+                            mSessionCallback.onAdBufferReady(AdBuffer.dupAdBuffer(buffer));
                         }
-                    } catch (RemoteException e) {
+                    } catch (RemoteException | IOException e) {
                         Log.w(TAG, "error in notifyAdBuffer", e);
                     }
                 }
diff --git a/services/core/java/com/android/server/tv/TvInputManagerService.java b/services/core/java/com/android/server/tv/TvInputManagerService.java
index 88c9042c963e5..1f5c1cf6a9596 100644
--- a/services/core/java/com/android/server/tv/TvInputManagerService.java
+++ b/services/core/java/com/android/server/tv/TvInputManagerService.java
@@ -2629,6 +2629,10 @@ public final class TvInputManagerService extends SystemService {
                         getSessionLocked(sessionState).notifyAdBufferReady(buffer);
                     } catch (RemoteException | SessionNotFoundException e) {
                         Slog.e(TAG, "error in notifyAdBuffer", e);
+                    } finally {
+                        if (buffer != null) {
+                            buffer.getSharedMemory().close();
+                        }
                     }
                 }
             } finally {
@@ -3891,10 +3895,13 @@ public final class TvInputManagerService extends SystemService {
                     return;
                 }
                 try {
-                    mSessionState.client.onAdBufferConsumed(
-                            buffer, mSessionState.seq);
+                    mSessionState.client.onAdBufferConsumed(buffer, mSessionState.seq);
                 } catch (RemoteException e) {
                     Slog.e(TAG, "error in onAdBufferConsumed", e);
+                } finally {
+                    if (buffer != null) {
+                        buffer.getSharedMemory().close();
+                    }
                 }
             }
         }
diff --git a/services/core/java/com/android/server/tv/interactive/TvInteractiveAppManagerService.java b/services/core/java/com/android/server/tv/interactive/TvInteractiveAppManagerService.java
index 80cb0855922ea..e6273d331fcec 100644
--- a/services/core/java/com/android/server/tv/interactive/TvInteractiveAppManagerService.java
+++ b/services/core/java/com/android/server/tv/interactive/TvInteractiveAppManagerService.java
@@ -2007,6 +2007,10 @@ public class TvInteractiveAppManagerService extends SystemService {
                         getSessionLocked(sessionState).notifyAdBufferConsumed(buffer);
                     } catch (RemoteException | SessionNotFoundException e) {
                         Slogf.e(TAG, "error in notifyAdBufferConsumed", e);
+                    } finally {
+                        if (buffer != null) {
+                            buffer.getSharedMemory().close();
+                        }
                     }
                 }
             } finally {
@@ -3063,6 +3067,10 @@ public class TvInteractiveAppManagerService extends SystemService {
                     mSessionState.mClient.onAdBufferReady(buffer, mSessionState.mSeq);
                 } catch (RemoteException e) {
                     Slogf.e(TAG, "error in onAdBuffer", e);
+                } finally {
+                    if (buffer != null) {
+                        buffer.getSharedMemory().close();
+                    }
                 }
             }
         }