Camera: Address an issue that the invalid memory is accessed

If the ImagePlanes is initiailized the HardwareBuffer and is close()'ed
by finalizer then the invalid memory access to the GraphicBufferWrapper
and GraphicBuffer could be happen.

This patch addressed the issue by properly clearing fields after
being destoyed.

Bug: 283038375
Test: Test extensions proxy service with advanced extender
implementation while maintaining a reference counter so that the
ExtensionImage is finalized without invoking close.

Change-Id: Iab49da708daf0099d029cda6873cb2e811377fbc

1 files changed, 3 insertions, 2 deletions

diff --git a/graphics/java/android/graphics/GraphicBuffer.java b/graphics/java/android/graphics/GraphicBuffer.java
index f9113a21405c..6705b25ab0ec 100644
--- a/graphics/java/android/graphics/GraphicBuffer.java
+++ b/graphics/java/android/graphics/GraphicBuffer.java
@@ -57,7 +57,7 @@ public class GraphicBuffer implements Parcelable {
     private final int mUsage;
     // Note: do not rename, this field is used by native code
     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
-    private final long mNativeObject;
+    private long mNativeObject;
 
     // These two fields are only used by lock/unlockCanvas()
     private Canvas mCanvas;
@@ -219,6 +219,7 @@ public class GraphicBuffer implements Parcelable {
         if (!mDestroyed) {
             mDestroyed = true;
             nDestroyGraphicBuffer(mNativeObject);
+            mNativeObject = 0;
         }
     }
 
@@ -239,7 +240,7 @@ public class GraphicBuffer implements Parcelable {
     @Override
     protected void finalize() throws Throwable {
         try {
-            if (!mDestroyed) nDestroyGraphicBuffer(mNativeObject);
+            destroy();
         } finally {
             super.finalize();
         }