Camera: Address an issue that the invalid memory is accessed

If the ImagePlanes is initiailized the HardwareBuffer and is close()'ed
by finalizer then the invalid memory access to the GraphicBufferWrapper
and GraphicBuffer could be happen.

This patch addressed the issue by properly clearing fields after
being destoyed.

Bug: 283038375
Test: Test extensions proxy service with advanced extender
implementation while maintaining a reference counter so that the
ExtensionImage is finalized without invoking close.

Change-Id: Iab49da708daf0099d029cda6873cb2e811377fbc

graphics/java/android/graphics/GraphicBuffer.java

@@ -57,7 +57,7 @@ public class GraphicBuffer implements Parcelable {
     private final int mUsage;
     // Note: do not rename, this field is used by native code
     @UnsupportedAppUsage(maxTargetSdk = Build.VERSION_CODES.R, trackingBug = 170729553)
-    private final long mNativeObject;
+    private long mNativeObject;
 
     // These two fields are only used by lock/unlockCanvas()
     private Canvas mCanvas;
@@ -219,6 +219,7 @@ public class GraphicBuffer implements Parcelable {
         if (!mDestroyed) {
             mDestroyed = true;
             nDestroyGraphicBuffer(mNativeObject);
+            mNativeObject = 0;
         }
     }
 
@@ -239,7 +240,7 @@ public class GraphicBuffer implements Parcelable {
     @Override
     protected void finalize() throws Throwable {
         try {
-            if (!mDestroyed) nDestroyGraphicBuffer(mNativeObject);
+            destroy();
         } finally {
             super.finalize();
         }

media/jni/android_media_ImageReader.cpp

@@ -768,6 +768,7 @@ static void ImageReader_unlockGraphicBuffer(JNIEnv* env, jobject /*thiz*/,
             android_graphics_GraphicBuffer_getNativeGraphicsBuffer(env, buffer);
     if (graphicBuffer.get() == NULL) {
         jniThrowRuntimeException(env, "Invalid graphic buffer!");
+        return;
     }
 
     status_t res = graphicBuffer->unlock();

packages/services/CameraExtensionsProxy/src/com/android/cameraextensions/CameraExtensionsProxyService.java

@@ -2057,7 +2057,11 @@ public class CameraExtensionsProxyService extends Service {
             mIsImageValid = false;
 
             if (mGraphicBuffer != null) {
-                ImageReader.unlockGraphicBuffer(mGraphicBuffer);
+                try {
+                    ImageReader.unlockGraphicBuffer(mGraphicBuffer);
+                } catch (RuntimeException e) {
+                    e.printStackTrace();
+                }
                 mGraphicBuffer.destroy();
                 mGraphicBuffer = null;
             }