From eab2a2312c5a9c925c463905fdeb1dc74b97f1e3 Mon Sep 17 00:00:00 2001
From: chaviw <chaviw@google.com>
Date: Thu, 19 May 2022 17:47:20 -0500
Subject: [PATCH] Check for null buffer when calling Transaction#setBuffer

android_hardware_HardwareBuffer_getNativeHardwareBuffer will crash when
trying to convert a null object to a GraphicBuffer. Instead, just set
the GraphicBuffer to null and call into SCC with a null buffer. This
will result in the previous buffer getting released

Test: SurfaceControlTest
Fixes: 233252754
Change-Id: Idc9f5ca3d747dbc890d7cafb9512c51ca9e711c9
---
 core/jni/android_view_SurfaceControl.cpp | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/core/jni/android_view_SurfaceControl.cpp b/core/jni/android_view_SurfaceControl.cpp
index 4044c579a57fd..f388fec2cd783 100644
--- a/core/jni/android_view_SurfaceControl.cpp
+++ b/core/jni/android_view_SurfaceControl.cpp
@@ -688,8 +688,11 @@ static void nativeSetBuffer(JNIEnv* env, jclass clazz, jlong transactionObj, jlo
                             jobject bufferObject, jlong fencePtr, jobject releaseCallback) {
     auto transaction = reinterpret_cast<SurfaceComposerClient::Transaction*>(transactionObj);
     SurfaceControl* const ctrl = reinterpret_cast<SurfaceControl*>(nativeObject);
-    sp<GraphicBuffer> graphicBuffer(GraphicBuffer::fromAHardwareBuffer(
-            android_hardware_HardwareBuffer_getNativeHardwareBuffer(env, bufferObject)));
+    sp<GraphicBuffer> graphicBuffer;
+    if (bufferObject != nullptr) {
+        graphicBuffer = GraphicBuffer::fromAHardwareBuffer(
+                android_hardware_HardwareBuffer_getNativeHardwareBuffer(env, bufferObject));
+    }
     std::optional<sp<Fence>> optFence = std::nullopt;
     if (fencePtr != 0) {
         optFence = sp<Fence>{reinterpret_cast<Fence*>(fencePtr)};