[xyz.zood.george] Zood Location

Affected app
Name: Zood Location
Package id: xyz.zood.george

Describe the bug
The app lets users share their location with each other via en end-to-end encrypted channel. The problem occurs when the app calls getTag() on a com.google.android.gms.maps.model.Circle that is part of a map. A stack trace is provided:

02-06 23:29:15.605 E/AndroidRuntime(8147): FATAL EXCEPTION: main
02-06 23:29:15.605 E/AndroidRuntime(8147): Process: xyz.zood.george, PID: 8147
02-06 23:29:15.605 E/AndroidRuntime(8147): java.lang.NullPointerException: Attempt to invoke interface method 'android.os.IBinder com.google.android.gms.dynamic.IObjectWrapper.asBinder()' on a null object reference
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at com.google.android.gms.dynamic.ObjectWrapper.unwrap(com.google.android.gms:play-services-basement@@17.3.0:7)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at com.google.android.gms.maps.model.Circle.getTag(Unknown Source:78)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at xyz.zood.george.MainFragment.updateMarker(MainFragment.java:867)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at xyz.zood.george.MainFragment.onFriendLocationUpdated(MainFragment.java:1022)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at io.pijun.george.database.DB$2.run(DB.java:800)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at android.os.Handler.handleCallback(Handler.java:883)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at android.os.Handler.dispatchMessage(Handler.java:100)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at android.os.Looper.loop(Looper.java:214)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at android.app.ActivityThread.main(ActivityThread.java:7356)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at java.lang.reflect.Method.invoke(Native Method)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:491)
02-06 23:29:15.605 E/AndroidRuntime(8147): 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:925)

To Reproduce
Steps to reproduce the behavior:
Hopefully the stack trace above is sufficient, but just in case it's not, here are some user provided repro steps. :-)
The following steps are for a

• Samsung S9 fully loaded with play services, though it could be any phone with play services.
• Pixel running Calyx (also happens on an unknown device running Havoc)

1. Open Zood on Phone 1 (Samsung) and register as test123 (password is test123)
2. Open Zood on Phone 2 (Pixel) and register as test567 (password is test567)
3. In the Zood app on phone 2 (Pixel), assign an image as the avatar.
4. One phone 1 (Samsung), add friend: test567.
5. One phone 2 (Pixel), add friend test123.
6. Both phones are in the same location.
7. IMPORTANT: Do not enable sharing of location yet.
8. Open Zood on both phones. Apps are stable.
9. Tap the partner accounts on each phone (do not switch on sharing). Apps remain stable.
10. IMPORTANT: Now make sure that the Zood app is completely closed on phone 1 (Samsung).
11. Wait 10 seconds after killing zood on phone 1 (Samsung).
12. On phone 2 (Pixel), open the options in Zood and tap to change the avatar.
13. Select an image, resize to maximum you can get in square.
14. Still on phone 2 (Pixel), share your location with your partner (test123).
15. Zood remains stable.
16. Back on Phone 1 (Samsung), open zood and confirm it is not sharing it's location with test567 yet.
17. On phone 1 (Samsung), tap the profile picture of the partner (test567) and share your location.
18. The zood app will instantly crash on phone 2 (Pixel).

Expected behavior
The app should not crash

System
Android Version: 10
Custom ROM: Havoc 3.11

microG
microG Core version: 0.2.11.202414
microG Self-Check results: All checked/passed.

Additional context
I'm the developer of the app in question, so please feel free to reach out if you have any questions.

Start at MainFragment.java:867, where updateMarker calls Circle.getTag(), and follow the stack trace through onFriendLocationUpdated. Reproduce the two-device location-sharing sequence on Android 10 with the reported Play Services or microG setup, then verify that sharing a location no longer crashes the app.