Draft: picture: check planes count before deallocating

picture_DestroyFromFormat will try to deallocate the picture created as a shared memory buffer if it was created from picture_NewFromFormat and sys is not NULL.

However, picture_NewFromFormat will not create the planes when the format is opaque and plane count are 0, and the client of the picture is free to put anything it wants in the sys pointer of the picture.

In this case, picture_DestroyFromFormat will still try to deallocate the picture which is not correct. By checking whether there are planes in the picture, we can reliably check whether the deallocation is needed.