Prevent OOB read on truncated H264 headers.

webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc

Index: webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
index a5b42ab3e0e2c27661fe6ba16bed9ae7a7983df2..15e6df05dcd9445bc519f2baf0bc22afae9b03b2 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
@@ -84,10 +84,14 @@ void ParseSingleNalu(RtpDepacketizer::ParsedPayload* parsed_payload,
   }
 }
 
-void ParseFuaNalu(RtpDepacketizer::ParsedPayload* parsed_payload,
+bool ParseFuaNalu(RtpDepacketizer::ParsedPayload* parsed_payload,
                   const uint8_t* payload_data,
                   size_t payload_data_length,
                   size_t* offset) {
+  if (payload_data_length < kFuAHeaderSize) {
+    LOG(LS_ERROR) << "FU-A NAL units truncated.";
+    return false;
+  }
   uint8_t fnri = payload_data[0] & (kFBit | kNriMask);
   uint8_t original_nal_type = payload_data[1] & kTypeMask;
   bool first_fragment = (payload_data[1] & kSBit) > 0;
@@ -114,6 +118,7 @@ void ParseFuaNalu(RtpDepacketizer::ParsedPayload* parsed_payload,
       &parsed_payload->type.Video.codecHeader.H264;
   h264_header->packetization_type = kH264FuA;
   h264_header->nalu_type = original_nal_type;
+  return true;
 }
 }  // namespace
 
@@ -326,7 +331,10 @@ bool RtpDepacketizerH264::Parse(ParsedPayload* parsed_payload,
   size_t offset = 0;
   if (nal_type == kFuA) {
     // Fragmented NAL units (FU-A).
-    ParseFuaNalu(parsed_payload, payload_data, payload_data_length, &offset);
+    if (!ParseFuaNalu(
+            parsed_payload, payload_data, payload_data_length, &offset)) {
+      return false;
+    }
   } else {
     // We handle STAP-A and single NALU's the same way here. The jitter buffer
     // will depacketize the STAP-A into NAL units later.