Fix bug where rtcp::TransportFeedback may generate incorrect messages.

webrtc/modules/rtp_rtcp/source/rtcp_packet/transport_feedback.cc

 /*
  *  Copyright (c) 2015 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 429 matching lines @@
       if (first_symbol_cardinality_ <= capacity) {
         symbol_vec_.push_back(symbol);
       } else if (first_symbol_cardinality_ == kRunLengthCapacity) {
         // Max length for an RLE-chunk reached.
         EmitRunLengthChunk();
       }
       size_bytes_ += delta_size;
       return true;
     } else {
       // New symbol does not match what's already in symbol_vec.
-      if (first_symbol_cardinality_ > capacity) {
+      if (first_symbol_cardinality_ >= capacity) {
         // Symbols in symbol_vec can only be RLE-encoded. Emit the RLE-chunk
         // and re-add input. symbol_vec is then guaranteed to have room for the
         // symbol, so recursion cannot continue.
         EmitRunLengthChunk();
         return Encode(symbol);
       }
       // Fall through and treat state as non RLE-candidate.
     }
   }
 
@@ skipping 306 matching lines @@
                        "RLE block of size " << rle_chunk->NumSymbols()
                     << " but only " << max_size << " left to read.";
     delete rle_chunk;
     return nullptr;
   }
   return rle_chunk;
 }
 
 }  // namespace rtcp
 }  // namespace webrtc