Fix issue with parsing of incorrect (empty) Stap-A H264 NAL units.

webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc

 /*
  *  Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 385 matching lines @@
   }
   h264_header->nalu_type = nal_type;
   parsed_payload->frame_type = kVideoFrameDelta;
 
   nalu_start_offsets.push_back(length_ + kLengthFieldSize);  // End offset.
   for (size_t i = 0; i < nalu_start_offsets.size() - 1; ++i) {
     size_t start_offset = nalu_start_offsets[i];
     // End offset is actually start offset for next unit, excluding length field
     // so remove that from this units length.
     size_t end_offset = nalu_start_offsets[i + 1] - kLengthFieldSize;
+    if (end_offset - start_offset < H264::kNaluTypeSize) {
+      LOG(LS_ERROR) << "STAP-A packet too short";
+      return false;
+    }
+
     nal_type = payload_data[start_offset] & kTypeMask;
     start_offset += H264::kNaluTypeSize;
 
     if (nal_type == H264::NaluType::kSps) {
       // Check if VUI is present in SPS and if it needs to be modified to avoid
       // excessive decoder latency.
 
       // Copy any previous data first (likely just the first header).
       std::unique_ptr<rtc::Buffer> output_buffer(new rtc::Buffer());
       if (start_offset)
@@ skipping 101 matching lines @@
   parsed_payload->type.Video.codec = kRtpVideoH264;
   parsed_payload->type.Video.isFirstPacket = first_fragment;
   RTPVideoHeaderH264* h264_header =
       &parsed_payload->type.Video.codecHeader.H264;
   h264_header->packetization_type = kH264FuA;
   h264_header->nalu_type = original_nal_type;
   return true;
 }
 
 }  // namespace webrtc