Fix potential use after free in H264 packetizer.

webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc

 /*
  *  Copyright (c) 2014 The WebRTC project authors. All Rights Reserved.
  *
  *  Use of this source code is governed by a BSD-style license
  *  that can be found in the LICENSE file in the root of the source
  *  tree. An additional intellectual property rights grant can be found
  *  in the file PATENTS.  All contributing project authors may
  *  be found in the AUTHORS file in the root of the source tree.
  */
 
@@ skipping 275 matching lines @@
 }
 
 void RtpPacketizerH264::NextAggregatePacket(RtpPacketToSend* rtp_packet) {
   uint8_t* buffer = rtp_packet->AllocatePayload(max_payload_len_);
   RTC_DCHECK(buffer);
   PacketUnit* packet = &packets_.front();
   RTC_CHECK(packet->first_fragment);
   // STAP-A NALU header.
   buffer[0] = (packet->header & (kFBit | kNriMask)) | H264::NaluType::kStapA;
   size_t index = kNalHeaderSize;
+  bool is_last_fragment = packet->last_fragment;
   while (packet->aggregated) {
     const Fragment& fragment = packet->source_fragment;
     // Add NAL unit length field.
     ByteWriter<uint16_t>::WriteBigEndian(&buffer[index], fragment.length);
     index += kLengthFieldSize;
     // Add NAL unit.
     memcpy(&buffer[index], fragment.buffer, fragment.length);
     index += fragment.length;
     packets_.pop();
     input_fragments_.pop_front();
-    if (packet->last_fragment)
+    if (is_last_fragment)
       break;
     packet = &packets_.front();
+    is_last_fragment = packet->last_fragment;
   }
-  RTC_CHECK(packet->last_fragment);
+  RTC_CHECK(is_last_fragment);
   rtp_packet->SetPayloadSize(index);
 }
 
 void RtpPacketizerH264::NextFragmentPacket(RtpPacketToSend* rtp_packet) {
   PacketUnit* packet = &packets_.front();
   // NAL unit fragmented over multiple packets (FU-A).
   // We do not send original NALU header, so it will be replaced by the
   // FU indicator header of the first packet.
   uint8_t fu_indicator =
       (packet->header & (kFBit | kNriMask)) | H264::NaluType::kFuA;
@@ skipping 298 matching lines @@
   h264->packetization_type = kH264FuA;
   h264->nalu_type = original_nal_type;
   if (first_fragment) {
     h264->nalus[h264->nalus_length] = nalu;
     h264->nalus_length = 1;
   }
   return true;
 }
 
 }  // namespace webrtc