Fix potential use after free in H264 packetizer.

webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc

Index: webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
diff --git a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
index 99f5d6ca5413598901b7423137c354084c1850b1..5d631b504d60283ebca19da41420783353faed28 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_format_h264.cc
@@ -293,6 +293,7 @@ void RtpPacketizerH264::NextAggregatePacket(RtpPacketToSend* rtp_packet) {
   // STAP-A NALU header.
   buffer[0] = (packet->header & (kFBit | kNriMask)) | H264::NaluType::kStapA;
   size_t index = kNalHeaderSize;
+  bool is_last_fragment = packet->last_fragment;
   while (packet->aggregated) {
     const Fragment& fragment = packet->source_fragment;
     // Add NAL unit length field.
@@ -303,11 +304,12 @@ void RtpPacketizerH264::NextAggregatePacket(RtpPacketToSend* rtp_packet) {
     index += fragment.length;
     packets_.pop();
     input_fragments_.pop_front();
-    if (packet->last_fragment)
+    if (is_last_fragment)
       break;
     packet = &packets_.front();
+    is_last_fragment = packet->last_fragment;
   }
-  RTC_CHECK(packet->last_fragment);
+  RTC_CHECK(is_last_fragment);
   rtp_packet->SetPayloadSize(index);
 }