When Ulpfec recovers a packet, set |returned| flag earlier.

webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc

Index: webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc
diff --git a/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc b/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc
index b4ac30e040e0ab3c2ae9e7596a31f2aaf1bd8138..f3b08310c6597eb464985ad9bb0ae16eabece6f9 100644
--- a/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc
+++ b/webrtc/modules/rtp_rtcp/source/ulpfec_receiver_impl.cc
@@ -241,11 +241,13 @@ int32_t UlpfecReceiverImpl::ProcessReceivedFec() {
     }
     ForwardErrorCorrection::Packet* packet = recovered_packet->pkt;
     ++packet_counter_.num_recovered_packets;
+    // Set this flag first; in case the recovered packet carries a RED
+    // header, OnRecoveredPacket will recurse back here.
+    recovered_packet->returned = true;
     crit_sect_.Leave();
     recovered_packet_callback_->OnRecoveredPacket(packet->data,
                                                   packet->length);
     crit_sect_.Enter();
-    recovered_packet->returned = true;
   }
   crit_sect_.Leave();
   return 0;