Prevent size_t underflow in H264 SPS parsing.

BUG=webrtc:4771
R=stefan@webrtc.org

Review URL: https://codereview.webrtc.org/1219493004

Cr-Commit-Position: refs/heads/master@{#9523}
diff --git a/webrtc/modules/rtp_rtcp/source/h264_sps_parser.cc b/webrtc/modules/rtp_rtcp/source/h264_sps_parser.cc
index b022b21..034e761 100644
--- a/webrtc/modules/rtp_rtcp/source/h264_sps_parser.cc
+++ b/webrtc/modules/rtp_rtcp/source/h264_sps_parser.cc
@@ -36,8 +36,8 @@
   // section 7.3.1 of the H.264 standard.
   rtc::ByteBuffer rbsp_buffer;
   for (size_t i = 0; i < byte_length_;) {
-    if (i < byte_length_ - 3 &&
-        sps_[i] == 0 && sps_[i + 1] == 0 && sps_[i + 2] == 3) {
+    if (i + 3 < byte_length_ && sps_[i] == 0 && sps_[i + 1] == 0 &&
+        sps_[i + 2] == 3) {
       // Two rbsp bytes + the emulation byte.
       rbsp_buffer.WriteBytes(sps_bytes + i, 2);
       i += 3;
diff --git a/webrtc/modules/rtp_rtcp/source/rtp_format_h264_unittest.cc b/webrtc/modules/rtp_rtcp/source/rtp_format_h264_unittest.cc
index 7bf1cf1..3ad5686 100644
--- a/webrtc/modules/rtp_rtcp/source/rtp_format_h264_unittest.cc
+++ b/webrtc/modules/rtp_rtcp/source/rtp_format_h264_unittest.cc
@@ -563,4 +563,10 @@
   EXPECT_FALSE(depacketizer_->Parse(&payload, kPayload, sizeof(kPayload)));
 }
 
+TEST_F(RtpDepacketizerH264Test, TestShortSpsPacket) {
+  const uint8_t kPayload[] = {0x27, 0x80, 0x00};
+  RtpDepacketizer::ParsedPayload payload;
+  EXPECT_TRUE(depacketizer_->Parse(&payload, kPayload, sizeof(kPayload)));
+}
+
 }  // namespace webrtc