Created attachment 247230 [details] [review]
Patch

As explain in the title, it seems the size field and the condition to leave the for loop in _get_merged_memory of gstbuffer.c are wrong.
I noticed this with a custom element which was parsing the RTP buffers after rtph264pay element. rtph264pay or another element before might store the payload in more than one blocksize and when retrieving the payload in my element with gst_rtp_buffer_get_payload(), it merges internally the memory blocks containing the payload if necessary.
When the payload was stored in more than one block size, it was leading to get a buffer bigger of RTP header length size than before and messing up my data inside.
In the patch provided in attachment, I applied the following changes:

 - Set the size of the buffer containing the merged memory of the size of the memory blocks to be merged (and not the size of the full buffer)

 - Change the condition to leave the for loop from (i < length) to (i < idx+length) to handle cases where i > 0.