media: Fix conf_win parameter checking

Obviously the wrong variable name was used here, fix it. Fuzzer caught
this.

BUG=chromium:1157168
TEST=Fuzzer test passes now

Change-Id: I55a33b1ec1ddaf5f7f30e27608b87b57ddcb062c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2582507
Auto-Submit: Jeffrey Kardatzke <jkardatzke@google.com>
Commit-Queue: Dale Curtis <dalecurtis@chromium.org>
Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#835333}

media/video/h265_parser.cc

@@ -548,8 +548,8 @@ H265Parser::Result H265Parser::ParseSPS(int* sps_id) {
     TRUE_OR_RETURN(width_crop.ValueOrDefault(0) <
                    sps->pic_width_in_luma_samples);
     base::CheckedNumeric<int> height_crop = sps->conf_win_top_offset;
-    width_crop += sps->conf_win_bottom_offset;
-    width_crop *= sps->sub_height_c;
+    height_crop += sps->conf_win_bottom_offset;
+    height_crop *= sps->sub_height_c;
     if (!height_crop.IsValid())
       return kInvalidStream;
     TRUE_OR_RETURN(height_crop.ValueOrDefault(0) <