From 91ff19af886a22921c75146a765f98c54a1ddb43 Mon Sep 17 00:00:00 2001
From: Rudolfs Bundulis <rudolfs.bundulis@gmail.com>
Date: Fri, 5 Feb 2016 15:45:14 +1100
Subject: [PATCH] Bug 1235427: [mp4] Properly parse tfhd box. r=jya

---
 media/libstagefright/binding/MoofParser.cpp | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/media/libstagefright/binding/MoofParser.cpp b/media/libstagefright/binding/MoofParser.cpp
index 080d0df088d..e2749877893 100644
--- a/media/libstagefright/binding/MoofParser.cpp
+++ b/media/libstagefright/binding/MoofParser.cpp
@@ -693,9 +693,10 @@ Tfhd::Tfhd(Box& aBox, Trex& aTrex)
   mFlags = reader->ReadU32();
   size_t need = sizeof(uint32_t) /* trackid */;
   uint8_t flag[] = { 1, 2, 8, 0x10, 0x20, 0 };
+  uint8_t flagSize[] = { sizeof(uint64_t), sizeof(uint32_t), sizeof(uint32_t), sizeof(uint32_t), sizeof(uint32_t) };
   for (size_t i = 0; flag[i]; i++) {
     if (mFlags & flag[i]) {
-      need += sizeof(uint32_t);
+      need += flagSize[i];
     }
   }
   if (reader->Remaining() < need) {
@@ -703,9 +704,9 @@ Tfhd::Tfhd(Box& aBox, Trex& aTrex)
         (uint64_t)reader->Remaining(), (uint64_t)need);
     return;
   }
-  mBaseDataOffset =
-    mFlags & 1 ? reader->ReadU32() : aBox.Parent()->Parent()->Offset();
   mTrackId = reader->ReadU32();
+  mBaseDataOffset =
+    mFlags & 1 ? reader->ReadU64() : aBox.Parent()->Parent()->Offset();
   if (mFlags & 2) {
     mDefaultSampleDescriptionIndex = reader->ReadU32();
   }