Hello, there.

There is an out-of-bound read in GetTrackId, Ap4TfhdAtom.h:71, in the latest commit commit [1529b83](https://github.com/axiomatic-systems/Bento4/commit/1529b83f89d52958b811469fc3ac5206639a3d0f), which also affects versions ranging from v1.4.2-590 to v1.6.0-641.

## How to reproduce

Here are the detailed reproduction steps using docker.

```bash
docker pull ubuntu:20.04 && docker run -it ubuntu:20.04 bash
## now step into the container
apt update && apt install wget git unzip gcc g++ cmake make libgc-dev -y
git clone https://github.com/axiomatic-systems/Bento4.git && pushd Bento4
## build binary mp4decrypt
export CC="gcc" 
export CXX="g++"
export CFLAGS="-fsanitize=address -g"
export CXXFLAGS="-fsanitize=address -g"
cmake . && make -j
## obtain poc
wget https://github.com/axiomatic-systems/Bento4/files/13471223/mp4decrypt_poc1.zip
unzip mp4decrypt_poc1.zip
## reproducing command
./mp4decrypt mp4decrypt_poc1 /dev/null
```

## Platform

- OS : ubuntu 20.04 (docker)
- gcc version 9.4.0 (default)

## ASAN

Here is the reproduction trace reported by ASAN:

```bash
root@d3932adedebb:/Bento4# ./mp4decrypt ./mp4decrypt_poc1  /dev/null
AddressSanitizer:DEADLYSIGNAL
=================================================================
==31100==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x563bbd4e09bd bp 0x7ffe9337ff10 sp 0x7ffe9337ff00 T0)
==31100==The signal is caused by a READ memory access.
==31100==Hint: address points to the zero page.
    #0 0x563bbd4e09bc in AP4_TfhdAtom::GetTrackId() /Bento4/Source/C++/Core/Ap4TfhdAtom.h:71
    #1 0x563bbd535eab in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&) /Bento4/Source/C++/Core/Ap4Processor.cpp:192
    #2 0x563bbd53a874 in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) /Bento4/Source/C++/Core/Ap4Processor.cpp:721
    #3 0x563bbd53b32e in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_Processor::ProgressListener*, AP4_AtomFactory&) /Bento4/Source/C++/Core/Ap4Processor.cpp:771
    #4 0x563bbd4b3c3e in main /Bento4/Source/C++/Apps/Mp4Decrypt/Mp4Decrypt.cpp:258
    #5 0x7fbc890ec082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #6 0x563bbd4b286d in _start (/Bento4/mp4decrypt+0x31286d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /Bento4/Source/C++/Core/Ap4TfhdAtom.h:71 in AP4_TfhdAtom::GetTrackId()
==31100==ABORTING
```

## Affected Version

v1.4.2-590-v1.6.0-641

## PoC

The PoC is available at [mp4decrypt_poc1.zip](https://github.com/axiomatic-systems/Bento4/files/13471223/mp4decrypt_poc1.zip)
Thanks for your time!




[BUG] OOB Read Bug in mp4decrypt, GetTrackId, Ap4TfhdAtom.h:71
This is a GitHub Issue
repo:Bento4
owner:axiomatic-systems
Title : [BUG] OOB Read Bug in mp4decrypt, GetTrackId, Ap4TfhdAtom.h:71
Issue date:

--- start body ---
Hello, there.

There is an out-of-bound read in GetTrackId, Ap4TfhdAtom.h:71, in the latest commit commit [1529b83](https://github.com/axiomatic-systems/Bento4/commit/1529b83f89d52958b811469fc3ac5206639a3d0f), which also affects versions ranging from v1.4.2-590 to v1.6.0-641.

## How to reproduce

Here are the detailed reproduction steps using docker.

```bash
docker pull ubuntu:20.04 && docker run -it ubuntu:20.04 bash
## now step into the container
apt update && apt install wget git unzip gcc g++ cmake make libgc-dev -y
git clone https://github.com/axiomatic-systems/Bento4.git && pushd Bento4
## build binary mp4decrypt
export CC="gcc" 
export CXX="g++"
export CFLAGS="-fsanitize=address -g"
export CXXFLAGS="-fsanitize=address -g"
cmake . && make -j
## obtain poc
wget https://github.com/axiomatic-systems/Bento4/files/13471223/mp4decrypt_poc1.zip
unzip mp4decrypt_poc1.zip
## reproducing command
./mp4decrypt mp4decrypt_poc1 /dev/null
```

## Platform

- OS : ubuntu 20.04 (docker)
- gcc version 9.4.0 (default)

## ASAN

Here is the reproduction trace reported by ASAN:

```bash
root@d3932adedebb:/Bento4# ./mp4decrypt ./mp4decrypt_poc1  /dev/null
AddressSanitizer:DEADLYSIGNAL
=================================================================
==31100==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000028 (pc 0x563bbd4e09bd bp 0x7ffe9337ff10 sp 0x7ffe9337ff00 T0)
==31100==The signal is caused by a READ memory access.
==31100==Hint: address points to the zero page.
    #0 0x563bbd4e09bc in AP4_TfhdAtom::GetTrackId() /Bento4/Source/C++/Core/Ap4TfhdAtom.h:71
    #1 0x563bbd535eab in AP4_Processor::ProcessFragments(AP4_MoovAtom*, AP4_List<AP4_AtomLocator>&, AP4_ContainerAtom*, AP4_SidxAtom*, unsigned long long, AP4_ByteStream&, AP4_ByteStream&) /Bento4/Source/C++/Core/Ap4Processor.cpp:192
    #2 0x563bbd53a874 in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_ByteStream*, AP4_Processor::ProgressListener*, AP4_AtomFactory&) /Bento4/Source/C++/Core/Ap4Processor.cpp:721
    #3 0x563bbd53b32e in AP4_Processor::Process(AP4_ByteStream&, AP4_ByteStream&, AP4_Processor::ProgressListener*, AP4_AtomFactory&) /Bento4/Source/C++/Core/Ap4Processor.cpp:771
    #4 0x563bbd4b3c3e in main /Bento4/Source/C++/Apps/Mp4Decrypt/Mp4Decrypt.cpp:258
    #5 0x7fbc890ec082 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x24082)
    #6 0x563bbd4b286d in _start (/Bento4/mp4decrypt+0x31286d)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /Bento4/Source/C++/Core/Ap4TfhdAtom.h:71 in AP4_TfhdAtom::GetTrackId()
==31100==ABORTING
```

## Affected Version

v1.4.2-590-v1.6.0-641

## PoC

The PoC is available at [mp4decrypt_poc1.zip](https://github.com/axiomatic-systems/Bento4/files/13471223/mp4decrypt_poc1.zip)
Thanks for your time!




--- end body ---
