Integer overflow in QByteArray::remove leads to crash

Documentation of QByteArray::remove: "If pos is valid, but pos + len is larger than the size of the array, the array is truncated at position pos."

Code in QByteArray.cpp:1820

if (pos + len >= d->size) ...

Leads to an integer overflow if pos + len > INT_MAX, my usecase was: text.remove (2, INT_MAX).

Fix:

if (len >= d->size - pos) ...

pos is not greater than d->size (checked some lines before).