Integer overflow in class QElfParser (qtbase/src/corelib/plugin/qelfparser_p.cpp)

The bug is caused by the codes in these two files: qtbase/src/corelib/plugin/qelfparser_p.h and qtbase/src/corelib/plugin/qelfparser_p.cpp.

In class QElfParser in qelfparser_p.h, it declares a struct ElfSectionHeader that contains a unsigned int variable called "offset". The class also have a int variable called "m_stringTableFileOffset".

In qelfparser_p.cpp:169, the code assigns the value of strtab.offset, an unsigned int value, to m_stringTableFileOffset, a signed int variable. Because one of the Elf file in our program is very large, it exceeds the maximum value that an int variable can hold. This line of code causes an int overflow, and the int becomes negative as the result.

Then, in qelfparser_p.cpp:191, the code use m_stringTableFileOffset to navigate a char * pointer. It makes the pointer invalid, and causes a segmentation fault.

After changing the value type of m_stringTableFileOffset to unsigned int or long long int in Qt library, the crash is solved.