Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-70560

Integer overflow in class QElfParser (qtbase/src/corelib/plugin/qelfparser_p.cpp)

    XMLWordPrintable

    Details

    • Platform/s:
      Linux/X11
    • Commits:
      9f95f25d2ef3de76d449bc4de5b09e87e9ed537a (qt/qtbase/5.9.7) cb5c24fa26142edaff8fd2c9787dbe45c222b4ff (qt/qtbase/5.11) 91c83d842c54180f98b23a1cf8878b9d7a22f1b2 (qt/qtbase/5.6)

      Description

      The bug is caused by the codes in these two files: qtbase/src/corelib/plugin/qelfparser_p.h and qtbase/src/corelib/plugin/qelfparser_p.cpp.

      In class QElfParser in qelfparser_p.h, it declares a struct ElfSectionHeader that contains a unsigned int variable called "offset". The class also have a int variable called "m_stringTableFileOffset".

      In qelfparser_p.cpp:169, the code assigns the value of strtab.offset, an unsigned int value, to m_stringTableFileOffset, a signed int variable. Because one of the Elf file in our program is very large, it exceeds the maximum value that an int variable can hold. This line of code causes an int overflow, and the int becomes negative as the result.

      Then, in qelfparser_p.cpp:191, the code use m_stringTableFileOffset to navigate a char * pointer. It makes the pointer invalid, and causes a segmentation fault.

      After changing the value type of m_stringTableFileOffset to unsigned int or long long int in Qt library, the crash is solved.

        Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

          Activity

            People

            • Assignee:
              thiago Thiago Macieira
              Reporter:
              hengxiao Heng Xiao
            • Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Gerrit Reviews

                There are no open Gerrit changes