[utilities/krusader] app/BookMan: BookMan: Fix use-after-free problems during bookmark context menu execution

Git commit 9d471190277f024cac72784a99bdb5351d359e24 by Toni Asensi Esteve.
Committed on 16/08/2026 at 22:14.
Pushed by asensi into branch 'master'.

BookMan: Fix use-after-free problems during bookmark context menu execution

The `KrBookmarkHandler::rightClicked` function must not dereference a
dangling pointer after a context menu interaction.

Because `popup.exec()` initiates a nested event loop, background events
(e.g. the XML file watcher triggering an asynchronous bookmark
reload and deletion) can be executed while the function is blocked
waiting for user input. If the underlying bookmark was deleted during
this time, returning from the popup and attempting to access `bm->url()`
resulted in a use-after-free abrupt termination.

By "capturing" the bookmark in a `QPointer` before executing the popup,
the function can now verify the object's existence before attempting to
open it, delete it, etc.

Revision: https://invent.kde.org/utilities/krusader/-/merge_requests/193

M  +11   -3    app/BookMan/krbookmarkhandler.cpp

https://invent.kde.org/utilities/krusader/-/commit/9d471190277f024cac72784a99bdb5351d359e24

diff --git a/app/BookMan/krbookmarkhandler.cpp b/app/BookMan/krbookmarkhandler.cpp
index 7a435bdb7..e4f652d75 100644
--- a/app/BookMan/krbookmarkhandler.cpp
+++ b/app/BookMan/krbookmarkhandler.cpp
@@ -915,6 +915,9 @@ void KrBookmarkHandler::rightClicked(QMenu *menu, KrBookmark *bm)
     connect(menu, SIGNAL(highlighted(int)), &popup, SLOT(close()));
     connect(menu, SIGNAL(activated(int)), &popup, SLOT(close()));
 
+    // A QPointer aimed to safely track the lifetime of the bookmark
+    QPointer<KrBookmark> safeBm(bm);
+
     int result = -1;
     QAction *res = popup.exec(QCursor::pos());
     if (res && res->data().canConvert<int>())
@@ -925,15 +928,20 @@ void KrBookmarkHandler::rightClicked(QMenu *menu, KrBookmark *bm)
         _mainBookmarkPopup->close();
     }
 
+    // Only proceed if the bookmark wasn't destroyed in the background
+    if (!safeBm) {
+        return;
+    }
+
     switch (result) {
     case OPEN_ID:
-        SLOTS->refresh(bm->url());
+        SLOTS->refresh(safeBm->url());
         break;
     case OPEN_NEW_TAB_ID:
-        _mainWindow->activeManager()->newTab(bm->url());
+        _mainWindow->activeManager()->newTab(safeBm->url());
         break;
     case DELETE_ID:
-        deleteBookmark(bm);
+        deleteBookmark(safeBm.data());
         break;
     }
 }