[utilities/krusader] app/BookMan: BookMan: Fix use-after-free problems during bookmark search reset

Git commit c889811ccae047cee51555710f0baf804bb151ca by Toni Asensi Esteve.
Committed on 16/08/2026 at 22:14.
Pushed by asensi into branch 'master'.

BookMan: Fix use-after-free problems during bookmark search reset

Previously, if a bookmark action was deleted in the background while
a search was active, the raw pointer remained in a QHash. When the
search was cleared and `_resetActionTextAndHighlighting()` iterated
over the QHash in order to restore the original text, it dereferenced
a dangling pointer, causing a use-after-free abrupt termination.

By using a QPointer, the reset loop can now safely verify that
the action still exists before attempting to restore its text.

Note: The QPointer class does not have a default `qHash()` implementation
in Qt, which means that it cannot be used directly as a key in a QHash
without writing a custom hash function. Because we only iterate over
this collection in order to restore the text and then clear it (we
never actually perform key-based lookups), using a QHash is not needed.

Revision: https://invent.kde.org/utilities/krusader/-/merge_requests/193

M  +6    -5    app/BookMan/krbookmarkhandler.cpp
M  +2    -2    app/BookMan/krbookmarkhandler.h

https://invent.kde.org/utilities/krusader/-/commit/c889811ccae047cee51555710f0baf804bb151ca

diff --git a/app/BookMan/krbookmarkhandler.cpp b/app/BookMan/krbookmarkhandler.cpp
index c50ecf799..7a435bdb7 100644
--- a/app/BookMan/krbookmarkhandler.cpp
+++ b/app/BookMan/krbookmarkhandler.cpp
@@ -719,7 +719,7 @@ bool KrBookmarkHandler::eventFilter(QObject *obj, QEvent *ev)
 
                 // strip accelerator keys from actions so they don't interfere with the search key press events
                 auto text = act->text();
-                _quickSearchOriginalActionTitles.insert(act, text);
+                _quickSearchOriginalActionTitles.append({act, text});
                 act->setText(KLocalizedString::removeAcceleratorMarker(text));
             }
 
@@ -805,10 +805,11 @@ bool KrBookmarkHandler::eventFilter(QObject *obj, QEvent *ev)
 
 void KrBookmarkHandler::_resetActionTextAndHighlighting()
 {
-    for (QHash<QAction *, QString>::const_iterator i = _quickSearchOriginalActionTitles.constBegin(); i != _quickSearchOriginalActionTitles.constEnd(); ++i) {
-        QAction *action = i.key();
-        action->setText(i.value());
-        _highlightAction(action, false);
+    for (const auto &item : _quickSearchOriginalActionTitles) {
+        if (QAction *action = item.first) {
+            action->setText(item.second);
+            _highlightAction(action, false);
+        }
     }
 
     _quickSearchOriginalActionTitles.clear();
diff --git a/app/BookMan/krbookmarkhandler.h b/app/BookMan/krbookmarkhandler.h
index 8d79e6846..17e8ef4ec 100644
--- a/app/BookMan/krbookmarkhandler.h
+++ b/app/BookMan/krbookmarkhandler.h
@@ -77,8 +77,8 @@ private:
 
     QWidgetAction *_quickSearchAction; ///< Search bar container action
     QLineEdit *_quickSearchBar; ///< Search bar containing current query
-    QMenu *_quickSearchMenu; ///< The menu where the search is performed
-    QHash<QAction *, QString> _quickSearchOriginalActionTitles; ///< Saved original action text values to restore after search
+    QPointer<QMenu> _quickSearchMenu; ///< The menu where the search is performed
+    QList<std::pair<QPointer<QAction>, QString>> _quickSearchOriginalActionTitles; ///< Saved original action text values to restore after search
 
     void _setQuickSearchText(const QString &text);
     QString _quickSearchText() const;