From 81701d6a92d09a9ae091e755a55079f647f5f46c Mon Sep 17 00:00:00 2001
From: Jonathan Bagg <drwho@infidigm.net>
Date: Tue, 10 Feb 2026 13:14:26 -0500
Subject: [PATCH] Bonjour - fix crashing when deleting browser (recent
 regression)

When the browser is deleted, Resolver::cleanUp() is called for each
resolver in the resolvers list and it modifies resolvers which can break
the iterator in the caller.  Use erase() to get a valid iterator and return
it to use in the callers loop.
---
 bonjour.cpp | 10 ++++++----
 bonjour_p.h |  2 +-
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/bonjour.cpp b/bonjour.cpp
index 8c65c7c..ba182ef 100644
--- a/bonjour.cpp
+++ b/bonjour.cpp
@@ -43,14 +43,16 @@ void Resolver::addressReady()
 		cleanUp();
 }
 
-void Resolver::cleanUp()
+QHash<QString, Resolver*>::iterator Resolver::cleanUp()
 {
 	DNSServiceRefDeallocate(DNSresolverRef);
 	DNSServiceRefDeallocate(DNSaddressRef);
 	// the QSocketNotifiers resolverNotifier and addressNotifier get deleted when the QSharedPointer gets deleted along with the Resolver.  No need to clear them here.
 	QString key = zcs->name() + QString::number(zcs->interfaceIndex());
-	ref->resolvers.remove(key);
+	QHash<QString, Resolver*>::iterator it = ref->resolvers.find(key);
+	it = ref->resolvers.erase(it);
 	delete this;
+	return it;
 }
 
 QZeroConfPrivate::QZeroConfPrivate(QZeroConf *parent)
@@ -232,8 +234,8 @@ void QZeroConfPrivate::cleanUp(DNSServiceRef toClean)
 	if (toClean == browser) {
 		browser = nullptr;
 		browserNotifier.clear();
-		for (auto resolver : resolvers)
-			resolver->cleanUp();
+		for (QHash<QString, Resolver*>::iterator it = resolvers.begin(); it != resolvers.end(); )
+			it = (*it)->cleanUp();  // cleanUp() modifies resolvers, so it returns a valid iterator
 		resolvers.clear();
 		for (auto service : pub->services)
 			emit pub->serviceRemoved(service);
diff --git a/bonjour_p.h b/bonjour_p.h
index 6508316..16748db 100644
--- a/bonjour_p.h
+++ b/bonjour_p.h
@@ -42,7 +42,7 @@ class Resolver : public QObject
 {
 	Q_OBJECT
 public:
-	void cleanUp();
+	QHash<QString, Resolver*>::iterator cleanUp();
 	QZeroConfService zcs;
 	QZeroConfPrivate *ref = nullptr;
 	DNSServiceRef DNSresolverRef = nullptr;