rpm-ostree crash when obtaining rpm diff of a remote branch

[IainCollins262]

Describe the bug

rpm-ostree service crashes when 'DownloadRebaseRpmDiff' is called

Reproduction steps

On an OSTree deployment which includes Cockpit and the cockpit-ostree project. Change the selected branch to one which is different from the current deployment and the check for updates.

Expected behavior

The request should complete.

Actual behavior

The request doesn't complete and the following crash is reported in the journalctl log

\an 21 16:44:11 cdx-mved-00012 rpm-ostree[4679]: Initiated txn DownloadRebaseRpmDiff for client(dbus:1.125 unit:session-4.scope uid:0): /org/projectatomic/rpmostree1/mediavault_updates
Jan 21 16:44:12 cdx-mved-00012 rpm-ostree[4679]: Process [pid: 2746 uid: 0 unit: session-4.scope] connected to transaction progress
Jan 21 16:44:12 cdx-mved-00012 kernel: pool-rpm-ostree[4684]: segfault at 8 ip 00007f1f007e7ec0 sp 00007f1ee37fd628 error 4 in libglib-2.0.so.0.6800.4[7f1f00765000+91000] likely on CPU 0 (core 0, socket 0)
Jan 21 16:44:12 cdx-mved-00012 kernel: Code: 75 d8 48 8b 84 24 98 00 00 00 64 48 2b 04 25 28 00 00 00 75 10 48 81 c4 a0 00 00 00 5b 5d 41 5c 41 5d 41 5e c3 e8 b0 e3 f7 ff <48> 8b 47 08 ba 26 2a c0 99 41 b8 01 00 00 >
Jan 21 16:44:12 cdx-mved-00012 systemd[1]: Started Process Core Dump (PID 4703/UID 0).
Jan 21 16:44:12 cdx-mved-00012 systemd-coredump[4704]: [🡕] Process 4679 (rpm-ostree) of user 0 dumped core.
                                                       
                                                       Stack trace of thread 4684:
                                                       #0  0x00007f1f007e7ec0 ensure_valid_dict (libglib-2.0.so.0 + 0x9fec0)
                                                       #1  0x00007f1f007e7fcd g_variant_dict_lookup (libglib-2.0.so.0 + 0x9ffcd)
                                                       #2  0x0000555e4500f515 _ZL21change_origin_refspecP13_GVariantDictP13OstreeSysrootP15RpmOstreeOriginPKcP13_GCancellablePPcSA_PP7_GError.constprop.0 (rpm-ostree +>
                                                       #3  0x0000555e44f50087 _ZL32package_diff_transaction_executeP22_RpmostreedTransactionP13_GCancellablePP7_GError (rpm-ostree + 0x303087)
                                                       #4  0x0000555e44f4b5f8 _ZL26transaction_execute_threadP6_GTaskPvS1_P13_GCancellable (rpm-ostree + 0x2fe5f8)
                                                       #5  0x00007f1f009317ff g_task_thread_pool_thread (libgio-2.0.so.0 + 0xaf7ff)
                                                       #6  0x00007f1f007ce654 g_thread_pool_thread_proxy.lto_priv.0 (libglib-2.0.so.0 + 0x86654)
                                                       #7  0x00007f1f007cb762 g_thread_proxy (libglib-2.0.so.0 + 0x83762)
                                                       #8  0x00007f1eff88a062 start_thread (libc.so.6 + 0x8a062)
                                                       #9  0x00007f1eff90f0e0 __clone3 (libc.so.6 + 0x10f0e0)

System details

rpm-ostree --version
rpm-ostree:
Version: '2024.9'
Git: b88b8f411d2fff6c70d301fb0465731bd7d32f1d
Features:

• rust
• compose
• container

Additional information

No response

[IainCollins262]

After some more digging I think that I have located the source of the problem and the following patch seems to address the issue which I'm seeing.

diff -uNr rpm-ostree-2024.9/src/daemon/rpmostreed-transaction-types.cxx rpm-ostree-2024.9p/src/daemon/rpmostreed-transaction-types.cxx
--- rpm-ostree-2024.9/src/daemon/rpmostreed-transaction-types.cxx       2024-11-19 16:10:57.000000000 +0000
+++ rpm-ostree-2024.9p/src/daemon/rpmostreed-transaction-types.cxx      2025-01-27 11:40:16.709031878 +0000
@@ -320,7 +320,8 @@
 
   if (self->refspec != NULL)
     {
-      if (!change_origin_refspec (NULL, sysroot, origin, self->refspec, cancellable, NULL, NULL,
+      g_autoptr (GVariantDict) options_dict = g_variant_dict_new (NULL);
+      if (!change_origin_refspec (options_dict, sysroot, origin, self->refspec, cancellable, NULL, NULL,
                                   error))
         return FALSE;
     }