gnome-software is crashing on startup (so security notifications are never delivered), when there are updates available from the Google Chrome APT repository.


$ apt-cache policy gnome-software
gnome-software:
  Installed: 3.22.5-1
  Candidate: 3.22.5-1
  Version table:
 *** 3.22.5-1 500
        500 http://ftp.uk.debian.org/debian stretch/main amd64 Packages
        100 /var/lib/dpkg/status
$ apt-cache policy libpackagekit-glib2-18
libpackagekit-glib2-18:
  Installed: 1.1.5-2
  Candidate: 1.1.5-2
  Version table:
 *** 1.1.5-2 500
        500 http://ftp.uk.debian.org/debian stretch/main amd64 Packages
        100 /var/lib/dpkg/status


Thread 9 "pool" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffcffff700 (LWP 2689)]
gs_plugin_add_updates (plugin=0x555555885d00, list=0x555557735af0, cancellable=<optimized out>, error=<optimized out>)
    at gs-plugin-systemd-updates.c:122
(gdb) bt full 1
#0  gs_plugin_add_updates (plugin=0x555555885d00, list=0x555557735af0, cancellable=<optimized out>, error=<optimized out>) at gs-plugin-systemd-updates.c:122
        app = 0x5555558af7c0
        split = 0x0
        i = 1
        error_local = 0x0
        package_ids = 0x7fffc0073d00

Source code gs-plugin-systemd-updates.c:

121     split = pk_package_id_split (package_ids[i]);
122     gs_app_add_source (app, split[PK_PACKAGE_ID_NAME]);

We have split = 0x0 (NULL pointer) above. pk_package_id_split() returns NULL only when the id is invalid.

(gdb) p package_ids[0]
$1 = (gchar *) 0x7fffc407f720 "google-chrome-stable;63.0.3239.84-1;amd64;google"
(gdb) p package_ids[1]
$2 = (gchar *) 0x7fffc4087e20 "_inc.-stable-main"
(gdb) p package_ids[2]
$3 = (gchar *) 0x0
(gdb) p i
$5 = 1

It seems the invalid id is `_inc.-stable-main`. `pkcon get-updates` shows only one package containing the text from both ids. However `pkcon get-offline-updates` appears to illustrate the same bug. (`apt-get --dry-run upgrade shows there is only one upgradable package`):

$ pkcon get-updates      
Normal          google-chrome-stable-63.0.3239.84-1.amd64 (google,_inc.-stable-main)    The web browser from Google
$ pkcon offline-get-prepared
Prepared updates:
google-chrome-stable-63.0.3239.84-1.amd64
(null)

because `pk-offline.c` does:

/* return raw package ids */
return g_strsplit (prepared_ids, ",", -1);


So PK offline does not handle an ID that looks like this.  Despite that `pkcon get-updates` was able to do so, hence I assume pk_package_id_split() is claiming that an ID which contains "," is perfectly valid.

Both the code quotes above appear the same in GIT master.