Creating an alias to a command defined in the same file causes segmentation fault when the new command is used

[michel-slm]

Given this alias configuration file

~ 
❯ cat /etc/dnf/dnf5-aliases.d/CPE.conf 
version = '1.0'

['cpe-aliases']
type = 'group'
header = 'CPE aliases'

['upgrade-no-meta']
type = 'command'
attached_command = 'upgrade'
descr = "Alias for 'upgrade --skip-unavailable --disable-repo=cpe-yum*'"
group_id = 'cpe-aliases'
attached_named_args =[
  { id_path = 'upgrade.skip-unavailable' },
  { id_path = 'disable-repo', value = 'cpe-yum*' },
]

['up-no-meta']
type = 'command'
attached_command = 'upgrade'
descr = "Alias for 'upgrade --skip-unavailable --disable-repo=cpe-yum*'"
group_id = 'cpe-aliases'
attached_named_args =[
  { id_path = 'upgrade.skip-unavailable' },
  { id_path = 'disable-repo', value = 'cpe-yum*' },
]

['up2']
type = 'command'
attached_command = 'upgrade-no-meta'
descr = "Alias for upgrade-no-meta"
group_id = 'cpe-aliases'

The commands show up in dnf --help as expected

~ 
❯ sudo dnf --help | grep -A5 CPE
CPE aliases                              
  upgrade-no-meta                        Alias for 'upgrade --skip-unavailable --disable-repo=cpe-yum*'
  up-no-meta                             Alias for 'upgrade --skip-unavailable --disable-repo=cpe-yum*'
  up2                                    Alias for upgrade-no-meta
                                         
Commands:  

And upgrade-no-meta and up-no-meta both work as expected. But up2 which is just an alias to upgrade-no-meta causes a segmentation fault when used

~ 
❯ sudo dnf up2
fish: Job 1, 'sudo dnf up2' terminated by signal SIGSEGV (Address boundary error)

On Fedora 41 x86_64

~
❯ rpm -q dnf5
dnf5-5.2.8.1-2.fc41.x86_64

[ppisar]

I confirm this issue with dnf5-5.2.8.1-20250102010253.19.gd51f6146.fc42.x86_64. The reproducer can be reduced to:

version = '1.0'

['up1']
type = 'command'
attached_command = 'upgrade'

['up2']
type = 'command'
attached_command = 'up1'

A backtrace:

#0  0x00007ffff7f14784 in libdnf5::cli::session::Command::get_session (this=0x0)
    at /home/test/dnf5/libdnf5-cli/session.cpp:152
#1  0x00007ffff7f14277 in operator()
    (__closure=0x790a30, arg=0x82bba0, option=0x7fffffffe0cf "up2", argc=1, argv=0x7fffffffddd0)
    at /home/test/dnf5/libdnf5-cli/session.cpp:72
#2  0x00007ffff7f15c26 in std::__invoke_impl<bool, libdnf5::cli::session::Session::Impl::add_and_initialize_command(std::unique_ptr<libdnf5::cli::session::Command>&&)::<lambda(libdnf5::cli::ArgumentParser::Argument*, char const*, int, char const* const*)>&, libdnf5::cli::ArgumentParser::Command*, char const*, int, char const* const*>(std::__invoke_other, struct {...} &) (__f=...)
    at /usr/include/c++/14/bits/invoke.h:61
#3  0x00007ffff7f158fe in std::__invoke_r<bool, libdnf5::cli::session::Session::Impl::add_and_initialize_command(std::unique_ptr<libdnf5::cli::session::Command>&&)::<lambda(libdnf5::cli::ArgumentParser::Argument*, char const*, int, char const* const*)>&, libdnf5::cli::ArgumentParser::Command*, char const*, int, char const* const*>(struct {...} &) (__fn=...) at /usr/include/c++/14/bits/invoke.h:114
#4  0x00007ffff7f1565a in std::_Function_handler<bool(libdnf5::cli::ArgumentParser::Command*, char const*, int, char const* const*), libdnf5::cli::session::Session::Impl::add_and_initialize_command(std::unique_ptr<libdnf5::cli::session::Command>&&)::<lambda(libdnf5::cli::ArgumentParser::Argument*, char const*, int, char const* const*)> >::_M_invoke(const std::_Any_data &, libdnf5::cli::ArgumentParser::Command *&&, const char *&&, int &&, const char * const *&&)
    (__functor=..., __args#0=@0x7fffffffcd60: 0x82bba0, __args#1=@0x7fffffffcd58: 0x7fffffffe0cf "up2", __args#2=@0x7fffffffcd54: 1, __args#3=@0x7fffffffcd48: 0x7fffffffddd0)
    at /usr/include/c++/14/bits/std_function.h:290
#5  0x00007ffff7e62297 in std::function<bool(libdnf5::cli::ArgumentParser::Command*, char const*, int, char const* const*)>::operator()
    (this=0x790a30, __args#0=0x82bba0, __args#1=0x7fffffffe0cf "up2", __args#2=1, __args#3=0x7fffffffddd0) at /usr/include/c++/14/bits/std_function.h:591
#6  0x00007ffff7e5a92f in libdnf5::cli::ArgumentParser::CommandAlias::parse
    (this=0x82bcc0, option=0x7fffffffe0cf "up2", argc=1, argv=0x7fffffffddd0)
    at /home/test/dnf5/libdnf5-cli/argument_parser.cpp:1328
#7  0x00007ffff7e58efc in libdnf5::cli::ArgumentParser::CommandOrdinary::parse
    (this=0x789740, option=0x7fffffffe0a2 "/home/test/dnf5/redhat-linux-build/dnf5/dnf5", argc=2, argv=0x7fffffffddc8) at /home/test/dnf5/libdnf5-cli/argument_parser.cpp:1079
#8  0x00007ffff7e5b45a in libdnf5::cli::ArgumentParser::parse
    (this=0x702530, argc=2, argv=0x7fffffffddc8)
    at /home/test/dnf5/libdnf5-cli/argument_parser.cpp:1445
#9  0x000000000057a39f in main (argc=2, argv=0x7fffffffddc8) at /home/test/dnf5/dnf5/main.cpp:1244

We have a related bug report from Fedora https://bugzilla.redhat.com/show_bug.cgi?id=2323866 which has the same backtrace. They have probably the same cause.