In src/pkg_columnizer.cc, function
pkg_item::pkg_columnizer::setup_columns(),
there is a guaranteed null pointer dereference when the default column
format string cannot be parsed.

The relevant code:

    columns = parse_columns(cfg, ...);
    ...
    if(!columns)
    {
        ...
        columns = parse_columns(cfg, ...);
        if(!columns)
        {
            _error->Warning(_("Internal error: Default column string is
unparsable"));
            const cw::config::column_definition col(...);
            columns->push_back(col);   // <-- dereference of nullptr
        }
    }

parse_columns() from cwidget returns NULL on parse failure. When the second
call also fails, columns is nullptr, but the code unconditionally
dereferences
it. This is undefined behavior (CWE-476).

Suggested fix:

    if(!columns)
    {
        _error->Warning(_("Internal error: Default column string is
unparsable"));
        columns = new cw::config::column_definition_list;
        const cw::config::column_definition col(...);
        columns->push_back(col);
    }

or return early to avoid the dereference.

This is an old upstream bug originally tracked at
https://bugs.debian.org/424659 and similar.