Crashes in `promql.ParseExpr()`

[msiebuhr]

After fuzzing promql.ParseExp() (see #667 (comment)), a few hundred crashing cases were found. All examined ones look like arithmetic on zeroes, ex :-0%--%-0, 0++->-0-0 and 0--% and seem to have a common stack trace:

panic: runtime error: invalid memory address or nil pointer dereference [recovered]
    panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x28 pc=0x3f6c6]

goroutine 1 [running]:
github.com/prometheus/prometheus/promql.(*parser).recover(0xc2080a2310, 0xc2080b3e50)
    /var/folders/sx/dbshyxqs4ks06n4f91r1qb800000gn/T/go-fuzz-build996535930/src/github.com/prometheus/prometheus/promql/parse.go:326 +0x113
github.com/prometheus/prometheus/promql.(*UnaryExpr).Type(0xc20801f0e0, 0x80dd30)
    /var/folders/sx/dbshyxqs4ks06n4f91r1qb800000gn/T/go-fuzz-build996535930/src/github.com/prometheus/prometheus/promql/ast.go:213 +0x66
github.com/prometheus/prometheus/promql.(*UnaryExpr).Type(0xc20801f100, 0x816800)

[msiebuhr]

Just did a second round of fuzzing and got the following crashing statements:

"(-=)"
"+*+0+0+0-0"
"+*+0-+0+0-0-0"
"++-%-0+0-0"
"++-+*"
"++-+*+0-0-0"
"++-+*-0"
"++-++%"
"++-++%>0"
"++-++%>0>0"
"++-++-*-0-0"
"++-++-+-+-<"
"++-++--+*"
"++-++--+*-0"
"+-%-0+0-0"
"+-*"
"+-*+0"
"+-*+0-0"
"+-+*"
"+-+*-0"
"+-++%>0>0"
"+-++-+-+-<"
"+-++--+*"
"+-++--+*-0"
"-%-0+0-0"
"-*+0"
"-*+0-0"
"-+*+0+0+0-0"
"-+*+0-+0+0-0-0"
"-++%>0>0"
"-++-+*+0-0-0"
"-++--+*"
"-++--+*-0"
"-If"
"0++-**0+0"
"0++-++%"
"0++-++%>0"
"0++-++%>0>0"
"0+-%-0+0-0"
"0+-*"
"0+-**0+0+0-0"
"0+-**0>0"
"0+-*+0"
"0+-*+0-0"
"0+-+*"
"0+-+*+0-0-0"
"0+-+*-0"
"0+-++%"
"0+-++%>0"
"0+-++%>0>0"
"0+-++-+-+-<"
"0+-++--+*"
"0+-++--+*-0"
"0+0*+-*"
"0+0*+-*-0"
"0-+**0-0-0"
"0-+*+0+0+0-0"
"0-+*+0-+0+0-0-0"
"0-++%>0>0"
"0-+++*+0-0-0"
"0-++-+*+0-0-0"
"0-++-+-+-<"
"0-++--+*"
"0-++--+*-0"
"0-0*+*"
"0-0*+*+0-0"
"0-0*+*+0-0-0"
"0-0*+*-0"
"0-0*++*+0-0"
"0-0*++*+0-0-0"
"08.>-80m"
"0>-*+0+0"
"0>-+>-0"
"0>-0m-0"
"0>0*+/-0"
"0>0--0y-0>0"
"0>e*+/"
"0>e*+/-0"
"0>y--0y-0>0"
"1+2++*/(3-1)"
"A+-*"
"T++-*"
"T++--++-*"
"T+-++--++-*"
"T+--++-*"
"T-++-*"
"T-++--++-*"
"T--++-*"
"e-+=/(0)"

I'm not familiar with that piece of code, so I've included all the output in hopes someone can discern a pattern :)

[msiebuhr]

Fixed by #954 (haven't tested, just that the other issues says it's the same underlying issue + it's fixed in the PR)

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.