promsql.ParseStmts() crashes on input starting with I=

[msiebuhr]

After fuzzing promql.ParseStmts() (see #667), crashes were found when the input starts with I=, ex: I=-/, I=0---0d and I=3E8/-=, but also one case with M=-=-0-0. (Ran 2,6M different cases so far)

The stack traces generally look to be on the form

panic: runtime error: invalid memory address or nil pointer dereference [recovered]
    panic: runtime error: invalid memory address or nil pointer dereference
[signal 0xb code=0x1 addr=0x28 pc=0x3f696]

goroutine 1 [running]:
github.com/prometheus/prometheus/promql.(*parser).recover(0xc2080a2620, 0xc2080b3e20)
    /var/folders/sx/dbshyxqs4ks06n4f91r1qb800000gn/T/go-fuzz-build553606002/src/github.com/prometheus/prometheus/promql/parse.go:326 +0x113
github.com/prometheus/prometheus/promql.(*UnaryExpr).Type(0xc20801f820, 0xa040d0)
    /var/folders/sx/dbshyxqs4ks06n4f91r1qb800000gn/T/go-fuzz-build553606002/src/github.com/prometheus/prometheus/promql/ast.go:213 +0x66
github.com/prometheus/prometheus/promql.(*UnaryExpr).Type(0xc20801f840, 0x20)

But there's also a few cases where go-fuzz decided to kill things after 10 seconds without any output...

[fabxc]

Same underlying bug as #940 and fixed in #954.
The examples were added as another regression test.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.