panic: INSERT VALUES placeholder $0 underflows parameter index inference

[Dandandan]

Describe the bug

Planning an INSERT ... VALUES statement with placeholder $0 panics. Other statement forms reject $0, but this DML path parses the placeholder index as usize and subtracts one without checking for zero.

To Reproduce

CREATE TABLE t AS SELECT 1 AS x;
EXPLAIN INSERT INTO t VALUES ($0);

Actual behavior

thread 'main' panicked at datafusion/sql/src/statement.rs:2339:29:
attempt to subtract with overflow

Expected behavior

Return a planning error such as Invalid placeholder, zero is not a valid index: $0.

Notes

SELECT $0 and PREPARE p AS SELECT $0 already return a clean planning error; the INSERT ... VALUES inference path should do the same.

[nathanb9]

@Dandandan Are these issues found from fuzzing? Could you link that if so please?

[Dandandan]

@Dandandan Are these issues found from fuzzing? Could you link that if so please?

This one was from instructing Codex to find distinct query crashes using

/goal and then something like "find 20 unique crashes in sql / planner. Continue until you found 20 distinct issues and create a github issue with a minimal reproducer for each"

[Dandandan]

The earlier ones where from setting up https://github.com/rust-fuzz/cargo-fuzz and have it generate random inputs while parsing / planning.