Repository navigation
panic: INSERT VALUES placeholder $0 underflows parameter index inference #22224
Description
Describe the bug
Planning an INSERT ... VALUES statement with placeholder $0 panics. Other statement forms reject $0, but this DML path parses the placeholder index as usize and subtracts one without checking for zero.
To Reproduce
CREATE TABLE t AS SELECT 1 AS x;
EXPLAIN INSERT INTO t VALUES ($0);Actual behavior
thread 'main' panicked at datafusion/sql/src/statement.rs:2339:29:
attempt to subtract with overflow
Expected behavior
Return a planning error such as Invalid placeholder, zero is not a valid index: $0.
Notes
SELECT $0 and PREPARE p AS SELECT $0 already return a clean planning error; the INSERT ... VALUES inference path should do the same.
Activity
nathanb9 commentedon May 15, 2026
@Dandandan Are these issues found from fuzzing? Could you link that if so please?
Dandandan commentedon May 15, 2026
This one was from instructing Codex to find distinct query crashes using
/goaland then something like "find 20 unique crashes in sql / planner. Continue until you found 20 distinct issues and create a github issue with a minimal reproducer for each"Dandandan commentedon May 15, 2026
The earlier ones where from setting up https://github.com/rust-fuzz/cargo-fuzz and have it generate random inputs while parsing / planning.
Guard insert placeholder zero (apache#22299)