[PostGIS] #6118: Out-of-bounds read in geometry_type_from_string() on an empty type modifier

[PostGIS]

#6118: Out-of-bounds read in geometry_type_from_string() on an empty type modifier
-----------------------+-----------------------------
  Reporter:  eivkov    |      Owner:  pramsey
      Type:  defect    |     Status:  closed
  Priority:  critical  |  Milestone:  PostGIS 3.6.5
 Component:  postgis   |    Version:  master
Resolution:  fixed     |   Keywords:  buffer overflow
-----------------------+-----------------------------
Changes (by Darafei Praliaskouski <komzpa@…>):

 * resolution:   => fixed
 * status:  new => closed

Comment:

 In [changeset:"c0793ca1e25eba653a5cc500f600daa9fd936f68/git"
 c0793ca1/git]:
 {{{#!CommitTicketReference repository="git"
 revision="c0793ca1e25eba653a5cc500f600daa9fd936f68"
 Merge pull request 'Reject empty geometry type modifiers' (!769) from
 Komzpa/postgis:codex/postgis-1176-20260907 into master

 Reject empty geometry type modifiers before computing the
 trailing-space index in geometry_type_from_string(). This prevents an
 out-of-bounds read caused by strlen(str) - 1 underflow.

 Add regression coverage for empty input and preserve initialized
 output values on failure.

 Patch by Egor Ivkov, with SQL regression coverage and contributor
 metadata updates by Darafei Praliaskouski.

 Closes #6118
 Closes https://github.com/postgis/postgis/pull/1176

 Reviewed-on: https://gitea.osgeo.org/postgis/postgis/pulls/769
 }}}
-- 
Ticket URL: <https://trac.osgeo.org/postgis/ticket/6118#comment:3>
PostGIS <http://trac.osgeo.org/postgis/>
The PostGIS Trac is used for bug, enhancement & task tracking, a user and developer wiki, and a view into the subversion code repository of PostGIS project.