* SECURITY UPDATE: out-of-bounds reads in the mysqlnd wire-protocol packet readers - debian/patches/php-7.3-CVE-2025-1218.patch: backport upstream commit 114dbb7436 in ext/mysqlnd/ - the packet readers decoded fields out of a server response before checking that the packet still held enough bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer by sending a truncated packet. BAIL_IF_NO_MORE_DATA, which only noticed an over-read after it had happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n); php_mysqlnd_net_field_length() and its _ll variant take a remaining_size argument and refuse to decode a length whose payload is not present; the auth-plugin-name reads in greet_read, auth_response_read and chg_user_read use memchr() instead of trusting a NUL terminator; and mysqlnd_ps_codec.c rejects a declared field length that is too short for the fixed offsets the TIME/DATE/DATETIME readers decode. The patch also carries the prerequisite upstream commit d37a20c4a2 (php-8.2.27), which bounds the auth_protocol read in greet_read: the CVE fix removes the NUL terminator that greeting buffer relied on, so without it that read would become a stack over-read. The ext/mysqlnd/mysqlnd_ps.c hunk is a memory-leak fix on the failure path the new bounds checks make reachable, and the prepare_read() and sha256_pk_request_response_read() hunks are hardening, not memory-safety fixes. Upstream's regression tests are not carried: they drive the dynamic-port fake server upstream added in the same commit, while this branch's ext/standard/tests/mysqli/fake_server.inc harness binds a fixed port, and nothing in this package runs the suite. The 32 of them that apply here were run locally instead, on a tree built from this repository's own patch series, first patched and then with only the C hunks of this patch reversed out and rebuilt: 32 of 32 pass patched, 0 fail; 8 of 32 pass unpatched, 24 fail. - debian/patches/php-7.3-CVE-2025-1218-caching-sha2.patch: the same fix for php_mysqlnd_cached_sha2_result_read(), which does not exist at php-7.3.33 but is introduced by debian/patches/php-7.3.33-caching-sha2-password.patch with the unterminated-plugin-name over-read and the one-byte over-read on the normal path. Kept separate because the Alpine build does not apply the caching_sha2_password backport. - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 3 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - CVE-2025-1218