* SECURITY UPDATE: multiple out-of-bounds reads in the mysqlnd wire protocol parser - a malicious or compromised MySQL server could send a truncated packet and make the client read past the end of the packet buffer - debian/patches/php-8.0-CVE-2025-1218.patch: backport upstream commit 114dbb7436 in ext/mysqlnd/. Replaces the after-the-fact BAIL_IF_NO_MORE_DATA check with a BAIL_IF_NOT_ENOUGH_DATA_EX(n) family that refuses the read before it happens, adds a remaining_size parameter to php_mysqlnd_net_field_length()/_ll() so the 2/3/8-byte length prefixes are bounds-checked, and adds the missing checks in greet_read (server version, MariaDB RPL prefix, the fixed 31-byte block, the extended scramble and the auth plugin name), auth_response_read, ok_read, eof_read, rset_header_read, the READ_RSET_FIELD metadata macro, rowp_read and its text-protocol field lengths, chg_user_read and cached_sha2_result_read. In mysqlnd_ps_codec.c the new ps_fetch_is_length_too_short() makes the prepared-statement time/date/datetime fetchers reject a declared field length that is shorter than the fixed offsets they read. The mysqlnd_ps.c hunk is a memory-leak fix on the failure path the new checks make reachable, not an over-read fix; the prepare_read() and sha256_pk_request_response_read() hunks are hardening only - the former provably cannot fire behind the existing PREPARE_RESPONSE_SIZE gate and the latter is a strictness change. Carries all 38 upstream ghsa-r6x9-5r99-36j7 phpt tests plus ext/mysqli/tests/fake_server.inc, imported in full from upstream because the tests load it by that path. This branch already carries an older, 870-line fake_server.inc at ext/standard/tests/mysqli/ from the CVE-2024-8929 backport; that copy predates upstream's dynamic-port API, so the two coexist rather than one being rewritten to serve both. 14 of the 38 have the last one or two lines of their expected output adapted, because mysqli on 8.0 does not throw on a failed connect and does not populate the error message the 8.2 expectations print. - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 3 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - CVE-2025-1218 * debian/rules: build with -O2. The deb build never set an optimisation level (only -fno-strict-aliasing/-fPIC/... were appended to CFLAGS), so gcc compiled everything at its -O0 default. Unoptimised binaries failed the perftest on ubuntu26.04 (alt-php80 took 3.85x the time of the distro PHP 8.5.4 against a 2.55x limit). RPM (optflags, -O2) and Alpine (-Os) builds were already optimised and are unchanged.