* SECURITY UPDATE: various packet overreads in the mysqlnd wire protocol - debian/patches/php-7.4-CVE-2025-1218.patch: backport upstream commit 114dbb7436 in ext/mysqlnd/ - the packet readers decoded fields out of a server response before checking that the packet still held enough bytes, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer. BAIL_IF_NO_MORE_DATA, which only noticed an overread after it happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n); php_mysqlnd_net_field_length() and its _ll variant take a remaining_size argument and reject length encodings whose payload is not fully present; the auth-plugin-name branches use memchr() instead of trusting a NUL terminator; and the prepared-statement TIME/DATE/DATETIME readers stop decoding fixed offsets out of a shorter declared length. The mysqlnd_ps.c hunk is a leak fix on the newly reachable prepare-EOF failure path, and the prepare_read / sha256_pk_request_response_read hunks are hardening only, not memory-safety fixes. Also carries upstream's fake_server.inc additions and 38 regression tests, adapted for PHP 7.4 (see the patch header). - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 3 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - CVE-2025-1218