* SECURITY UPDATE: mysqlnd read past the end of a server packet - debian/patches/php-7.2-CVE-2025-1218.patch: the mysqlnd wire-protocol packet readers in ext/mysqlnd/mysqlnd_wireprotocol.c decoded fields out of a server response before checking that the packet still held enough bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer by sending a truncated packet. The affected readers are the greeting, auth response, OK, EOF, result-set header, result-set field metadata, row and change user packets, plus the backported caching_sha2_password result reader. The BAIL_IF_NO_MORE_DATA macro, which only noticed an over-read after it had already happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n), which checks before the bytes are read; php_mysqlnd_net_field_length() and its _ll variant now take the number of bytes left in the packet and refuse a length whose payload is not fully present; and the unterminated auth-plugin-name branches use memchr() instead of trusting a NUL terminator. In ext/mysqlnd/mysqlnd_ps_codec.c the TIME, DATE and DATETIME readers stop decoding fixed offsets out of a shorter declared length. Two of the upstream hunks are hardening rather than memory safety: the bounds added to php_mysqlnd_prepare_read() and php_mysqlnd_sha256_pk_request_response_read() cannot be violated behind the checks that already guard those functions. The ext/mysqlnd/mysqlnd_ps.c hunk is a memory-leak fix, releasing the connection reference and the execute command buffer on the failure path that the new bounds check makes reachable. The patch also carries upstream commit d37a20c4a2 (php-8.2.27), which bounds the auth plugin name read in the greeting parser. The CVE-2025-1218 fix removes the buffer's safety NUL terminator, which is only safe once that earlier commit is in; without it the auth_protocol read would become an unbounded read off a 2048-byte stack buffer. None of upstream's 38 regression tests are carried: they drive the dynamic-port fake server upstream added in the same commit, while the harness this package ships in ext/standard/tests/mysqli/fake_server.inc binds a fixed port, and nothing in this package runs the suite anyway. They were run locally instead, on a tree built from this repository's own patch series, first patched and then with only the C hunks of this patch reversed out and rebuilt: 38 of 38 pass patched, 0 fail; 9 of 38 pass unpatched, 29 fail. - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 3 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - The mysqlnd_ps.c hunk additionally releases the result's own connection reference on the prepare-EOF path. Before PHP 7.4 (upstream f365d0e00ed93b1c33e984ff3b4cc8677cbca193) free_result_contents() did not drop it, so that path leaked one reference. The sibling site in mysqlnd_stmt store_result() leaks the same reference but is not made reachable by this change and is left for a separate one. - CVE-2025-1218