* SECURITY UPDATE: packet over-reads in the mysqlnd wire-protocol parser - debian/patches/php-7.1-CVE-2025-1218.patch: the greeting, auth response, OK, EOF, result-set header, result-set field, row, prepare and backported caching_sha2 readers decoded fields out of a server packet before checking that the packet still held enough bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer by sending a truncated packet. The consequences range from a crash to heap bytes leaking into user-visible result-set metadata (field catalog/db/table/name), and in the auth-switch branches a length that underflows to SIZE_MAX and is then handed to emalloc()/memcpy(). php_mysqlnd_net_field_length() and its _ll variant now take the number of bytes left in the packet and refuse encoded lengths whose payload is not fully present, returning the new MYSQLND_INVALID_NET_FIELD_LENGTH sentinel without advancing the read pointer; the BAIL_IF_NO_MORE_DATA macro, which only noticed an over-read after it had already happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n), which checks before the bytes are read; the unterminated auth-plugin-name branches use memchr() instead of trusting a NUL terminator; and mysqlnd_ps_codec.c gains ps_fetch_is_length_too_short() so the TIME, DATE and DATETIME prepared-statement readers stop decoding fixed offsets out of a shorter declared length. This is a backport of upstream 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2. Upstream d37a20c4a24a70dbbcfd8724cd2ad5f1b005bd2a is carried as a prerequisite: the fix deletes the greeting buffer's NUL terminator, which would turn this branch's unbounded estrdup() of the auth plugin name into a stack over-read, so that commit's bounded form is backported with it. Two of the hunks are hardening rather than memory-safety fixes: php_mysqlnd_prepare_read() cannot violate the bounds it now checks behind the PREPARE_RESPONSE_SIZE gate that already guards it, and the php_mysqlnd_sha256_pk_request_response_read() hunk is a strictness change. The mysqlnd_ps.c hunk is a memory-leak fix: it releases the connection reference and the execute command buffer on the failure path in mysqlnd_stmt_prepare_read_eof() that the new checks make reachable, before the memset() that resets the statement. Upstream's 38 regression tests are NOT carried: they drive the dynamic-port fake server upstream added in the same commit, while the harness this package ships in ext/standard/tests/mysqli/ binds a fixed port, and nothing in this package runs the suite anyway. They were run locally instead, on a tree built from this repository's own patch series, first patched and then with only the C hunks of this patch reversed out and rebuilt: 38 of 38 pass patched, 0 fail; 9 of 38 pass unpatched, 29 fail. - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 3 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - The mysqlnd_ps.c hunk additionally releases the result's own connection reference on the prepare-EOF path. Before PHP 7.4 (upstream f365d0e00ed93b1c33e984ff3b4cc8677cbca193) free_result_contents() did not drop it, so that path leaked one reference. The sibling site in mysqlnd_stmt store_result() leaks the same reference but is not made reachable by this change and is left for a separate one. - CVE-2025-1218