* SECURITY UPDATE: out-of-bounds reads in the mysqlnd wire-protocol parser when a malicious or compromised MySQL server sends a truncated packet - debian/patches/php-5.3-CVE-2025-1218.patch: re-implementation, against the PHP 5.3 mysqlnd sources, of upstream commit 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2 (GHSA-r6x9-5r99-36j7, released in php-8.2.34 / php-8.3.34). The upstream diff does not apply to 5.3 in any form, so every bound was re-derived from 5.3's own bookkeeping. BAIL_IF_NO_MORE_DATA only noticed an over-read after it had happened; it is replaced by BAIL_PREMATURE_END / BAIL_IF_NOT_ENOUGH_DATA_EX(n), which refuse the read up front. php_mysqlnd_net_field_length() and php_mysqlnd_net_field_length_ll() are given the number of bytes still left in the packet and report an unreadable length encoding instead of reading it; all ten call sites in mysqlnd_wireprotocol.c and all five in mysqlnd_ps_codec.c were converted. Memory-safety fixes: the greeting's server version string, which was read with estrdup() off a 2048-byte stack buffer with no terminator guarantee at all on this branch, is now bounded with memchr()+estrndup(); the greeting's 31-byte fixed block and the second half of its scramble are bounded; the OK and result-set header packets' affected_rows, last_insert_id, server_status and warning_count; the EOF packet's 4 trailing bytes; the in-row EOF marker, which accepted a 2-byte row packet as a 5-byte EOF; the result-set field metadata lengths, which were only rejected on MYSQLND_NULL_LENGTH and so leaked heap bytes into user-visible column metadata; the text-protocol row field lengths; and ps_fetch_time()/ps_fetch_date()/ ps_fetch_datetime(), which read fixed offsets regardless of the length the server declared for the field. HARDENING ONLY, not memory safety: the two new checks in php_mysqlnd_prepare_read() provably cannot fire behind the existing PREPARE_RESPONSE_SIZE gate. The mysqlnd_ps.c change is a memory LEAK fix on the prepare-EOF failure path, which the new checks make reachable, not an over-read. Large parts of the upstream commit have no counterpart on this branch and are deliberately absent: php_mysqlnd_auth_response_read(), php_mysqlnd_sha256_pk_request_response_read() and php_mysqlnd_cached_sha2_result_read() do not exist at 5.3, php_mysqlnd_chg_user_read() has no 0xFE auth-switch branch, and the greeting reader has no MARIADB_RPL_VERSION_HACK, no auth_protocol and no pluggable-auth scramble. The 38 upstream .phpt tests are not carried: the fake_server.inc they drive needs PHP 8.0 syntax to run, and most of them exercise packet types that do not exist here. The C fix ships without tests. - The same hunk also corrects that path's result free from mnd_efree() to upstream's php-7.0 form, mnd_pefree(stmt->result, stmt->result->persistent), since mysqlnd_result_init() allocates the result with mnd_pecalloc(..., persistent) and a persistent connection therefore gave the Zend allocator a malloc()ed block; before the change a hostile prepare over p:127.0.0.1 aborts with "zend_mm_heap corrupted" on a build with the Zend MM heap checks compiled in, after it the same run completes - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 2 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - CVE-2025-1218 * mysqlnd: initialise every pre-allocated row field before decoding - debian/patches/php-5.3.29-mysqlnd-rowp-init-fields.patch: the binary- and text-protocol row readers pre-allocate a zval per column with MAKE_STD_ZVAL(), which sets no type, and only type it when the decode loop reaches that column. The CVE-2024-8929 error paths abandon a row part-way, so every column past the failure point stays allocated but never typed, and the result set still frees the whole row at teardown - _zval_ptr_dtor() then branches on an uninitialised Z_TYPE. Each column is now ZVAL_NULL()ed at allocation. Confirmed with valgrind under USE_ZEND_ALLOC=0: the CVE-2024-8929 and CVE-2025-1218 stmt-row tests go from 1 uninitialised-value error to 0. PHP 5 only - from PHP 7 the row is a caller-owned array that mysqlnd_store_result() memset()s to zero. Kept separate from the CVE patch because the defect predates it and is reachable without it