* SECURITY UPDATE: various packet over-reads in the mysqlnd wire protocol - debian/patches/php-5.5-CVE-2025-1218.patch: backport upstream commit 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2 to ext/mysqlnd. The packet readers decoded fields out of a server response before checking that the packet still held the bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer with a truncated packet. BAIL_IF_NO_MORE_DATA, which only noticed an over-read after it happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n), which checks before the read; php_mysqlnd_net_field_length() and its _ll variant now take the number of bytes left and refuse to decode a length whose payload is not fully present; the auth-plugin-name branches in auth_response_read, chg_user_read and cached_sha2_result_read use memchr() instead of trusting a NUL terminator (chg_user_read and cached_sha2_result_read read into buffers nothing zero-terminates, so strlen() there could run off the end); the greeting's server version string is read the same way; and the TIME, DATE and DATETIME readers in mysqlnd_ps_codec.c stop decoding fixed offsets out of a shorter declared length. The mysqlnd_ps.c hunk is a leak fix, not a memory-safety one: it releases the connection reference and the execute command buffer before mysqlnd_stmt_prepare_read_eof() memsets the statement, a path that only becomes reachable now that a short EOF packet is rejected. The prepare_read and sha256_pk_request_response_read changes are hardening rather than memory safety - prepare_read's new byte counts provably cannot fire behind the PREPARE_RESPONSE_SIZE gate that precedes them, and the sha256 one is a strictness change. Two parts of the upstream fix have no call site on this branch: MARIADB_RPL_VERSION_HACK does not exist here, and upstream's two-byte look-ahead in cached_sha2_result_read guards a "packet->result" read that the caching_sha2_password backport on this branch never added - the one-byte read it does have is guarded instead. The ps_codec helper trio and the text-row packet_end guard that upstream only gained in 8.1.34 were already brought in by our CVE-2024-8929 backport, so this patch extends them. As a prerequisite, the bounded form of the greeting's auth plugin name from php-8.1.34 is carried as well (upstream d37a20c4a24a70dbbcfd8724cd2ad5f1b005bd2a, never backported here): without it, deleting the NUL-terminating hack as upstream does would turn that estrdup() into an unbounded read off a 2048 byte stack buffer. Upstream's 38 phpt tests are not carried - they need the PHP 8 ext/mysqli/tests/fake_server.inc, and the RPM test suite runs in the build-cgi tree, which is configured without mysqli/mysqlnd, so every ext/mysqli test skips there. - The same hunk also corrects that path's result free from mnd_efree() to upstream's php-7.0 form, mnd_pefree(stmt->result, stmt->result->persistent), since mysqlnd_result_init() allocates the result with mnd_pecalloc(..., persistent) and a persistent connection therefore gave the Zend allocator a malloc()ed block; before the change a hostile prepare over p:127.0.0.1 aborts with "zend_mm_heap corrupted" on a build with the Zend MM heap checks compiled in, after it the same run completes - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 2 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - CVE-2025-1218 * mysqlnd: initialise every pre-allocated row field before decoding - debian/patches/php-5.5.38-mysqlnd-rowp-init-fields.patch: the binary- and text-protocol row readers pre-allocate a zval per column with MAKE_STD_ZVAL(), which sets no type, and only type it when the decode loop reaches that column. The CVE-2024-8929 error paths abandon a row part-way, so every column past the failure point stays allocated but never typed, and the result set still frees the whole row at teardown - _zval_ptr_dtor() then branches on an uninitialised Z_TYPE. Each column is now ZVAL_NULL()ed at allocation. Confirmed with valgrind under USE_ZEND_ALLOC=0: the CVE-2024-8929 and CVE-2025-1218 stmt-row tests go from 1 uninitialised-value error to 0. PHP 5 only - from PHP 7 the row is a caller-owned array that mysqlnd_store_result() memset()s to zero. Kept separate from the CVE patch because the defect predates it and is reachable without it