* SECURITY UPDATE: various out-of-bounds reads in the mysqlnd wire protocol parser - debian/patches/php-5.4-CVE-2025-1218.patch: backport upstream commit 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2 to ext/mysqlnd. The packet readers decoded fields out of a server response before checking that the packet still held enough bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer with a truncated packet. BAIL_IF_NO_MORE_DATA, which only noticed an overread after it had happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n), which checks before the read; php_mysqlnd_net_field_length() and its _ll variant gain a remaining_size argument and refuse to decode a length whose payload is not present; the auth-plugin-data branches of greet_read, auth_response_read and chg_user_read use memchr() instead of trusting a NUL terminator; and ps_fetch_time/date/datetime stop reading fixed offsets out of a shorter declared length. - Two items in the upstream commit are hardening rather than memory safety and are labelled as such in the patch: the prepare_read() size checks cannot fire behind the existing PREPARE_RESPONSE_SIZE gate, and the mysqlnd_ps.c hunk is a leak fix on the failure path the rest of the change makes reachable, not an overread fix. - Not applicable on this branch, because the code does not exist at 5.4: the MARIADB_RPL_VERSION_HACK guard in greet_read (macro absent), and the cached_sha2_result_read and sha256_pk_request_response_read hunks (both functions absent; this repo carries no caching-sha2 backport). - php-5.4-CVE-2024-8929.patch already supplies the mysqlnd_ps_codec.c helper trio and the text-row packet_end bound this change builds on. Deleting upstream's greet_read NUL-terminator hack would have left 5.4's still-unbounded auth_protocol estrdup() reading off the 2048-byte stack buffer, so the bounded form from upstream d37a20c4a24a70dbbcfd8724cd2ad5f1b005bd2a is carried as part of this patch. - Upstream's 38 regression tests are not carried: they need the PHP 8 fake_server.inc extension from the same commit rewritten for 5.4, and this package's rpm check stage runs harvested .phpt files in a build tree configured without mysqli, where they could only skip or fail. - The same hunk also corrects that path's result free from mnd_efree() to upstream's php-7.0 form, mnd_pefree(stmt->result, stmt->result->persistent), since mysqlnd_result_init() allocates the result with mnd_pecalloc(..., persistent) and a persistent connection therefore gave the Zend allocator a malloc()ed block; before the change a hostile prepare over p:127.0.0.1 aborts with "zend_mm_heap corrupted" on a build with the Zend MM heap checks compiled in, after it the same run completes - Also fixes a pre-existing use-after-free on the row-reader failure path. The CVE-2024-8929 backport added error loops in the binary- and text-protocol row readers that zval_ptr_dtor() every field decoded so far and return FAIL without clearing the zvals, so the result set frees the same zvals again when it is torn down. The loops were already reachable before this change; the new too-short TIME/DATE/DATETIME check adds a second way in. All 2 sites now clear the zval after freeing it. Confirmed under AddressSanitizer with the Zend allocator disabled: heap-use-after-free in mysqlnd_result_buffered_zval free_result before, clean after, on both the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11; php-8.1 is not affected. - CVE-2025-1218 * mysqlnd: initialise every pre-allocated row field before decoding - debian/patches/php-5.4.45-mysqlnd-rowp-init-fields.patch: the binary- and text-protocol row readers pre-allocate a zval per column with MAKE_STD_ZVAL(), which sets no type, and only type it when the decode loop reaches that column. The CVE-2024-8929 error paths abandon a row part-way, so every column past the failure point stays allocated but never typed, and the result set still frees the whole row at teardown - _zval_ptr_dtor() then branches on an uninitialised Z_TYPE. Each column is now ZVAL_NULL()ed at allocation. Confirmed with valgrind under USE_ZEND_ALLOC=0: the CVE-2024-8929 and CVE-2025-1218 stmt-row tests go from 1 uninitialised-value error to 0. PHP 5 only - from PHP 7 the row is a caller-owned array that mysqlnd_store_result() memset()s to zero. Kept separate from the CVE patch because the defect predates it and is reachable without it