- CVE-2025-1218: various packet over-reads in the mysqlnd wire protocol. The packet readers decoded fields out of a server response before checking that the packet still held the bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer with a truncated packet. BAIL_IF_NO_MORE_DATA, which only noticed an over-read after it had happened, is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n), which checks before the read; php_mysqlnd_net_field_length() and its _ll variant now take the number of bytes left and refuse to decode a length whose payload is not fully present; the auth-plugin-name branches in auth_response_read, chg_user_read and cached_sha2_result_read use memchr() instead of trusting a NUL terminator (the latter two read into buffers nothing zero-terminates); the greeting's server version string is read the same way; and the TIME, DATE and DATETIME readers stop decoding fixed offsets out of a shorter declared length (GHSA-r6x9-5r99-36j7, upstream 114dbb7436). - The mysqlnd_ps.c hunk is a leak fix, not a memory-safety one: it releases the connection reference and the execute command buffer before mysqlnd_stmt_prepare_read_eof() memsets the statement, a path that only becomes reachable now that a short EOF packet is rejected. The prepare_read and sha256_pk_request_response_read changes are hardening rather than memory safety - prepare_read's new byte counts provably cannot fire behind the PREPARE_RESPONSE_SIZE gate in front of them, and the sha256 one is a strictness change. - Not applicable on 5.5: MARIADB_RPL_VERSION_HACK does not exist here, and upstream's two-byte look-ahead in cached_sha2_result_read guards a packet->result read that this branch's caching_sha2_password backport never added (the one-byte read it does have is guarded instead). The ps_codec helper trio and the text-row packet_end guard came in with our CVE-2024-8929 backport, so this patch extends them. As a prerequisite the bounded form of the greeting's auth plugin name from php-8.1.34 is carried too, without which dropping the NUL-terminating hack would make that estrdup() an unbounded read off a 2048 byte stack buffer. - Upstream's 38 phpt tests are not carried: they need the PHP 8 fake_server.inc, and the RPM test suite runs in the build-cgi tree, which is built without mysqli/mysqlnd, so every ext/mysqli test skips there. - The same mysqlnd_ps.c hunk also corrects that path's result free from mnd_efree() to upstream's php-7.0 form, mnd_pefree(stmt->result, stmt->result->persistent): mysqlnd_result_init() allocates the result with mnd_pecalloc(..., persistent), so on a persistent connection the Zend allocator was being handed a malloc()ed block. Before the change a hostile prepare over p:127.0.0.1 aborts with "zend_mm_heap corrupted" on a build with the Zend MM heap checks compiled in; after it the same run completes, and a non-persistent connection is unaffected either way - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 2 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11 - mysqlnd: initialise every pre-allocated row field before decoding (php-5.5.38-mysqlnd-rowp-init-fields.patch). The row readers pre-allocate a zval per column with MAKE_STD_ZVAL(), which sets no type, and only type it when the decode loop reaches that column; the CVE-2024-8929 error paths abandon a row part-way, leaving the rest allocated but never typed, and the result set still frees the whole row at teardown. Each column is now ZVAL_NULL()ed at allocation. Verified with valgrind under USE_ZEND_ALLOC=0. PHP 5 only, and kept separate from the CVE patch because the defect predates it and is reachable without it