- CVE-2025-1218: bound every read in the mysqlnd wire-protocol parser so a malicious server cannot make the client read past the end of a packet; length-encoded prefixes, the greeting packet, auth-switch plugin names, the cached_sha2 result packet, result-set field metadata and the binary time/date/datetime fetchers are all checked against the declared size first - Carries, as a prerequisite, upstream's earlier bounding of the greeting packet's auth_protocol field, without which removing the NUL-terminator hack would have introduced an unbounded stack over-read - The prepare_read and sha256_pk_request_response_read changes are hardening, not memory-safety fixes; the mysqlnd_ps.c hunk is a leak fix - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 3 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11 - The mysqlnd_ps.c hunk additionally releases the result's own connection reference on the prepare-EOF path: before PHP 7.4 (upstream f365d0e00ed9) free_result_contents() did not drop it, so that path leaked one reference