- CVE-2025-1218: various out-of-bounds reads in the mysqlnd wire-protocol parser (ext/mysqlnd/mysqlnd_wireprotocol.c, mysqlnd_wireprotocol.h, mysqlnd_ps_codec.c, mysqlnd_ps.c; GHSA-r6x9-5r99-36j7). The parser read fields out of a server packet before checking that the packet still held enough bytes, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer. Backport of upstream commit 114dbb74368e: BAIL_IF_NO_MORE_DATA, which noticed an over-read only after it had happened, is replaced by the BAIL_PREMATURE_END / BAIL_IF_NOT_ENOUGH_DATA_EX family; php_mysqlnd_net_field_length() and its _ll() variant take the remaining packet size and report MYSQLND_INVALID_NET_FIELD_LENGTH instead of blindly consuming 2, 3 or 8 bytes; the server version and the auth-switch plugin names are located with memchr() over the remaining bytes instead of strdup()/strlen(); and the greeting's fixed block and extended scramble, the result-set field metadata lengths, the in-row EOF marker, the text-protocol field lengths and the declared lengths of TIME/DATE/DATETIME all gain real bounds checks. - Prerequisite note: the CVE-2024-8929 backport already on this branch is what supplies the three mysqlnd_ps_codec.c over-read helpers, the packet_end guard and the fake_server.inc test harness that upstream's change builds on; none of it is in the 5.6.40 tarball. - php-5.6.40-caching-sha2-password.patch introduces php_mysqlnd_cached_sha2_result_read() here, so both of its over-reads are live and are fixed: an unbounded stack over-read of the auth-switch plugin name off a 2048-byte buffer that nothing NUL-terminates (whose result is handed to the caller, with a length that underflows into a large emalloc/memcpy), and a one-byte read past a one-byte packet for the second response code. This patch is therefore applied after the caching-sha2 patch, not alongside the other CVE patches. - The greeting's authentication plugin name is still read with an unbounded estrdup() on 5.6.40, so php-8.1.34's bounded form is carried as a prerequisite before upstream's removal of the "buf[header.size] = 0" hack, which on its own would have turned a terminated read into an unbounded one. - Honest scope: php_mysqlnd_prepare_read() and php_mysqlnd_sha256_pk_request_response_read() are hardening, not memory-safety fixes - behind the existing PREPARE_RESPONSE_SIZE gate the new prepare_read checks cannot fire - and the mysqlnd_ps.c hunk is a leak fix on the newly reachable failure path, not an over-read. - Not applicable on this branch: upstream's guard around MARIADB_RPL_VERSION_HACK, which does not exist here. Upstream's rejection of any "def" value in the result-set field packet is deliberately not taken, because COM_FIELD_LIST is still supported on 5.6; the existing def bounds check is kept and only given the remaining size. - Upstream's 38 regression tests are NOT carried: they drive the dynamic-port fake server upstream added in the same commit, while the harness this branch has (ext/mysqli/tests/fake_server.inc, from the CVE-2024-8929 backport) binds a fixed port, so carrying them means rewriting all 38 and dropping the address assertion. Nothing would run them either way - the spec runselftest toggle defaults to 0 and debian/rules runs no suite. They were run locally instead, on a tree built from this repository's own patch series, first patched and then with only the C hunks of this patch reversed out and rebuilt: 32 of 38 pass patched / 0 fail, against 8 of 38 pass unpatched / 24 fail. The 6 skips in both arms are the cached-sha2 and sha256-pk tests, which need an ext/openssl this build did not have, PHP 5.6's openssl extension not compiling against OpenSSL 3 - The same mysqlnd_ps.c hunk also corrects that path's result free from mnd_efree() to upstream's php-7.0 form, mnd_pefree(stmt->result, stmt->result->persistent): mysqlnd_result_init() allocates the result with mnd_pecalloc(..., persistent), so on a persistent connection the Zend allocator was being handed a malloc()ed block. Before the change a hostile prepare over p:127.0.0.1 aborts with "zend_mm_heap corrupted" on a build with the Zend MM heap checks compiled in; after it the same run completes, and a non-persistent connection is unaffected either way - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 2 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11 - The mysqlnd_ps.c hunk additionally releases the result's own connection reference on the prepare-EOF path: before PHP 7.4 (upstream f365d0e00ed9) free_result_contents() did not drop it, so that path leaked one reference - mysqlnd: initialise every pre-allocated row field before decoding (php-5.6.40-mysqlnd-rowp-init-fields.patch). The row readers pre-allocate a zval per column with MAKE_STD_ZVAL(), which sets no type, and only type it when the decode loop reaches that column; the CVE-2024-8929 error paths abandon a row part-way, leaving the rest allocated but never typed, and the result set still frees the whole row at teardown. Each column is now ZVAL_NULL()ed at allocation. Verified with valgrind under USE_ZEND_ALLOC=0. PHP 5 only, and kept separate from the CVE patch because the defect predates it and is reachable without it