- CVE-2025-1218: packet over-reads in the mysqlnd wire-protocol parser - the greeting, auth response, OK, EOF, result-set header, result-set field, row and prepare readers decoded fields out of a server packet before checking that the packet still held enough bytes for them, so a malicious or compromised MySQL server could make the client read past the end of the packet buffer, leak heap bytes into user-visible result-set metadata, or allocate and copy a huge attacker-chosen length; php_mysqlnd_net_field_length() and its _ll variant now take the remaining packet size and refuse lengths whose payload is not present, the BAIL_IF_NO_MORE_DATA macro that only noticed an over-read after the fact is replaced by BAIL_IF_NOT_ENOUGH_DATA_EX(n), the unterminated auth-plugin-name branches use memchr() instead of trusting a NUL terminator, and the TIME/DATE/DATETIME prepared-statement readers stop decoding fixed offsets out of a shorter declared length (backport of upstream 114dbb74368e6a6cd6e48ddb4a76dbe8728b84e2, with upstream d37a20c4a24a70dbbcfd8724cd2ad5f1b005bd2a carried as a prerequisite because the fix removes the greeting buffer's NUL terminator; the php_mysqlnd_prepare_read() and php_mysqlnd_sha256_pk_request_response_read() hunks are hardening rather than memory-safety fixes, and the mysqlnd_ps.c hunk is a memory-leak fix on a newly reachable failure path) - Also fixes a pre-existing use-after-free on the row-reader failure path: the CVE-2024-8929 error loops free every field decoded so far without clearing the zvals, and the result set frees them again at teardown. All 3 sites now clear after freeing. Confirmed under AddressSanitizer with the Zend allocator disabled - heap-use-after-free before, clean after, on the three new short-length tests and the nine CVE-2024-8929 stmt-row tests. Upstream still carries the same loops unguarded in php-8.2.34 through php-8.5.11 - The mysqlnd_ps.c hunk additionally releases the result's own connection reference on the prepare-EOF path: before PHP 7.4 (upstream f365d0e00ed9) free_result_contents() did not drop it, so that path leaked one reference