* SECURITY UPDATE: ext/pgsql and ext/pdo_pgsql ignored the error status of the libpq escaping helpers - debian/patches/php-5.6-CVE-2025-1735.patch: backport upstream commit 9376aeef9f8ff81f2705b8016237ec3e30bdee44 (GHSA-hrwm-9436-5mv3) in ext/pgsql/pgsql.c and ext/pdo_pgsql/pgsql_driver.c. Every PQescapeStringConn() call passed NULL for the "error" out-parameter and the pointers returned by PQescapeByteaConn() and PQescapeIdentifier() were used without a NULL check. libpq refuses to escape input that is not valid in the connection's client encoding - the PostgreSQL CVE-2025-1094 case - setting its error flag and leaving a mangled buffer behind, which PHP then used to build a query, so the caller had no way to learn the value was never escaped. The unchecked PQescapeIdentifier() returns are a NULL dereference: strlen(NULL) via smart_str_appends() in build_tablename(), memcpy() from NULL in the PDO quoter. Call sites covered: pg_escape_string(), pg_escape_bytea(), php_pgsql_meta_data(), php_pgsql_convert() (string, bytea and identifier paths), build_tablename(), php_pgsql_insert(), build_assignment_string() and pgsql_handle_quoter(). Confirmed on PostgreSQL 15.19 with a locally built 5.6.40: for the input "\xC3' OR 1=1 --" an unpatched pg_escape_string() returned "\xC0 '' OR 1=1 --" with no error of any kind, and pg_convert(), pg_insert() and PDO::quote() emitted that same mangled value into the generated SQL; with this patch all four report the failure and return false, while valid input is byte-identical to before. - Note: hand-ported to the PHP 5 zval API from the alt-php70 adaptation (Gerrit 269508) - 13 of the upstream commit's 22 hunks target the zend_string / zend_result / ZPP-exception APIs PHP 5 does not have. build_tablename() gains TSRMLS_DC and an int (SUCCESS/FAILURE) return, php_pgsql_convert() escapes into a local buffer and only populates the result zval once the escape succeeded so the existing error cleanup stays safe, php_pgsql_insert() fetches the current hash key so the diagnostic can name the field, and every error flag is initialised to 0 so the added checks cannot read uninitialised memory in the !HAVE_PQESCAPE_CONN build where PQescapeStringConn() is a macro that discards the error argument. - Adds ext/pgsql/tests/ghsa-hrwm-9436-5mv3.phpt, a PHP 5.6 replacement for the two upstream .phpt files, which rely on PHP 8 exception semantics. Like every other test in ext/pgsql/tests it skips unless PGSQL_TEST_CONNSTR points at a live server. ext/pgsql plus ext/pdo_pgsql: 140 passed and the same 3 pre-existing failures (bug48764, bug_33876, bug81720) before and after the patch. - CVE-2025-1735