[php-src] PR #24432: Fix GH-23956: Regression with MySQL 4.1 after mysqlnd security fix

From: Date: Mon, 19 Oct 2026 13:20:47 +0000
Subject: [php-src] PR #24432: Fix GH-23956: Regression with MySQL 4.1 after mysqlnd security fix
Groups: php.git-pulls 
Request: Send a blank email to git-pulls+get-39594@lists.php.net to get a copy of this message
Pull Request: https://github.com/php/php-src/pull/24432 Author: jeroenvdkolff Fixes GH-23956 Since the fix for GHSA-r6x9-5r99-36j7, PHP can no longer run queries on a MySQL 4.1 server. You get "Premature end of data" and "EOF packet shorter than expected". **Cause** MySQL 4.1 sometimes sends an EOF packet of only 1 byte. The code already has a branch to handle this (the else in php_mysqlnd_eof_read()). But the new check BAIL_IF_NOT_ENOUGH_DATA after p++ requires at least 2 bytes. The old BAIL_IF_NO_MORE_DATA did not require that. So that branch can no longer be reached. The same happens in php_mysqlnd_auth_response_read() with a 1-byte 0xFE packet. There it only adds two extra warnings before the normal "old insecure authentication" error. **Fix** I moved the check into the ERROR_MARKER branch, because that is the only branch that reads more data. The other checks from the security fix are not changed. **Tests** - Two new fake-server tests: gh23956.phpt (1-byte EOF) and gh23956_2.phpt (1-byte auth response). Both fail without the fix and pass with it. - All existing fake-server tests still pass, including all ghsa-r6x9-5r99-36j7-* tests. - I also tested against a real MySQL 4.1.11 server (Docker image oblakstudio/mysql41). Queries, prepared statements and PDO work again. With the full ext/mysqli and ext/pdo_mysql test suites, 421 tests that failed before no longer fail. Six tests could not run before, because their SKIPIF crashed on this bug. Now they run, but fail because of MySQL 4.1 limitations (no SSL, older SQL syntax, older transaction behaviour). This does not affect modern MySQL or MariaDB versions. **Note** I am not a C developer, and I made this fix with help from an AI assistant. I did test it myself, as described above. I am happy to change anything, or to move the PR to another branch if needed.

« previous php.git-pulls (#39594) next »