BufferedWriteFlushedAfterUnlock

warning native on by default

Group: Probable bugs

Identify fflush after proven fwrite on the same exclusively locked stream when LOCK_UN occurs between write and flush and no intervening flush or close occurred.

Detection

• Report fflush after proven fwrite on the same exclusively locked stream when LOCK_UN occurs between write and flush and no intervening flush or close occurred.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values or escaped aliases invalidate proof. When the proof is inconclusive, nothing is reported.
• D4. The stream must be a plain local variable whose only route to other code is the stream slot of the tracked builtin calls. The handle escapes, and nothing is reported, when a closure of the same scope lists it in use, when an arrow function of the same scope mentions it, or when it is passed before the flush as any other argument of a function, method, static or constructor call: such code can flush or close the stream while the lock is still held.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• No report when the handle escapes as described in D4, or when the stream is a variable variable ($$name), which identifies no single handle.
• Both @custos-ignore BufferedWriteFlushedAfterUnlock and @noinspection BufferedWriteFlushedAfterUnlock suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "BufferedWriteFlushedAfterUnlock": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore BufferedWriteFlushedAfterUnlock