CompressionDecoderFormatMismatch

warning native on by default quick-fix PHP ≥ 5.3

Group: Probable bugs

Match the decoder to the compression format.

Example

<?php
gzuncompress(gzencode("sample payload"));

Reported:

• line 2: Match the decoder to the compression format.

Detection

• Compare resolved gzip/zlib/raw encoders and decoders through direct nesting or unchanged locals. Report gzencode input to gzuncompress/gzinflate, gzcompress input to gzdecode/gzinflate, or gzdeflate input to gzdecode/gzuncompress. Encoders with a third explicit format argument and manually transformed bytes remain unknown.
• Resolve builtin functions, extension classes, method receivers, constants and named arguments. Follow unchanged locals and aliases only within the same bounded lexical scope. Require a reachable path; merge branch facts only when all incoming paths establish them.
• Emit one finding at the violating operation, not one per evidence statement. Rebinding, writes, by-reference escape and unresolved calls that can mutate relevant state remove proof. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

An explicit encoding argument stays unknown whether positional or named. An encoder called with unpacked arguments (gzencode(...$args)) is unknown too, because the spread may carry the encoding. A local captured by reference by a closure of the same scope (use (&$bytes)), or by the closure the decoder itself sits in, is unknown: calling the closure may replace the bytes. The same holds for a local assigned from such a variable ($copy = $bytes;). The replacement decoder must exist in the target version; gzdecode is unavailable on PHP 5.3, so that finding has no automatic fix.

• Exclude shadowed builtins, unresolved receivers, incomplete syntax and unknown prerequisite facts. An extension function name alone does not prove an application function is that builtin.
• A dominating valid guard or repair described in Detection prevents the finding. Both legacy noinspection and custos-ignore forms suppress this ID.

Fix

Replace only the resolved decoder function name: gzencode→gzdecode, gzcompress→gzuncompress, gzdeflate→gzinflate. Preserve namespace syntax; omit if a matching replacement builtin is shadowed.

All edits use exact byte ranges and preserve comments and evaluation order. Offer no fix when its stated prerequisites cannot be proven or the replacement is unsupported by the configured PHP version.

PHP versions

Requires PHP 5.3 or later and the referenced extension API. Respect method-specific introduction versions within PHP 5.3–8.5; unsupported optional APIs cannot establish facts. Named arguments require PHP 8.0 or later.

Configure

In custos.json:

{
  "rules": {
    "CompressionDecoderFormatMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CompressionDecoderFormatMismatch