CompressionLevelOutsideSupportedRange

error native on by default PHP ≥ 5.3

Group: Probable bugs

Use a supported compression level. Enabled by default; require positive semantic or local-flow proof.

Example

<?php
gzencode("sample",14);

Reported:

• line 2: Use a supported compression level.

Detection

• Report gzencode, gzcompress or gzdeflate level argument proven integer less than -1 or greater than 9. Skip unknown levels, default omission, and bzip2 APIs with different contracts.
• Resolve builtin functions, extension classes, method receivers, constants and named arguments. Follow unchanged locals and aliases only within the same bounded lexical scope. Require a reachable path; merge branch facts only when all incoming paths establish them.
• Emit one finding at the violating operation, not one per evidence statement. Rebinding, writes, by-reference escape and unresolved calls that can mutate relevant state remove proof. When the proof is inconclusive, nothing is reported.
• A level passed as a variable is proven only when that variable keeps its literal for the whole enclosing scope (function, method, closure or top-level code; nested function, closure and class bodies are not part of it). The same requirement applies to every variable it was copied from by a plain $copy = $source assignment.

Exceptions (no report)

• Exclude shadowed builtins, unresolved receivers, incomplete syntax and unknown prerequisite facts. An extension function name alone does not prove an application function is that builtin.
• A dominating valid guard or repair described in Detection prevents the finding. Both legacy noinspection and custos-ignore forms suppress this ID.
• No report for a variable level when, anywhere in the enclosing scope:
  • the variable is incremented or decremented ($level--, ++$level), wherever that happens relative to the call;
  • a closure imports it by reference (use (&$level)); an arrow function or a by-value import only works on a copy and keeps the proof;
  • a write names its target at run time: $$name--, a compound assignment to $$name, extract(), or parse_str();
  • the variable is shared with another scope (top-level code, global, static, a by-reference parameter, a by-reference import of the enclosing closure) and the scope also holds code able to run application logic: a call that is not a resolved builtin function, a method or static call, new, include/require, eval, or a closure or arrow function expression.

Fix

No automatic fix. The required repair depends on error handling, data selection, lifecycle ordering or application policy.

PHP versions

Requires PHP 5.3 or later and the referenced extension API. Respect method-specific introduction versions within PHP 5.3–8.5; unsupported optional APIs cannot establish facts. Named arguments require PHP 8.0 or later.

Configure

In custos.json:

{
  "rules": {
    "CompressionLevelOutsideSupportedRange": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore CompressionLevelOutsideSupportedRange