ContentRangeLengthMismatch

warning native on by default

Group: Probable bugs

Match the body to the inclusive byte range.

Example

Finding:

<?php
http_response_code(206); header("Content-Range: bytes 0-4/20"); echo "four"; exit;

Reported:

• line 2: Match the body to the inclusive byte range.

Detection

• Track effective Content-Range bytes START-END/TOTAL (decimal numeric bounds, valid single range) and a proven status 206. Report the range header when complete emitted constant bytes differ from END - START + 1. Support repeated literal concatenations and constant-folded str_repeat. Use the same complete response-path proof and invalidations as ContentLengthKnownBodyMismatch.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias or unknown call involving the tracked value. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Redirect Location and CGI Status headers can change response status implicitly; exclude their body proof.

• Multipart ranges, unknown output, malformed ranges, unsatisfied bytes */TOTAL, buffering/transformation, HEAD and incomplete response paths are excluded.

• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

PHP versions

Available throughout PHP 5.3–8.5.

Configure

In custos.json:

{
  "rules": {
    "ContentRangeLengthMismatch": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ContentRangeLengthMismatch