GmpAutomaticBaseChangesDecimalInput

warning native off by default quick-fix

Group: Probable bugs

Specify decimal base for zero-prefixed GMP input. This inspection is disabled by default; enabling it selects the stated policy.

Example

<?php
$n = gmp_init('024');

Reported:

• line 2: Specify decimal base for zero-prefixed GMP input.

Detection

• gmp_init receives a valid digit-only constant string with leading zero, an omitted or zero base, and octal interpretation differs from decimal interpretation. Enabling selects decimal-input policy. Exclude all-zero strings and 0x/0b prefixes.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• A variable argument is not reported when its assigned literal may be stale at the call: the variable, or a variable whose value was copied into it, is changed by ++ or --, is bound by a catch clause, is captured by reference in a closure use list, or is stored by reference in an array item; or the enclosing scope calls extract() or one-argument parse_str(). A file-level variable is also a global, so a global declaration naming it, or any $GLOBALS access in the file, has the same effect.
• Both @custos-ignore GmpAutomaticBaseChangesDecimalInput and @noinspection GmpAutomaticBaseChangesDecimalInput suppress this native rule.

Fix

Append base 10 to a one-argument gmp_init call, or replace an explicit literal zero base with 10. Withhold for unpacking, unsupported named arguments, or comments inside the replacement range.

The fix is offered only when the argument expression itself fixes the digits: a string literal, a constant, or a class constant named through a fixed class. When the digits are read from a variable, or from a static:: constant that a subclass may redefine, the finding is reported without a fix, because an explicit decimal base makes gmp_init throw on a value that turns out to carry a 0x or 0b prefix.

Use exact byte edits and preserve comments, evaluation count, argument order and supported PHP syntax. Withhold the fix whenever its prerequisites cannot be proven.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "GmpAutomaticBaseChangesDecimalInput": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore GmpAutomaticBaseChangesDecimalInput