UnpackBufferTooShort

warning native on by default

Group: Probable bugs

Provide enough bytes for the unpack format.

Example

<?php
$n = unpack('Nnumber', "\x01\x02");

Reported:

• line 2: Provide enough bytes for the unpack format.

Detection

• For constant unpack format, byte string and optional nonnegative offset, interpret widths and cursor moves and prove a required read exceeds available bytes. Supported widths: c/C one byte, n/v two bytes, N/V four bytes, J/P eight bytes, g/G four bytes, e/E eight bytes; a/A/Z byte counts and h/H nibble counts. Cursor directives x/X/@ update byte position. Unpack slash-separated field names do not consume bytes. A star read consumes only remaining bytes and does not itself establish underflow. Include network integer widths and fixed string counts; unsupported directives or platform-dependent widths invalidate proof. Exclude J/P before PHP 5.6, g/G/e/E before PHP 7.2, Z before PHP 5.5, and explicit offsets before PHP 7.1.
• Resolve builtin functions, extension classes, constants and method receivers, including aliases and supported named arguments. Inspect reachable operations in one lexical scope with bounded local flow.
• Emit one finding per violating operation. Never infer policy from names or comments. When the proof is inconclusive, nothing is reported.

Exceptions (no report)

• Exclude shadowed or unresolved symbols, incomplete code, unknown required constants, ambiguous receiver identity and unsupported versions. Reassignment, escaping aliases, and unknown calls invalidate dependent flow facts.
• Both @custos-ignore UnpackBufferTooShort and @noinspection UnpackBufferTooShort suppress this native rule.

Fix

None. A safe repair requires choosing values, error handling, or application behavior.

PHP versions

Apply throughout PHP 5.3–8.5 only where the extension API and syntax exist. Do not flag API unavailability through this rule.

Options

None. Use normal rule configuration to enable or disable the inspection.

Configure

In custos.json:

{
  "rules": {
    "UnpackBufferTooShort": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore UnpackBufferTooShort