XmlParserNeverReceivesFinalChunk

warning native on by default

Group: Probable bugs

Identify xml_parser_free on a locally created parser after at least one xml_parse call, with no xml_parse true final argument and no xml_parse_into_struct completion. Unknown parser aliases or paths exclude.

Detection

• Report xml_parser_free on a locally created parser after at least one xml_parse call, with no xml_parse true final argument and no xml_parse_into_struct completion. Unknown parser aliases or paths exclude.
• Resolve builtin functions, classes, constants and methods, including imports and supported named arguments. Follow only bounded local facts within one lexical scope. Receiver and argument provenance must establish the specific API contract; variable names and comments never prove intent.
• Report one finding per violating operation. A reachable path, unchanged value identity and applicable API behavior are required. Intervening mutation, unknown calls involving tracked values, escaped aliases or exhausted analysis budgets invalidate proof.
• Handing the parser to other code before the free excludes the report, because the callee may send the final chunk itself. This covers the parser appearing anywhere in the arguments of a method call (including nullsafe), a static call, a constructor call or a function that is not an available builtin, also when the call sits in an arrow function of the same scope. Only the scope that contains the free is searched; other functions, methods and closures have their own variables. A builtin call nested in such arguments (for example reading the current line number for a log call) only reads the parser and does not exclude.

Exceptions (no report)

• Exclude unresolved required symbols, user-defined lookalikes, incomplete syntax, unknown required values and unsupported versions.
• Both @custos-ignore XmlParserNeverReceivesFinalChunk and @noinspection XmlParserNeverReceivesFinalChunk suppress this native rule.

Fix

None. A repair requires a semantic decision or application error-handling policy.

PHP versions

Available in PHP 5.3–8.5 where the referenced API exists. Do not apply extension contracts when the resolved API is unavailable. Gate syntax and version-specific behavior to the configured target.

Configure

In custos.json:

{
  "rules": {
    "XmlParserNeverReceivesFinalChunk": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore XmlParserNeverReceivesFinalChunk