ZipEntryIndexPastEnd

warning native on by default PHP ≥ 5.3

Group: Probable bugs

Use an existing ZIP entry index.

Example

<?php
$z=new ZipArchive(); $z->getNameIndex($z->numFiles);

Reported:

• line 2: Use an existing ZIP entry index.

Detection

• Report a resolved ZIP indexed operation with a proven negative index, or an index directly equal to that same receiver numFiles property. Support getNameIndex, statIndex, getFromIndex, deleteIndex and getStreamIndex. Other inferred counts and unknown indices are excluded.
• Resolve builtin functions, extension classes, method receivers, constants and named arguments. Follow unchanged locals and aliases only within the same bounded lexical scope. Require a reachable path; merge branch facts only when all incoming paths establish them.
• Emit one finding at the violating operation, not one per evidence statement. Rebinding, writes, by-reference escape, unresolved calls that can mutate relevant state, and exhausted analysis budgets remove proof.
• A negative index is proven only by an integer literal, a resolved constant, or a local variable whose reaching value is such a literal. A variable is not proof when it, or a variable it was copied from through plain assignments, is the target of ++ or -- anywhere in the enclosing function (including an arrow function around the call), or is captured by reference by a closure. A property or static property is never proof: its declared default says nothing about the value at the call.

Exceptions (no report)

• Exclude shadowed builtins, unresolved receivers, incomplete syntax and unknown prerequisite facts. An extension function name alone does not prove an application function is that builtin.
• A dominating valid guard or repair described in Detection prevents the finding. Both legacy noinspection and custos-ignore forms suppress this ID.
• Counter idioms that start below zero are valid: $i = -1; while (++$i < $z->numFiles) { $z->getNameIndex($i); }, $i = -1; do { $i++; ... } while (...), and a cursor object whose position property defaults to -1 and is advanced before each read.

Fix

No automatic fix. The required repair depends on error handling, data selection, lifecycle ordering or application policy.

All edits use exact byte ranges and preserve comments and evaluation order. Offer no fix when its stated prerequisites cannot be proven or the replacement is unsupported by the configured PHP version.

PHP versions

Requires PHP 5.3 or later and the referenced extension API. Respect method-specific introduction versions within PHP 5.3–8.5; unsupported optional APIs cannot establish facts. Named arguments require PHP 8.0 or later.

Configure

In custos.json:

{
  "rules": {
    "ZipEntryIndexPastEnd": {
      "enabled": false
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore ZipEntryIndexPastEnd