phanalist

E0037: String Offset Out of Bounds

E0037 reports string offsets that can be out of bounds. It is the string-offset member of Phanalist’s bounded formal verification family (E0031-E0043). The family shares a Z3-backed engine that encodes path conditions and values, so a finding comes with a solver-backed counterexample rather than a heuristic guess.

What it checks

• Negative and out-of-bounds string offsets
• Literal strings and documented non-empty-string values
• Lengths derived from strlen(), str_repeat() with a literal repetition count, substr() using PHP’s offset and length rules, str_split() using a literal chunk size, and str_pad() with a literal non-empty pad string
• Symbolic offsets and guards in branches and short-circuit conditions
• Offsets that cannot be modeled report unverified under unknown_policy: report

Model limits

E0037 shares the model limits, loop bounds, and interprocedural behavior described in E0031.

Configuration

rules:
  E0037:
    php_version: "8.4"
    check_string_offset: true

See E0031 for the shared model limits, unknown_policy behavior, and per-code configuration.

This site is open source. Improve this page.