phanalist

E0043: Stream Resource Used After Close

E0043 reports stream resources that are read, written, or closed after they have already been closed. It is the stream-lifecycle member of Phanalist’s bounded formal verification family (E0031-E0043). The family shares a Z3-backed engine that encodes path conditions and values.

What it checks

• fread() or fwrite() on a stream that was closed on every feasible path
• fread() or fwrite() on a stream that may have been closed on another path
• fclose() on a stream that was already closed, or may already have been closed
• Direct aliases created with $alias = $stream, because both names refer to the same tracked resource
• Branch and loop joins where one path closes the stream and another leaves it open; these produce a “may have been closed” finding
• Reopening a variable with another direct fopen() resets its lifecycle state

Model limits

E0043 tracks only resources assigned directly from fopen() and used directly by fclose(), fread(), or fwrite(). It assumes fopen() succeeds unless a later guard or contract narrows the value.

The following are not tracked and can cause missed findings:

• Resources returned by helpers, methods, or other functions
• Resources stored in object properties, array elements, or static properties
• Resources selected by a conditional expression or passed through an unmodeled wrapper
• Other stream operations such as fseek(), ftell(), fpassthru(), or stream_*() functions
• Stream wrappers, socket resources, and runtime-specific resource lifetimes

Unknown function, method, and static calls with a tracked stream argument invalidate that stream’s state, because the call may close it. This is conservative: it can miss a later use-after-close rather than report a false positive. Direct aliases share the same resource identity, but reassigning a reference alias to a different resource is not propagated back to the original name.

Configuration

rules:
  E0043:
    php_version: "8.4"

See E0031 for the shared model limits, unknown_policy behavior, and per-code configuration.

This site is open source. Improve this page.