phanalist

E0047: Resource Lifecycle Leak

E0047 reports function-scoped resources that are opened and never closed or transferred to another owner. It complements the verification rule E0043, which reports use-after-close and double-close on tracked streams.

What it checks

• fopen(), fsockopen(), pfsockopen(), stream_socket_client(), and tmpfile() handles that should be closed with fclose()
• popen() handles that should be closed with pclose()
• proc_open() handles that should be closed with proc_close()
• opendir() handles that should be closed with closedir()

The rule scans each function, method, interface method, trait method, and enum method independently. A finding is reported only when the handle is used and stays local to that body: it is not closed, returned, stored in a property or array, passed to a constructor, or passed to a call whose behavior is unknown. Handles that are opened but never used as resources are ignored, because they may be placeholder or discarded results.

Common stream operations such as fread(), fwrite(), fgets(), feof(), fseek(), stream_get_contents(), readdir(), and proc_get_status() are treated as consumers, not ownership transfers. This allows the rule to report a forgotten close even when the handle was used for I/O first.

Model limits

The rule is intentionally conservative and does not perform alias or reference analysis:

• Handles stored in arrays, properties, or static properties are treated as transferred, because ownership may be released elsewhere.
• Handles passed to unknown user functions, methods, or constructors are treated as transferred, because the callee may close them.
• The rule does not prove that a close runs on every path. A single matching close anywhere in the function is accepted.
• Reopening the same variable is reported as one finding for the variable, not once per lost handle.
• Resources created by extensions, such as curl_init(), imagecreate(), or database drivers, are not modeled.
• Destructors and finally blocks are not interpreted beyond the matching close call they contain.

Configuration

E0047 has no configuration options and is enabled by default.

This site is open source. Improve this page.