Boundary Issue Detection
Analyze PHP code for boundary and range violations.
Detection Patterns
1. Array Index Out of Bounds
// BUG: No bounds check
$items = [1, 2, 3];
$last = $items[count($items)]; // Off by one, should be count - 1
// BUG: Hardcoded index
$third = $data[2]; // May not have 3 elements
// BUG: Negative index
$item = $array[$index]; // $index could be negative
2. Empty Collection Access
// BUG: first() on empty
$users = $repository->findBy(['status' => 'vip']);
$topUser = $users[0]; // May be empty
// BUG: array_pop on empty
$items = [];
$last = array_pop($items); // Returns null
// BUG: reset() on empty
$first = reset($emptyArray); // Returns false
3. Off-by-One Errors
// BUG: Loop boundary
for ($i = 0; $i <= count($items); $i++) { // Should be <
process($items[$i]); // Last iteration fails
}
// BUG: Substring
$sub = substr($string, 0, strlen($string) + 1); // Off by one
// BUG: Slice
$slice = array_slice($array, 0, count($array) + 1);
4. Integer Overflow/Underflow
// BUG: No overflow check
$total = $price * $quantity; // May overflow
// BUG: Negative result
$remaining = $stock - $ordered; // May go negative
// BUG: Division truncation
$average = $total / $count; // Integer division loses precision
5. String Length Issues
// BUG: Empty string access
$first = $string[0]; // Undefined if empty
// BUG: Multibyte issues
$length = strlen($utf8String); // Wrong for multibyte
$char = $string[5]; // May split multibyte char
// BUG: No length check
$sub = substr($name, 0, 10); // May be shorter than 10
6. Range Validation
// BUG: Unchecked range
$page = $request->get('page'); // Could be 0, negative, or huge
$items = $repository->findPage($page); // Invalid page
// BUG: Missing min/max
$age = (int) $input; // Could be negative or 1000
7. Date/Time Boundaries
// BUG: Invalid month/day
$date = new DateTime("2024-13-45"); // Invalid date
// BUG: Leap year
$date = new DateTime("2023-02-29"); // Not a leap year
Grep Patterns
# Direct array index access
Grep: "\$\w+\[\d+\]" --glob "**/*.php"
# count() in loop condition
Grep: "for\s*\([^;]+;\s*\$\w+\s*<=\s*count" --glob "**/*.php"
# Array access after find
Grep: "findBy[^;]+;\s*\n\s*\$\w+\[0\]" --glob "**/*.php"
# Hardcoded string index
Grep: '\$\w+\["\w+"\]\[\d+\]' --glob "**/*.php"
Severity Classification
| Pattern | Severity |
|---|---|
| Unchecked array index | 🟠 Major |
| Off-by-one in loop | 🟠 Major |
| Empty collection access | 🟠 Major |
| Integer overflow | 🟡 Minor |
| Multibyte string issue | 🟡 Minor |
Output Format
### Boundary Issue: [Description]
**Severity:** 🔴/🟠/🟡
**Location:** `file.php:line`
**Type:** [Array Bounds|Off-by-One|Empty Access|Overflow|...]
**Issue:**
[Description of the boundary violation]
**Code:**
```php
// Problematic code
Fix:
// With bounds check
---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/dykyi-roman) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->