Guard *scanf() return type extension by counter

src/Type/Php/SscanfFunctionDynamicReturnTypeExtension.php

@@ -5,7 +5,9 @@
 use PhpParser\Node\Expr\FuncCall;
 use PHPStan\Analyser\Scope;
 use PHPStan\DependencyInjection\AutowiredService;
+use PHPStan\Php\PhpVersion;
 use PHPStan\Reflection\FunctionReflection;
+use PHPStan\Rules\Functions\PrintfHelper;
 use PHPStan\Type\Accessory\AccessoryNonEmptyStringType;
 use PHPStan\Type\Accessory\AccessoryNonFalsyStringType;
 use PHPStan\Type\Constant\ConstantArrayTypeBuilder;
@@ -15,6 +17,8 @@
 use PHPStan\Type\FloatType;
 use PHPStan\Type\IntegerType;
 use PHPStan\Type\IntersectionType;
+use PHPStan\Type\NeverType;
+use PHPStan\Type\NullType;
 use PHPStan\Type\StringType;
 use PHPStan\Type\Type;
 use PHPStan\Type\TypeCombinator;
@@ -26,6 +30,13 @@
 final class SscanfFunctionDynamicReturnTypeExtension implements DynamicFunctionReturnTypeExtension
 {
 
+	public function __construct(
+		private PrintfHelper $printfHelper,
+		private PhpVersion $phpVersion,
+	)
+	{
+	}
+
 	public function isFunctionSupported(FunctionReflection $functionReflection): bool
 	{
 		return in_array($functionReflection->getName(), ['sscanf', 'fscanf'], true);
@@ -48,6 +59,11 @@ public function getTypeFromFunctionCall(
 			return null;
 		}
 
+		$placeholderCount = $this->printfHelper->getScanfPlaceholdersCount($formatType->getValue());
+		if ($placeholderCount === null) {
+			return $this->phpVersion->throwsValueErrorForInternalFunctions() ? new NeverType() : new NullType();
+		}
+
 		if (preg_match_all('/%(\d*)(\[[^\]]+\]|[cdeEfosux]{1})/', $formatType->getValue(), $matches) > 0) {
 			$arrayBuilder = ConstantArrayTypeBuilder::createEmpty();
 

tests/PHPStan/Analyser/NodeScopeResolverTest.php

@@ -284,6 +284,12 @@ private static function findTestFiles(): iterable
 		yield __DIR__ . '/../Rules/Variables/data/bug-14124.php';
 		yield __DIR__ . '/../Rules/Variables/data/bug-14124b.php';
 		yield __DIR__ . '/../Rules/Arrays/data/bug-14308.php';
+
+		if (PHP_VERSION_ID < 80000) {
+			yield __DIR__ . '/data/sscanf-php74.php';
+		} else {
+			yield __DIR__ . '/data/sscanf-php80.php';
+		}
 	}
 
 	/**

tests/PHPStan/Analyser/data/sscanf-php74.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace SscanfPHP74;
+
+use function PHPStan\Testing\assertType;
+
+function sscanfInvalidFormatMixingPositionalWithSequential(string $s) {
+	assertType('null', sscanf($s, '%1$s %s'));
+}

tests/PHPStan/Analyser/data/sscanf-php80.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace SscanfPHP80;
+
+use function PHPStan\Testing\assertType;
+
+function sscanfInvalidFormatMixingPositionalWithSequential(string $s) {
+	assertType('*NEVER*', sscanf($s, '%1$s %s'));
+}