Skip to content

[Fix] Tuple::compare use strcmp instead of spaceship operator (#53) - #57

Merged
s2x merged 1 commit into
masterfrom
fix/issue-53-tuple-compare-strcmp
Jul 3, 2026
Merged

[Fix] Tuple::compare use strcmp instead of spaceship operator (#53)#57
s2x merged 1 commit into
masterfrom
fix/issue-53-tuple-compare-strcmp

Conversation

@s2x

@s2x s2x commented Jul 3, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #53.

Replace the spaceship operator ($packed1 <=> $packed2) with strcmp($packed1, $packed2) <=> 0 for byte-wise comparison of packed tuple data. PHP's <=> can coerce numeric-looking strings (numeric-string coercion), which is a latent correctness footgun. strcmp() compares byte-by-byte and the result is normalized to -1/0/1.

Changes

  • src/Tuple/Tuple.php:125 — Changed return $packed1 <=> $packed2 to return strcmp($packed1, $packed2) <=> 0
  • tests/Unit/Tuple/TupleCompareTest.php — Added compareNumericLookingStrings() test that verifies correct ordering of bytes that look like numeric strings, plus equality and regular string ordering

Verification

  • All 318 unit tests pass (including all 45 tuple comparison tests)
  • Code style (PHPCS) passes
  • No new PHPStan errors

Acceptance Criteria

  • Unit test(s) added covering ordering of values whose packed form is numeric-looking, plus general ordering
  • Functional test(s) covered by existing tuple-ordering tests (all pass)
  • Changelog entry — no CHANGELOG file exists in the project

Refs: #53

Replace the spaceship operator (<=>) with strcmp() for byte-wise
comparison of packed tuple data. PHP's <=> can coerce numeric-looking
strings, which is a latent correctness footgun. strcmp() compares
byte-by-byte and the result is normalized to -1/0/1.

Adds compareNumericLookingStrings test to verify correct ordering
of bytes that look like numeric strings.
@s2x
s2x merged commit 92e8fda into master Jul 3, 2026
5 of 6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Smell] Tuple::compare relies on PHP spaceship string comparison (numeric-string coercion risk)

1 participant