Treat * as assignment suppression in sscanf/fscanf placeholder counting

[phpstan-bot]

Summary

PHPStan incorrectly reported placeholder count mismatches for sscanf/fscanf calls using the %* assignment suppression modifier (e.g. %*[a-z], %*d). In scanf, * means "match the input but don't store it", so these placeholders should not be counted as requiring a variable argument. The fix teaches the placeholder parser to distinguish scanf semantics from printf semantics.

Changes

• Modified src/Rules/Functions/PrintfHelper.php:
  • Added bool $isScanf parameter to parsePlaceholders() and getPlaceholdersCount()
  • When $isScanf is true and * is captured (in the width regex group), the placeholder is skipped entirely via continue
  • getPrintfPlaceholdersCount() and getPrintfPlaceholders() pass false
  • getScanfPlaceholdersCount() passes true

Root cause

The parsePlaceholders() method was shared between printf and scanf without accounting for their different semantics for *:

• printf: %*d means "take width from the next argument" → counts as an extra parameter
• scanf: %*d means "match but don't assign" → should NOT count as a parameter at all

The fix adds a $isScanf flag so that when processing scanf format strings, any placeholder with * is recognized as assignment-suppressed and skipped.

Analogous cases investigated

• PrintfArrayParametersRule (vprintf/vsprintf): Only uses printf semantics — not affected.
• PrintfParameterTypeRule (printf/sprintf/fprintf): Only uses printf semantics — not affected.
• SscanfFunctionDynamicReturnTypeExtension: Uses its own regex (/%(\d*)(\[[^\]]+\]|[cdeEfosux]{1})/) which accidentally already handles %* correctly — the \d* group doesn't match *, so suppressed placeholders are never included in the inferred return array type. Added NSRT assertions to lock this in.

Test

• tests/PHPStan/Rules/Functions/data/bug-10260.php — Rule test covering %*[a-z], %*d, %*s, multiple suppressions, mixed suppressed/non-suppressed, and fscanf with suppression.
• tests/PHPStan/Analyser/nsrt/sscanf.php — Added type inference assertions for sscanf with %* to confirm the return type extension correctly excludes suppressed placeholders.

Fixes phpstan/phpstan#10260