added SscanfFunctionDynamicReturnTypeExtension return type extension

conf/config.neon

@@ -1667,6 +1667,11 @@ services:
 		tags:
 			- phpstan.broker.dynamicFunctionReturnTypeExtension
 
+	-
+		class: PHPStan\Type\Php\SscanfFunctionDynamicReturnTypeExtension
+		tags:
+			- phpstan.broker.dynamicFunctionReturnTypeExtension
+
 	-
 		class: PHPStan\Type\Php\StrvalFamilyFunctionReturnTypeExtension
 		tags:

src/Type/Php/SscanfFunctionDynamicReturnTypeExtension.php

@@ -0,0 +1,69 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Type\Php;
+
+use PhpParser\Node\Expr\FuncCall;
+use PHPStan\Analyser\Scope;
+use PHPStan\Reflection\FunctionReflection;
+use PHPStan\Type\Constant\ConstantArrayTypeBuilder;
+use PHPStan\Type\Constant\ConstantIntegerType;
+use PHPStan\Type\Constant\ConstantStringType;
+use PHPStan\Type\DynamicFunctionReturnTypeExtension;
+use PHPStan\Type\FloatType;
+use PHPStan\Type\IntegerType;
+use PHPStan\Type\StringType;
+use PHPStan\Type\Type;
+use PHPStan\Type\TypeCombinator;
+use function count;
+use function in_array;
+use function preg_match_all;
+
+class SscanfFunctionDynamicReturnTypeExtension implements DynamicFunctionReturnTypeExtension
+{
+
+	public function isFunctionSupported(FunctionReflection $functionReflection): bool
+	{
+		return in_array($functionReflection->getName(), ['sscanf', 'fscanf'], true);
+	}
+
+	public function getTypeFromFunctionCall(
+		FunctionReflection $functionReflection,
+		FuncCall $functionCall,
+		Scope $scope,
+	): ?Type
+	{
+		$args = $functionCall->getArgs();
+		if (count($args) !== 2) {
+			return null;
+		}
+
+		$formatType = $scope->getType($args[1]->value);
+
+		if (!$formatType instanceof ConstantStringType) {
+			return null;
+		}
+
+		if (preg_match_all('/%[cdeEfosux]{1}/', $formatType->getValue(), $matches) > 0) {
+			$arrayBuilder = ConstantArrayTypeBuilder::createEmpty();
+
+			for ($i = 0; $i < count($matches[0]); $i++) {
+				$type = new StringType();
+
+				if (in_array($matches[0][$i], ['%d', '%o', '%u', '%x'], true)) {
+					$type = new IntegerType();
+				}
+
+				if (in_array($matches[0][$i], ['%e', '%E', '%f'], true)) {
+					$type = new FloatType();
+				}
+
+				$arrayBuilder->setOffsetValueType(new ConstantIntegerType($i), $type);
+			}
+
+			return TypeCombinator::addNull($arrayBuilder->getArray());
+		}
+
+		return null;
+	}
+
+}

tests/PHPStan/Analyser/data/sscanf.php

@@ -1,6 +1,38 @@
 <?php
 
+namespace Sscanf;
+
 use function PHPStan\Testing\assertType;
 
-assertType('int|null', sscanf('20-20', '%d-%d', $first, $second));
-assertType('array|null', sscanf('20-20', '%d-%d'));
+function foo(string $s) {
+	assertType('int|null', sscanf('20-20', '%d-%d', $first, $second));
+	assertType('array{int, int}|null', sscanf('20-20', '%d-%d'));
+}
+
+function sscanfFormatInference(string $s) {
+	assertType('int|null', sscanf($s, $s, $first, $second));
+	assertType('array|null', sscanf($s, $s));
+
+	assertType('array{string}|null', sscanf($s, '%c'));
+	assertType('array{int}|null', sscanf($s, '%d'));
+	assertType('array{float}|null', sscanf($s, '%e'));
+	assertType('array{float}|null', sscanf($s, '%E'));
+	assertType('array{float}|null', sscanf($s, '%f'));
+	assertType('array{int}|null', sscanf($s, '%o'));
+	assertType('array{string}|null', sscanf($s, '%s'));
+	assertType('array{int}|null', sscanf($s, '%u'));
+	assertType('array{int}|null', sscanf($s, '%x'));
+
+	$mandate = "January 01 2000";
+	list($month, $day, $year) = sscanf($mandate, "%s %d %d");
+	assertType('string', $month);
+	assertType('int', $day);
+	assertType('int', $year);
+}
+
+function fscanfFormatInference($r) {
+	list($month, $day, $year) = fscanf($r, "%s %d %d");
+	assertType('string', $month);
+	assertType('int', $day);
+	assertType('int', $year);
+}