com_event_sink() / com_print_typeinfo($o, null, true) crash with NULL typelib for objects exposing IProvideClassInfo2 #25008

Description

In php_com_locate_typeinfo() (ext/com_dotnet/com_typeinfo.c ~L301-413), gotguid is set only in the dispatch_name == NULL && sink branch, and that branch never assigns typelib. The following else if (gotguid) arm therefore calls ITypeLib_GetTypeInfoOfGuid(typelib, ...) with typelib == NULL.

The following code:

<?php
$o = new COM('WinHttp.WinHttpRequest.5.1', null, CP_UTF8);
com_event_sink($o, new stdClass);
// com_print_typeinfo($o, null, true);  // same crash

Resulted in this output:

<access violation, exit code 0xC0000005>

(mov rax, [rcx] with rcx = NULL.) com_print_typeinfo($o, null, false) works. Scripting.Dictionary does not hit the path because it has no IProvideClassInfo2; MediaPlayer.MediaPlayer crashes like WinHttp.

But I expected this output instead: the source interface located via the GUID, or a clean failure/warning.

Suggested fix: obtain the typelib in the sink branch (e.g. IDispatch_GetTypeInfo() then ITypeInfo_GetContainingTypeLib()) before using the GUID. A bare else if (gotguid && typelib) only hides the crash. bug62474.phpt doesn't reach this path (new variant fails the VT_DISPATCH test).

PHP Version

PHP 8.7.0-dev (cli) (built: Oct 27 2026 17:51:17) (ZTS Visual C++ 2026 x64)
Zend Engine v4.7.0-dev (master @ 0af8a091eec28513a6a0b758bcb10b430ba6c6de)
com.autoregister_typelib=0

Affects PHP-8.4/8.5 by source inspection (not run there).

Operating System

Windows 11 x64