Skip to content

ext/com_dotnet: Fix GH-25008 event source typelib crash - #25020

Open
iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/gh-25008-event-source-typelib
Open

iliaal wants to merge 1 commit into
php:PHP-8.4from
iliaal:fix/gh-25008-event-source-typelib

Conversation

@iliaal

@iliaal iliaal commented Oct 28, 2026

Copy link
Copy Markdown
Member

php_com_locate_typeinfo() stored the default source IID and called ITypeLib_GetTypeInfoOfGuid() with a NULL typelib. The object's IDispatch typeinfo already names that library through GetContainingTypeLib(), including when com.autoregister_typelib is off. The sink path now uses that library and leaves the typeinfo NULL when the GUID lookup fails. A source that is not a dispinterface still raises "Type kind must be dispatchable". php_com_process_typeinfo() returned true after that error, and com_event_sink() then walked an uninitialized name map. That path now releases the TYPEATTR and returns false, so the sink is not advised. WinHttp IWinHttpRequestEvents is a custom IUnknown interface, so the IDispatch sink does not implement it. com_print_typeinfo() with the sink flag prints that interface. The non-sink print path and objects without IProvideClassInfo2 are unchanged. Reproduced from GH-25008 on the PHP 8.4 x64 NTS CLI, Windows 11, with com.autoregister_typelib=0 and WinHttp.WinHttpRequest.5.1.

Fixes #25008

php_com_locate_typeinfo() stored the default source IID and called
ITypeLib_GetTypeInfoOfGuid() on a NULL typelib. The object's IDispatch
typeinfo already names that library through GetContainingTypeLib(),
including when autoregister_typelib is off. The sink path uses that
library and keeps typeinfo NULL when GetTypeInfoOfGuid() fails. A source
that is not a dispinterface still raises "Type kind must be dispatchable";
php_com_process_typeinfo() returned true after that error, so
com_event_sink() walked an uninitialized name map. Print-false and
objects without IProvideClassInfo2 are unchanged.

Fixes phpGH-25008
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

com_event_sink() / com_print_typeinfo($o, null, true) crash with NULL typelib for objects exposing IProvideClassInfo2

1 participant