dlls/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #define COBJMACROS
  26 #define NONAMELESSUNION
  27
  28 #include "windef.h"
  29 #include "winbase.h"
  30 #include "wingdi.h"
  31 #include "winuser.h"
  32 #include "winerror.h"
  33
  34 #include "ole2.h"
  35 #include "oleauto.h"
  36 #include "typelib.h"
  37 #include "ocidl.h"
  38 #include "wine/debug.h"
  39
  40 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  41
  42 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  43 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  44 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  45 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  46
  47 /* ole32 exports those, not defined in public headers */
  48 ULONG __RPC_USER WdtpInterfacePointer_UserSize(ULONG*, ULONG, ULONG, IUnknown*, REFIID);
  49 unsigned char * __RPC_USER WdtpInterfacePointer_UserMarshal(ULONG*, ULONG, unsigned char*, IUnknown*, REFIID);
  50 unsigned char * __RPC_USER WdtpInterfacePointer_UserUnmarshal(ULONG*, unsigned char*, IUnknown**, REFIID);
  51
  52 static void dump_user_flags(const ULONG *pFlags)
  53 {
  54     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  55         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  56     else
  57         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  58     switch (LOWORD(*pFlags))
  59     {
  60         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  61         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  62         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  63         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  64         default: TRACE("%d)", LOWORD(*pFlags));
  65     }
  66 }
  67
  68 /* CLEANLOCALSTORAGE */
  69
  70 #define CLS_FUNCDESC  'f'
  71 #define CLS_LIBATTR   'l'
  72 #define CLS_TYPEATTR  't'
  73 #define CLS_VARDESC   'v'
  74
  75 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  76 {
  77     ALIGN_LENGTH(Start, 3);
  78     return Start + sizeof(DWORD);
  79 }
  80
  81 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  82 {
  83     ALIGN_POINTER(Buffer, 3);
  84     *(DWORD*)Buffer = pstg->flags;
  85     switch(pstg->flags)
  86     {
  87     case CLS_LIBATTR:
  88         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
  89         break;
  90     case CLS_TYPEATTR:
  91         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
  92         break;
  93     case CLS_FUNCDESC:
  94         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
  95         break;
  96     case CLS_VARDESC:
  97         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
  98         break;
  99
 100     default:
 101         ERR("Unknown type %x\n", pstg->flags);
 102     }
 103
 104     *(VOID**)pstg->pStorage = NULL;
 105     IUnknown_Release(pstg->pInterface);
 106     pstg->pInterface = NULL;
 107
 108     return Buffer + sizeof(DWORD);
 109 }
 110
 111 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
 112 {
 113     ALIGN_POINTER(Buffer, 3);
 114     pstr->flags = *(DWORD*)Buffer;
 115     return Buffer + sizeof(DWORD);
 116 }
 117
 118 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
 119 {
 120     /* Nothing to do */
 121 }
 122
 123 /* BSTR */
 124
 125 typedef struct
 126 {
 127     DWORD len;          /* No. of chars not including trailing '\0' */
 128     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 129     DWORD len2;         /* == len */
 130 } bstr_wire_t;
 131
 132 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 133 {
 134     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 135     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 136     ALIGN_LENGTH(Start, 3);
 137     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 138     TRACE("returning %d\n", Start);
 139     return Start;
 140 }
 141
 142 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 143 {
 144     bstr_wire_t *header;
 145     DWORD len = SysStringByteLen(*pstr);
 146
 147     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 148     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 149
 150     ALIGN_POINTER(Buffer, 3);
 151     header = (bstr_wire_t*)Buffer;
 152     header->len = header->len2 = (len + 1) / 2;
 153     if (*pstr)
 154     {
 155         header->byte_len = len;
 156         memcpy(header + 1, *pstr, header->len * 2);
 157     }
 158     else
 159         header->byte_len = 0xffffffff; /* special case for a null bstr */
 160
 161     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 162 }
 163
 164 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 165 {
 166     bstr_wire_t *header;
 167     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 168
 169     ALIGN_POINTER(Buffer, 3);
 170     header = (bstr_wire_t*)Buffer;
 171     if(header->len != header->len2)
 172         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 173
 174     if (header->byte_len == 0xffffffff)
 175     {
 176         SysFreeString(*pstr);
 177         *pstr = NULL;
 178     }
 179     else SysReAllocStringLen( pstr, (OLECHAR *)(header + 1), header->len );
 180
 181     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 182     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 183 }
 184
 185 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 186 {
 187     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 188     SysFreeString(*pstr);
 189     *pstr = NULL;
 190 }
 191
 192 /* VARIANT */
 193
 194 typedef struct
 195 {
 196     DWORD clSize;
 197     DWORD rpcReserved;
 198     USHORT vt;
 199     USHORT wReserved1;
 200     USHORT wReserved2;
 201     USHORT wReserved3;
 202     DWORD switch_is;
 203 } variant_wire_t;
 204
 205 unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 206 {
 207     if (vt & VT_ARRAY) return 4;
 208
 209     switch (vt & ~VT_BYREF) {
 210     case VT_EMPTY:
 211     case VT_NULL:
 212         return 0;
 213     case VT_I1:
 214     case VT_UI1:
 215         return sizeof(CHAR);
 216     case VT_I2:
 217     case VT_UI2:
 218         return sizeof(SHORT);
 219     case VT_I4:
 220     case VT_UI4:
 221     case VT_HRESULT:
 222         return sizeof(LONG);
 223     case VT_INT:
 224     case VT_UINT:
 225         return sizeof(INT);
 226     case VT_R4:
 227         return sizeof(FLOAT);
 228     case VT_R8:
 229         return sizeof(DOUBLE);
 230     case VT_BOOL:
 231         return sizeof(VARIANT_BOOL);
 232     case VT_ERROR:
 233         return sizeof(SCODE);
 234     case VT_DATE:
 235         return sizeof(DATE);
 236     case VT_CY:
 237         return sizeof(CY);
 238     case VT_DECIMAL:
 239         return sizeof(DECIMAL);
 240     case VT_BSTR:
 241         return sizeof(ULONG);
 242     case VT_VARIANT:
 243         return sizeof(VARIANT);
 244     case VT_UNKNOWN:
 245     case VT_DISPATCH:
 246     case VT_RECORD:
 247         return 0;
 248     default:
 249         FIXME("unhandled VT %d\n", vt);
 250         return 0;
 251     }
 252 }
 253
 254 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 255 {
 256     unsigned int size = get_type_size(pFlags, vt);
 257     if(vt & VT_BYREF) return 3;
 258     if(size == 0) return 0;
 259     if(size <= 4) return size - 1;
 260     return 7;
 261 }
 262
 263 /* WdtpInterfacePointer_UserSize takes care of 2 additional DWORDs to store marshalling buffer size */
 264 static unsigned interface_variant_size(ULONG *pFlags, REFIID riid, IUnknown *punk)
 265 {
 266     ULONG size = 0;
 267
 268     if (punk)
 269     {
 270         size = WdtpInterfacePointer_UserSize(pFlags, LOWORD(*pFlags), 0, punk, riid);
 271         if (!size)
 272         {
 273             ERR("interface variant buffer size calculation failed\n");
 274             return 0;
 275         }
 276     }
 277     size += sizeof(ULONG);
 278     TRACE("wire-size extra of interface variant is %d\n", size);
 279     return size;
 280 }
 281
 282 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 283 {
 284   if (V_ISARRAY(pvar))
 285   {
 286     if (V_ISBYREF(pvar))
 287       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 288     else
 289       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 290   }
 291
 292   switch (V_VT(pvar)) {
 293   case VT_BSTR:
 294     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 295   case VT_BSTR | VT_BYREF:
 296     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 297   case VT_VARIANT | VT_BYREF:
 298     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 299   case VT_UNKNOWN:
 300     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 301   case VT_UNKNOWN | VT_BYREF:
 302     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 303   case VT_DISPATCH:
 304     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 305   case VT_DISPATCH | VT_BYREF:
 306     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 307   case VT_RECORD:
 308     FIXME("wire-size record\n");
 309     return Start;
 310   case VT_SAFEARRAY:
 311   case VT_SAFEARRAY | VT_BYREF:
 312     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 313     return Start;
 314   default:
 315     return Start;
 316   }
 317 }
 318
 319 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer */
 320 static unsigned char* interface_variant_marshal(ULONG *pFlags, unsigned char *Buffer,
 321                                                 REFIID riid, IUnknown *punk)
 322 {
 323   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 324
 325   /* first DWORD is used to store pointer itself, truncated on win64 */
 326   if(!punk)
 327   {
 328       memset(Buffer, 0, sizeof(ULONG));
 329       return Buffer + sizeof(ULONG);
 330   }
 331   else
 332   {
 333       *(DWORD*)Buffer = (DWORD_PTR)punk;
 334       Buffer += sizeof(DWORD);
 335   }
 336
 337   return WdtpInterfacePointer_UserMarshal(pFlags, LOWORD(*pFlags), Buffer, punk, riid);
 338 }
 339
 340 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer */
 341 static unsigned char *interface_variant_unmarshal(ULONG *pFlags, unsigned char *Buffer,
 342                                                   REFIID riid, IUnknown **ppunk)
 343 {
 344   DWORD ptr;
 345
 346   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 347
 348   /* skip pointer part itself */
 349   ptr = *(DWORD*)Buffer;
 350   Buffer += sizeof(DWORD);
 351
 352   if(!ptr)
 353       return Buffer;
 354
 355   return WdtpInterfacePointer_UserUnmarshal(pFlags, Buffer, ppunk, riid);
 356 }
 357
 358 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 359 {
 360     int align;
 361     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 362     TRACE("vt=%04x\n", V_VT(pvar));
 363
 364     ALIGN_LENGTH(Start, 7);
 365     Start += sizeof(variant_wire_t);
 366     if(V_VT(pvar) & VT_BYREF)
 367         Start += 4;
 368
 369     align = get_type_alignment(pFlags, V_VT(pvar));
 370     ALIGN_LENGTH(Start, align);
 371     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 372         Start += 4;
 373     else
 374         Start += get_type_size(pFlags, V_VT(pvar));
 375     Start = wire_extra_user_size(pFlags, Start, pvar);
 376
 377     TRACE("returning %d\n", Start);
 378     return Start;
 379 }
 380
 381 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 382 {
 383     variant_wire_t *header;
 384     ULONG type_size;
 385     int align;
 386     unsigned char *Pos;
 387
 388     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 389     TRACE("vt=%04x\n", V_VT(pvar));
 390
 391     ALIGN_POINTER(Buffer, 7);
 392
 393     header = (variant_wire_t *)Buffer;
 394
 395     header->clSize = 0; /* fixed up at the end */
 396     header->rpcReserved = 0;
 397     header->vt = pvar->n1.n2.vt;
 398     header->wReserved1 = pvar->n1.n2.wReserved1;
 399     header->wReserved2 = pvar->n1.n2.wReserved2;
 400     header->wReserved3 = pvar->n1.n2.wReserved3;
 401     header->switch_is = pvar->n1.n2.vt;
 402     if(header->switch_is & VT_ARRAY)
 403         header->switch_is &= ~VT_TYPEMASK;
 404
 405     Pos = (unsigned char*)(header + 1);
 406     type_size = get_type_size(pFlags, V_VT(pvar));
 407     align = get_type_alignment(pFlags, V_VT(pvar));
 408     ALIGN_POINTER(Pos, align);
 409
 410     if(header->vt & VT_BYREF)
 411     {
 412         *(DWORD *)Pos = max(type_size, 4);
 413         Pos += 4;
 414         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 415         {
 416             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 417             Pos += type_size;
 418         }
 419         else
 420         {
 421             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 422             Pos += 4;
 423         }
 424     }
 425     else
 426     {
 427         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 428             memcpy(Pos, pvar, type_size);
 429         else
 430             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 431         Pos += type_size;
 432     }
 433
 434     if(header->vt & VT_ARRAY)
 435     {
 436         if(header->vt & VT_BYREF)
 437             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 438         else
 439             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 440     }
 441     else
 442     {
 443         switch (header->vt)
 444         {
 445         case VT_BSTR:
 446             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 447             break;
 448         case VT_BSTR | VT_BYREF:
 449             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 450             break;
 451         case VT_VARIANT | VT_BYREF:
 452             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 453             break;
 454         case VT_UNKNOWN:
 455             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 456             break;
 457         case VT_UNKNOWN | VT_BYREF:
 458             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 459             break;
 460         case VT_DISPATCH:
 461             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 462             break;
 463         case VT_DISPATCH | VT_BYREF:
 464             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 465             break;
 466         case VT_RECORD:
 467             FIXME("handle BRECORD by val\n");
 468             break;
 469         case VT_RECORD | VT_BYREF:
 470             FIXME("handle BRECORD by ref\n");
 471             break;
 472         }
 473     }
 474     header->clSize = ((Pos - Buffer) + 7) >> 3;
 475     TRACE("marshalled size=%d\n", header->clSize);
 476     return Pos;
 477 }
 478
 479 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 480 {
 481     variant_wire_t *header;
 482     ULONG type_size;
 483     int align;
 484     unsigned char *Pos;
 485
 486     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 487
 488     ALIGN_POINTER(Buffer, 7);
 489
 490     header = (variant_wire_t *)Buffer;
 491
 492     Pos = (unsigned char*)(header + 1);
 493     type_size = get_type_size(pFlags, header->vt);
 494     align = get_type_alignment(pFlags, header->vt);
 495     ALIGN_POINTER(Pos, align);
 496
 497     if(header->vt & VT_BYREF)
 498     {
 499         ULONG mem_size;
 500         Pos += 4;
 501
 502         switch (header->vt & ~VT_BYREF)
 503         {
 504         /* these types have a different memory size compared to wire size */
 505         case VT_UNKNOWN:
 506         case VT_DISPATCH:
 507         case VT_BSTR:
 508             mem_size = sizeof(void *);
 509             break;
 510         default:
 511             mem_size = type_size;
 512             break;
 513         }
 514
 515         if (V_VT(pvar) != header->vt)
 516         {
 517             VariantClear(pvar);
 518             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 519             memset(V_BYREF(pvar), 0, mem_size);
 520         }
 521         else if (!V_BYREF(pvar))
 522         {
 523             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 524             memset(V_BYREF(pvar), 0, mem_size);
 525         }
 526
 527         if(!(header->vt & VT_ARRAY)
 528                 && (header->vt & VT_TYPEMASK) != VT_BSTR
 529                 && (header->vt & VT_TYPEMASK) != VT_VARIANT
 530                 && (header->vt & VT_TYPEMASK) != VT_UNKNOWN
 531                 && (header->vt & VT_TYPEMASK) != VT_DISPATCH
 532                 && (header->vt & VT_TYPEMASK) != VT_RECORD)
 533             memcpy(V_BYREF(pvar), Pos, type_size);
 534
 535         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 536             Pos += type_size;
 537         else
 538             Pos += 4;
 539     }
 540     else
 541     {
 542         VariantClear(pvar);
 543         if(header->vt & VT_ARRAY)
 544             V_ARRAY(pvar) = NULL;
 545         else if((header->vt & VT_TYPEMASK) == VT_BSTR)
 546             V_BSTR(pvar) = NULL;
 547         else if((header->vt & VT_TYPEMASK) == VT_UNKNOWN)
 548             V_UNKNOWN(pvar) = NULL;
 549         else if((header->vt & VT_TYPEMASK) == VT_DISPATCH)
 550             V_DISPATCH(pvar) = NULL;
 551         else if((header->vt & VT_TYPEMASK) == VT_RECORD)
 552             V_RECORD(pvar) = NULL;
 553         else if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 554             memcpy(pvar, Pos, type_size);
 555         else
 556             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 557         Pos += type_size;
 558     }
 559
 560     pvar->n1.n2.vt = header->vt;
 561     pvar->n1.n2.wReserved1 = header->wReserved1;
 562     pvar->n1.n2.wReserved2 = header->wReserved2;
 563     pvar->n1.n2.wReserved3 = header->wReserved3;
 564
 565     if(header->vt & VT_ARRAY)
 566     {
 567         if(header->vt & VT_BYREF)
 568             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 569         else
 570             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 571     }
 572     else
 573     {
 574         switch (header->vt)
 575         {
 576         case VT_BSTR:
 577             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 578             break;
 579         case VT_BSTR | VT_BYREF:
 580             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 581             break;
 582         case VT_VARIANT | VT_BYREF:
 583             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 584             break;
 585         case VT_UNKNOWN:
 586             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 587             break;
 588         case VT_UNKNOWN | VT_BYREF:
 589             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 590             break;
 591         case VT_DISPATCH:
 592             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 593             break;
 594         case VT_DISPATCH | VT_BYREF:
 595             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 596             break;
 597         case VT_RECORD:
 598             FIXME("handle BRECORD by val\n");
 599             break;
 600         case VT_RECORD | VT_BYREF:
 601             FIXME("handle BRECORD by ref\n");
 602             break;
 603         }
 604     }
 605     return Pos;
 606 }
 607
 608 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 609 {
 610   VARTYPE vt = V_VT(pvar);
 611   PVOID ref = NULL;
 612
 613   TRACE("(%x,%p)\n", *pFlags, pvar);
 614   TRACE("vt=%04x\n", V_VT(pvar));
 615
 616   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 617
 618   VariantClear(pvar);
 619   if (!ref) return;
 620
 621   if(vt & VT_ARRAY)
 622   {
 623     if (vt & VT_BYREF)
 624       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 625     else
 626       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 627   }
 628   else
 629   {
 630     switch (vt)
 631     {
 632     case VT_BSTR | VT_BYREF:
 633       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 634       break;
 635     case VT_VARIANT | VT_BYREF:
 636       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 637       break;
 638     case VT_RECORD | VT_BYREF:
 639       FIXME("handle BRECORD by ref\n");
 640       break;
 641     case VT_UNKNOWN | VT_BYREF:
 642     case VT_DISPATCH | VT_BYREF:
 643       IUnknown_Release(*V_UNKNOWNREF(pvar));
 644       break;
 645     }
 646   }
 647
 648   CoTaskMemFree(ref);
 649 }
 650
 651 /* LPSAFEARRAY */
 652
 653 /* Get the number of cells in a SafeArray */
 654 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 655 {
 656     const SAFEARRAYBOUND* psab = psa->rgsabound;
 657     USHORT cCount = psa->cDims;
 658     ULONG ulNumCells = 1;
 659
 660     while (cCount--)
 661     {
 662         /* This is a valid bordercase. See testcases. -Marcus */
 663         if (!psab->cElements)
 664             return 0;
 665         ulNumCells *= psab->cElements;
 666         psab++;
 667     }
 668     return ulNumCells;
 669 }
 670
 671 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 672 {
 673     VARTYPE vt;
 674     HRESULT hr;
 675
 676     hr = SafeArrayGetVartype(psa, &vt);
 677     if (FAILED(hr))
 678     {
 679         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 680
 681         switch(psa->cbElements)
 682         {
 683         case 1: vt = VT_I1; break;
 684         case 2: vt = VT_I2; break;
 685         case 4: vt = VT_I4; break;
 686         case 8: vt = VT_I8; break;
 687         default:
 688             RpcRaiseException(hr);
 689         }
 690     }
 691
 692     if (psa->fFeatures & FADF_HAVEIID)
 693         return SF_HAVEIID;
 694
 695     switch (vt)
 696     {
 697     case VT_I1:
 698     case VT_UI1:      return SF_I1;
 699     case VT_BOOL:
 700     case VT_I2:
 701     case VT_UI2:      return SF_I2;
 702     case VT_INT:
 703     case VT_UINT:
 704     case VT_I4:
 705     case VT_UI4:
 706     case VT_R4:       return SF_I4;
 707     case VT_DATE:
 708     case VT_CY:
 709     case VT_R8:
 710     case VT_I8:
 711     case VT_UI8:      return SF_I8;
 712     case VT_INT_PTR:
 713     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 714     case VT_BSTR:     return SF_BSTR;
 715     case VT_DISPATCH: return SF_DISPATCH;
 716     case VT_VARIANT:  return SF_VARIANT;
 717     case VT_UNKNOWN:  return SF_UNKNOWN;
 718     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 719      * of a UDT is taken from the result of IRecordInfo_GetSize().
 720      */
 721     case VT_RECORD:   return SF_RECORD;
 722     default:          return SF_ERROR;
 723     }
 724 }
 725
 726 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 727 {
 728     if (sftype == SF_BSTR)
 729         return sizeof(DWORD);
 730     else if (sftype == SF_VARIANT)
 731         return sizeof(variant_wire_t) - sizeof(DWORD);
 732     else
 733         return lpsa->cbElements;
 734 }
 735
 736 static DWORD elem_mem_size(wireSAFEARRAY wiresa, SF_TYPE sftype)
 737 {
 738     if (sftype == SF_BSTR)
 739         return sizeof(BSTR);
 740     else if (sftype == SF_VARIANT)
 741         return sizeof(VARIANT);
 742     else
 743         return wiresa->cbElements;
 744 }
 745
 746 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 747 {
 748     ULONG size = StartingSize;
 749
 750     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 751
 752     ALIGN_LENGTH(size, 3);
 753     size += sizeof(ULONG);
 754     if (*ppsa)
 755     {
 756         SAFEARRAY *psa = *ppsa;
 757         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 758         SF_TYPE sftype;
 759         HRESULT hr;
 760
 761         size += sizeof(ULONG);
 762         size += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 763
 764         sftype = SAFEARRAY_GetUnionType(psa);
 765         size += sizeof(ULONG);
 766
 767         size += sizeof(ULONG);
 768         size += sizeof(ULONG);
 769         if (sftype == SF_HAVEIID)
 770             size += sizeof(IID);
 771
 772         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 773
 774         size += sizeof(ULONG);
 775
 776         switch (sftype)
 777         {
 778             case SF_BSTR:
 779             {
 780                 BSTR* lpBstr;
 781
 782                 for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 783                     size = BSTR_UserSize(pFlags, size, lpBstr);
 784
 785                 break;
 786             }
 787             case SF_DISPATCH:
 788             case SF_UNKNOWN:
 789             case SF_HAVEIID:
 790                 FIXME("size interfaces\n");
 791                 break;
 792             case SF_VARIANT:
 793             {
 794                 VARIANT* lpVariant;
 795
 796                 for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 797                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 798
 799                 break;
 800             }
 801             case SF_RECORD:
 802             {
 803                 IRecordInfo* pRecInfo = NULL;
 804
 805                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 806                 if (FAILED(hr))
 807                     RpcRaiseException(hr);
 808
 809                 if (pRecInfo)
 810                 {
 811                     FIXME("size record info %p\n", pRecInfo);
 812
 813                     IRecordInfo_Release(pRecInfo);
 814                 }
 815                 break;
 816             }
 817             case SF_I8:
 818                 ALIGN_LENGTH(size, 7);
 819                 /* fallthrough */
 820             case SF_I1:
 821             case SF_I2:
 822             case SF_I4:
 823                 size += ulCellCount * psa->cbElements;
 824                 break;
 825             default:
 826                 break;
 827         }
 828
 829     }
 830
 831     return size;
 832 }
 833
 834 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 835 {
 836     HRESULT hr;
 837
 838     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 839
 840     ALIGN_POINTER(Buffer, 3);
 841     *(ULONG *)Buffer = *ppsa ? 0x1 : 0x0;
 842     Buffer += sizeof(ULONG);
 843     if (*ppsa)
 844     {
 845         VARTYPE vt;
 846         SAFEARRAY *psa = *ppsa;
 847         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 848         SAFEARRAYBOUND *bound;
 849         SF_TYPE sftype;
 850         GUID guid;
 851         INT i;
 852
 853         sftype = SAFEARRAY_GetUnionType(psa);
 854
 855         *(ULONG *)Buffer = psa->cDims;
 856         Buffer += sizeof(ULONG);
 857         *(USHORT *)Buffer = psa->cDims;
 858         Buffer += sizeof(USHORT);
 859         *(USHORT *)Buffer = psa->fFeatures;
 860         Buffer += sizeof(USHORT);
 861         *(ULONG *)Buffer = elem_wire_size(psa, sftype);
 862         Buffer += sizeof(ULONG);
 863
 864         hr = SafeArrayGetVartype(psa, &vt);
 865         if (FAILED(hr)) vt = 0;
 866
 867         *(ULONG *)Buffer = (USHORT)psa->cLocks | (vt << 16);
 868         Buffer += sizeof(ULONG);
 869
 870         *(ULONG *)Buffer = sftype;
 871         Buffer += sizeof(ULONG);
 872
 873         *(ULONG *)Buffer = ulCellCount;
 874         Buffer += sizeof(ULONG);
 875         *(ULONG *)Buffer = psa->pvData ? 0x2 : 0x0;
 876         Buffer += sizeof(ULONG);
 877         if (sftype == SF_HAVEIID)
 878         {
 879             SafeArrayGetIID(psa, &guid);
 880             memcpy(Buffer, &guid, sizeof(guid));
 881             Buffer += sizeof(guid);
 882         }
 883
 884         /* bounds are marshaled in opposite order comparing to storage layout */
 885         bound = (SAFEARRAYBOUND*)Buffer;
 886         for (i = 0; i < psa->cDims; i++)
 887         {
 888             memcpy(bound++, &psa->rgsabound[psa->cDims-i-1], sizeof(psa->rgsabound[0]));
 889         }
 890         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 891
 892         *(ULONG *)Buffer = ulCellCount;
 893         Buffer += sizeof(ULONG);
 894
 895         if (psa->pvData)
 896         {
 897             switch (sftype)
 898             {
 899                 case SF_BSTR:
 900                 {
 901                     BSTR* lpBstr;
 902
 903                     for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 904                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 905
 906                     break;
 907                 }
 908                 case SF_DISPATCH:
 909                 case SF_UNKNOWN:
 910                 case SF_HAVEIID:
 911                     FIXME("marshal interfaces\n");
 912                     break;
 913                 case SF_VARIANT:
 914                 {
 915                     VARIANT* lpVariant;
 916
 917                     for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 918                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 919
 920                     break;
 921                 }
 922                 case SF_RECORD:
 923                 {
 924                     IRecordInfo* pRecInfo = NULL;
 925
 926                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 927                     if (FAILED(hr))
 928                         RpcRaiseException(hr);
 929
 930                     if (pRecInfo)
 931                     {
 932                         FIXME("write record info %p\n", pRecInfo);
 933
 934                         IRecordInfo_Release(pRecInfo);
 935                     }
 936                     break;
 937                 }
 938
 939                 case SF_I8:
 940                     ALIGN_POINTER(Buffer, 7);
 941                     /* fallthrough */
 942                 case SF_I1:
 943                 case SF_I2:
 944                 case SF_I4:
 945                     /* Just copy the data over */
 946                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
 947                     Buffer += ulCellCount * psa->cbElements;
 948                     break;
 949                 default:
 950                     break;
 951             }
 952         }
 953
 954     }
 955     return Buffer;
 956 }
 957
 958 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
 959                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
 960                            FADF_VARIANT | FADF_CREATEVECTOR)
 961
 962 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 963 {
 964     ULONG ptr;
 965     wireSAFEARRAY wiresa;
 966     ULONG cDims;
 967     HRESULT hr;
 968     SF_TYPE sftype;
 969     ULONG cell_count;
 970     GUID guid;
 971     VARTYPE vt;
 972     SAFEARRAYBOUND *wiresab;
 973
 974     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
 975
 976     ALIGN_POINTER(Buffer, 3);
 977     ptr = *(ULONG *)Buffer;
 978     Buffer += sizeof(ULONG);
 979
 980     if (!ptr)
 981     {
 982         SafeArrayDestroy(*ppsa);
 983         *ppsa = NULL;
 984
 985         TRACE("NULL safe array unmarshaled\n");
 986
 987         return Buffer;
 988     }
 989
 990     cDims = *(ULONG *)Buffer;
 991     Buffer += sizeof(ULONG);
 992
 993     wiresa = (wireSAFEARRAY)Buffer;
 994     Buffer += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 995
 996     if (cDims != wiresa->cDims)
 997         RpcRaiseException(RPC_S_INVALID_BOUND);
 998
 999     /* FIXME: there should be a limit on how large cDims can be */
1000
1001     vt = HIWORD(wiresa->cLocks);
1002
1003     sftype = *(ULONG *)Buffer;
1004     Buffer += sizeof(ULONG);
1005
1006     cell_count = *(ULONG *)Buffer;
1007     Buffer += sizeof(ULONG);
1008     ptr = *(ULONG *)Buffer;
1009     Buffer += sizeof(ULONG);
1010     if (sftype == SF_HAVEIID)
1011     {
1012         memcpy(&guid, Buffer, sizeof(guid));
1013         Buffer += sizeof(guid);
1014     }
1015
1016     wiresab = (SAFEARRAYBOUND *)Buffer;
1017     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1018
1019     if(*ppsa && (*ppsa)->cDims==wiresa->cDims)
1020     {
1021         if(((*ppsa)->fFeatures & ~FADF_AUTOSETFLAGS) != (wiresa->fFeatures & ~FADF_AUTOSETFLAGS))
1022             RpcRaiseException(DISP_E_BADCALLEE);
1023
1024         if(SAFEARRAY_GetCellCount(*ppsa)*(*ppsa)->cbElements != cell_count*elem_mem_size(wiresa, sftype))
1025         {
1026             if((*ppsa)->fFeatures & (FADF_AUTO|FADF_STATIC|FADF_EMBEDDED|FADF_FIXEDSIZE))
1027                 RpcRaiseException(DISP_E_BADCALLEE);
1028
1029             hr = SafeArrayDestroyData(*ppsa);
1030             if(FAILED(hr))
1031                 RpcRaiseException(hr);
1032         }
1033         memcpy((*ppsa)->rgsabound, wiresab, sizeof(*wiresab)*wiresa->cDims);
1034
1035         if((*ppsa)->fFeatures & FADF_HAVEVARTYPE)
1036             ((DWORD*)(*ppsa))[-1] = vt;
1037     }
1038     else if(vt)
1039     {
1040         SafeArrayDestroy(*ppsa);
1041         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1042         if (!*ppsa) RpcRaiseException(E_OUTOFMEMORY);
1043     }
1044     else
1045     {
1046         SafeArrayDestroy(*ppsa);
1047         if (FAILED(SafeArrayAllocDescriptor(wiresa->cDims, ppsa)))
1048             RpcRaiseException(E_OUTOFMEMORY);
1049         memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1050     }
1051
1052     /* be careful about which flags we set since they could be a security
1053      * risk */
1054     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1055     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1056     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1057     (*ppsa)->cbElements = elem_mem_size(wiresa, sftype);
1058
1059     /* SafeArrayCreateEx allocates the data for us, but
1060      * SafeArrayAllocDescriptor doesn't */
1061     if(!(*ppsa)->pvData)
1062     {
1063         hr = SafeArrayAllocData(*ppsa);
1064         if (FAILED(hr))
1065             RpcRaiseException(hr);
1066     }
1067
1068     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1069         RpcRaiseException(RPC_S_INVALID_BOUND);
1070     Buffer += sizeof(ULONG);
1071
1072     if (ptr)
1073     {
1074         switch (sftype)
1075         {
1076             case SF_BSTR:
1077             {
1078                 BSTR* lpBstr;
1079
1080                 for (lpBstr = (*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1081                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1082
1083                 break;
1084             }
1085             case SF_DISPATCH:
1086             case SF_UNKNOWN:
1087             case SF_HAVEIID:
1088                 FIXME("marshal interfaces\n");
1089                 break;
1090             case SF_VARIANT:
1091             {
1092                 VARIANT* lpVariant;
1093
1094                 for (lpVariant = (*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1095                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1096
1097                 break;
1098             }
1099             case SF_RECORD:
1100             {
1101                 FIXME("set record info\n");
1102
1103                 break;
1104             }
1105
1106             case SF_I8:
1107                 ALIGN_POINTER(Buffer, 7);
1108                 /* fallthrough */
1109             case SF_I1:
1110             case SF_I2:
1111             case SF_I4:
1112                 /* Just copy the data over */
1113                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1114                 Buffer += cell_count * (*ppsa)->cbElements;
1115                 break;
1116             default:
1117                 break;
1118         }
1119     }
1120
1121     TRACE("safe array unmarshaled: %p\n", *ppsa);
1122
1123     return Buffer;
1124 }
1125
1126 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1127 {
1128     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1129
1130     SafeArrayDestroy(*ppsa);
1131     *ppsa = NULL;
1132 }
1133
1134
1135 ULONG WINAPI HFONT_UserSize(ULONG *pFlags, ULONG Start, HFONT *phfont)
1136 {
1137     FIXME(":stub\n");
1138     return 0;
1139 }
1140
1141 unsigned char * WINAPI HFONT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1142 {
1143     FIXME(":stub\n");
1144     return NULL;
1145 }
1146
1147 unsigned char * WINAPI HFONT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1148 {
1149     FIXME(":stub\n");
1150     return NULL;
1151 }
1152
1153 void WINAPI HFONT_UserFree(ULONG *pFlags, HFONT *phfont)
1154 {
1155     FIXME(":stub\n");
1156     return;
1157 }
1158
1159
1160 /* IDispatch */
1161 /* exactly how Invoke is marshalled is not very clear to me yet,
1162  * but the way I've done it seems to work for me */
1163
1164 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1165     IDispatch* This,
1166     DISPID dispIdMember,
1167     REFIID riid,
1168     LCID lcid,
1169     WORD wFlags,
1170     DISPPARAMS* pDispParams,
1171     VARIANT* pVarResult,
1172     EXCEPINFO* pExcepInfo,
1173     UINT* puArgErr)
1174 {
1175   HRESULT hr;
1176   VARIANT VarResult;
1177   UINT* rgVarRefIdx = NULL;
1178   VARIANTARG* rgVarRef = NULL;
1179   UINT u, cVarRef;
1180   UINT uArgErr;
1181   EXCEPINFO ExcepInfo;
1182
1183   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1184         dispIdMember, debugstr_guid(riid),
1185         lcid, wFlags, pDispParams, pVarResult,
1186         pExcepInfo, puArgErr);
1187
1188   /* [out] args can't be null, use dummy vars if needed */
1189   if (!pVarResult) pVarResult = &VarResult;
1190   if (!puArgErr) puArgErr = &uArgErr;
1191   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1192
1193   /* count by-ref args */
1194   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1195     VARIANTARG* arg = &pDispParams->rgvarg[u];
1196     if (V_ISBYREF(arg)) {
1197       cVarRef++;
1198     }
1199   }
1200   if (cVarRef) {
1201     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1202     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1203     /* make list of by-ref args */
1204     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1205       VARIANTARG* arg = &pDispParams->rgvarg[u];
1206       if (V_ISBYREF(arg)) {
1207         rgVarRefIdx[cVarRef] = u;
1208         VariantInit(&rgVarRef[cVarRef]);
1209         VariantCopy(&rgVarRef[cVarRef], arg);
1210         VariantClear(arg);
1211         cVarRef++;
1212       }
1213     }
1214   } else {
1215     /* [out] args still can't be null,
1216      * but we can point these anywhere in this case,
1217      * since they won't be written to when cVarRef is 0 */
1218     rgVarRefIdx = puArgErr;
1219     rgVarRef = pVarResult;
1220   }
1221   TRACE("passed by ref: %d args\n", cVarRef);
1222   hr = IDispatch_RemoteInvoke_Proxy(This,
1223                                     dispIdMember,
1224                                     riid,
1225                                     lcid,
1226                                     wFlags,
1227                                     pDispParams,
1228                                     pVarResult,
1229                                     pExcepInfo,
1230                                     puArgErr,
1231                                     cVarRef,
1232                                     rgVarRefIdx,
1233                                     rgVarRef);
1234   if (cVarRef) {
1235     for (u=0; u<cVarRef; u++) {
1236       unsigned i = rgVarRefIdx[u];
1237       VariantCopy(&pDispParams->rgvarg[i],
1238                   &rgVarRef[u]);
1239       VariantClear(&rgVarRef[u]);
1240     }
1241     CoTaskMemFree(rgVarRef);
1242     CoTaskMemFree(rgVarRefIdx);
1243   }
1244
1245   if(pExcepInfo == &ExcepInfo)
1246   {
1247     SysFreeString(pExcepInfo->bstrSource);
1248     SysFreeString(pExcepInfo->bstrDescription);
1249     SysFreeString(pExcepInfo->bstrHelpFile);
1250   }
1251   return hr;
1252 }
1253
1254 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1255     IDispatch* This,
1256     DISPID dispIdMember,
1257     REFIID riid,
1258     LCID lcid,
1259     DWORD dwFlags,
1260     DISPPARAMS* pDispParams,
1261     VARIANT* pVarResult,
1262     EXCEPINFO* pExcepInfo,
1263     UINT* pArgErr,
1264     UINT cVarRef,
1265     UINT* rgVarRefIdx,
1266     VARIANTARG* rgVarRef)
1267 {
1268   HRESULT hr = S_OK;
1269   VARIANTARG *rgvarg, *arg;
1270   UINT u;
1271
1272   /* initialize out parameters, so that they can be marshalled
1273    * in case the real Invoke doesn't initialize them */
1274   VariantInit(pVarResult);
1275   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1276   *pArgErr = 0;
1277
1278   /* let the real Invoke operate on a copy of the in parameters,
1279    * so we don't risk losing pointers to allocated memory */
1280   rgvarg = pDispParams->rgvarg;
1281   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1282   if (!arg) return E_OUTOFMEMORY;
1283
1284   /* init all args so we can call VariantClear on all the args if the copy
1285    * below fails */
1286   for (u = 0; u < pDispParams->cArgs; u++)
1287     VariantInit(&arg[u]);
1288
1289   for (u = 0; u < pDispParams->cArgs; u++) {
1290     hr = VariantCopy(&arg[u], &rgvarg[u]);
1291     if (FAILED(hr))
1292         break;
1293   }
1294
1295   if (SUCCEEDED(hr)) {
1296     /* copy ref args to arg array */
1297     for (u=0; u<cVarRef; u++) {
1298       unsigned i = rgVarRefIdx[u];
1299       VariantCopy(&arg[i], &rgVarRef[u]);
1300     }
1301
1302     pDispParams->rgvarg = arg;
1303
1304     hr = IDispatch_Invoke(This,
1305                           dispIdMember,
1306                           riid,
1307                           lcid,
1308                           dwFlags,
1309                           pDispParams,
1310                           pVarResult,
1311                           pExcepInfo,
1312                           pArgErr);
1313
1314     /* copy ref args from arg array */
1315     for (u=0; u<cVarRef; u++) {
1316       unsigned i = rgVarRefIdx[u];
1317       VariantCopy(&rgVarRef[u], &arg[i]);
1318     }
1319   }
1320
1321   /* clear the duplicate argument list */
1322   for (u=0; u<pDispParams->cArgs; u++)
1323     VariantClear(&arg[u]);
1324
1325   pDispParams->rgvarg = rgvarg;
1326   CoTaskMemFree(arg);
1327
1328   return hr;
1329 }
1330
1331 /* IEnumVARIANT */
1332
1333 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1334     IEnumVARIANT* This,
1335     ULONG celt,
1336     VARIANT* rgVar,
1337     ULONG* pCeltFetched)
1338 {
1339   ULONG fetched;
1340   if (!pCeltFetched)
1341     pCeltFetched = &fetched;
1342   return IEnumVARIANT_RemoteNext_Proxy(This,
1343                                        celt,
1344                                        rgVar,
1345                                        pCeltFetched);
1346 }
1347
1348 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1349     IEnumVARIANT* This,
1350     ULONG celt,
1351     VARIANT* rgVar,
1352     ULONG* pCeltFetched)
1353 {
1354   HRESULT hr;
1355   *pCeltFetched = 0;
1356   hr = IEnumVARIANT_Next(This,
1357                          celt,
1358                          rgVar,
1359                          pCeltFetched);
1360   if (hr == S_OK) *pCeltFetched = celt;
1361   return hr;
1362 }
1363
1364 /* TypeInfo related freers */
1365
1366 static void free_embedded_typedesc(TYPEDESC *tdesc);
1367 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1368 {
1369     switch(adesc->tdescElem.vt)
1370     {
1371     case VT_PTR:
1372     case VT_SAFEARRAY:
1373         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1374         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1375         break;
1376     case VT_CARRAY:
1377         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1378         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1379         break;
1380     }
1381 }
1382
1383 static void free_embedded_typedesc(TYPEDESC *tdesc)
1384 {
1385     switch(tdesc->vt)
1386     {
1387     case VT_PTR:
1388     case VT_SAFEARRAY:
1389         free_embedded_typedesc(tdesc->u.lptdesc);
1390         CoTaskMemFree(tdesc->u.lptdesc);
1391         break;
1392     case VT_CARRAY:
1393         free_embedded_arraydesc(tdesc->u.lpadesc);
1394         CoTaskMemFree(tdesc->u.lpadesc);
1395         break;
1396     }
1397 }
1398
1399 static void free_embedded_elemdesc(ELEMDESC *edesc)
1400 {
1401     free_embedded_typedesc(&edesc->tdesc);
1402     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1403         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1404 }
1405
1406 /* ITypeComp */
1407
1408 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1409     ITypeComp* This,
1410     LPOLESTR szName,
1411     ULONG lHashVal,
1412     WORD wFlags,
1413     ITypeInfo** ppTInfo,
1414     DESCKIND* pDescKind,
1415     BINDPTR* pBindPtr)
1416 {
1417   FIXME("not implemented\n");
1418   return E_FAIL;
1419 }
1420
1421 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1422     ITypeComp* This,
1423     LPOLESTR szName,
1424     ULONG lHashVal,
1425     WORD wFlags,
1426     ITypeInfo** ppTInfo,
1427     DESCKIND* pDescKind,
1428     LPFUNCDESC* ppFuncDesc,
1429     LPVARDESC* ppVarDesc,
1430     ITypeComp** ppTypeComp,
1431     CLEANLOCALSTORAGE* pDummy)
1432 {
1433   FIXME("not implemented\n");
1434   return E_FAIL;
1435 }
1436
1437 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1438     ITypeComp* This,
1439     LPOLESTR szName,
1440     ULONG lHashVal,
1441     ITypeInfo** ppTInfo,
1442     ITypeComp** ppTComp)
1443 {
1444   FIXME("not implemented\n");
1445   return E_FAIL;
1446 }
1447
1448 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1449     ITypeComp* This,
1450     LPOLESTR szName,
1451     ULONG lHashVal,
1452     ITypeInfo** ppTInfo)
1453 {
1454   FIXME("not implemented\n");
1455   return E_FAIL;
1456 }
1457
1458 /* ITypeInfo */
1459
1460 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1461     ITypeInfo* This,
1462     TYPEATTR** ppTypeAttr)
1463
1464 {
1465     CLEANLOCALSTORAGE stg;
1466     TRACE("(%p, %p)\n", This, ppTypeAttr);
1467
1468     stg.flags = 0;
1469     stg.pStorage = NULL;
1470     stg.pInterface = NULL;
1471
1472     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1473 }
1474
1475 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1476     ITypeInfo* This,
1477     LPTYPEATTR* ppTypeAttr,
1478     CLEANLOCALSTORAGE* pDummy)
1479 {
1480     HRESULT hr;
1481     TRACE("(%p, %p)\n", This, ppTypeAttr);
1482
1483     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1484     if(hr != S_OK)
1485         return hr;
1486
1487     pDummy->flags = CLS_TYPEATTR;
1488     ITypeInfo_AddRef(This);
1489     pDummy->pInterface = (IUnknown*)This;
1490     pDummy->pStorage = ppTypeAttr;
1491     return hr;
1492 }
1493
1494 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1495     ITypeInfo* This,
1496     UINT index,
1497     FUNCDESC** ppFuncDesc)
1498 {
1499     CLEANLOCALSTORAGE stg;
1500     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1501
1502     stg.flags = 0;
1503     stg.pStorage = NULL;
1504     stg.pInterface = NULL;
1505
1506     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1507 }
1508
1509 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1510     ITypeInfo* This,
1511     UINT index,
1512     LPFUNCDESC* ppFuncDesc,
1513     CLEANLOCALSTORAGE* pDummy)
1514 {
1515     HRESULT hr;
1516     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1517
1518     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1519     if(hr != S_OK)
1520         return hr;
1521
1522     pDummy->flags = CLS_FUNCDESC;
1523     ITypeInfo_AddRef(This);
1524     pDummy->pInterface = (IUnknown*)This;
1525     pDummy->pStorage = ppFuncDesc;
1526     return hr;
1527 }
1528
1529 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1530     ITypeInfo* This,
1531     UINT index,
1532     VARDESC** ppVarDesc)
1533 {
1534     CLEANLOCALSTORAGE stg;
1535     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1536
1537     stg.flags = 0;
1538     stg.pStorage = NULL;
1539     stg.pInterface = NULL;
1540
1541     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1542 }
1543
1544 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1545     ITypeInfo* This,
1546     UINT index,
1547     LPVARDESC* ppVarDesc,
1548     CLEANLOCALSTORAGE* pDummy)
1549 {
1550     HRESULT hr;
1551     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1552
1553     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1554     if(hr != S_OK)
1555         return hr;
1556
1557     pDummy->flags = CLS_VARDESC;
1558     ITypeInfo_AddRef(This);
1559     pDummy->pInterface = (IUnknown*)This;
1560     pDummy->pStorage = ppVarDesc;
1561     return hr;
1562 }
1563
1564 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1565     ITypeInfo* This,
1566     MEMBERID memid,
1567     BSTR* rgBstrNames,
1568     UINT cMaxNames,
1569     UINT* pcNames)
1570 {
1571     TRACE("(%p, %08x, %p, %d, %p)\n", This, memid, rgBstrNames, cMaxNames, pcNames);
1572
1573     return ITypeInfo_RemoteGetNames_Proxy(This, memid, rgBstrNames, cMaxNames, pcNames);
1574 }
1575
1576 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1577     ITypeInfo* This,
1578     MEMBERID memid,
1579     BSTR* rgBstrNames,
1580     UINT cMaxNames,
1581     UINT* pcNames)
1582 {
1583     TRACE("(%p, %08x, %p, %d, %p)\n", This, memid, rgBstrNames, cMaxNames, pcNames);
1584
1585     return ITypeInfo_GetNames(This, memid, rgBstrNames, cMaxNames, pcNames);
1586 }
1587
1588 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1589     ITypeInfo* This,
1590     LPOLESTR* rgszNames,
1591     UINT cNames,
1592     MEMBERID* pMemId)
1593 {
1594   FIXME("not implemented\n");
1595   return E_FAIL;
1596 }
1597
1598 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1599     ITypeInfo* This)
1600 {
1601   FIXME("not implemented\n");
1602   return E_FAIL;
1603 }
1604
1605 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1606     ITypeInfo* This,
1607     PVOID pvInstance,
1608     MEMBERID memid,
1609     WORD wFlags,
1610     DISPPARAMS* pDispParams,
1611     VARIANT* pVarResult,
1612     EXCEPINFO* pExcepInfo,
1613     UINT* puArgErr)
1614 {
1615   FIXME("not implemented\n");
1616   return E_FAIL;
1617 }
1618
1619 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1620     ITypeInfo* This)
1621 {
1622   FIXME("not implemented\n");
1623   return E_FAIL;
1624 }
1625
1626 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(ITypeInfo *This, MEMBERID memid,
1627                                                   BSTR *name, BSTR *doc_string,
1628                                                   DWORD *help_context, BSTR *help_file)
1629 {
1630     DWORD dummy_help_context, flags = 0;
1631     BSTR dummy_name, dummy_doc_string, dummy_help_file;
1632     HRESULT hr;
1633     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, name, doc_string, help_context, help_file);
1634
1635     if(!name) name = &dummy_name;
1636     else flags = 1;
1637
1638     if(!doc_string) doc_string = &dummy_doc_string;
1639     else flags |= 2;
1640
1641     if(!help_context) help_context = &dummy_help_context;
1642     else flags |= 4;
1643
1644     if(!help_file) help_file = &dummy_help_file;
1645     else flags |= 8;
1646
1647     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, flags, name, doc_string, help_context, help_file);
1648
1649     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1650
1651     return hr;
1652 }
1653
1654 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(ITypeInfo *This, MEMBERID memid,
1655                                                    DWORD flags, BSTR *name, BSTR *doc_string,
1656                                                    DWORD *help_context, BSTR *help_file)
1657 {
1658     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, flags, name, doc_string, help_context, help_file);
1659
1660     *name = *doc_string = *help_file = NULL;
1661     *help_context = 0;
1662
1663     if(!(flags & 1)) name = NULL;
1664     if(!(flags & 2)) doc_string = NULL;
1665     if(!(flags & 4)) help_context = NULL;
1666     if(!(flags & 8)) help_file = NULL;
1667
1668     return ITypeInfo_GetDocumentation(This, memid, name, doc_string, help_context, help_file);
1669 }
1670
1671 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(ITypeInfo *This, MEMBERID memid,
1672                                              INVOKEKIND invkind, BSTR *dll_name,
1673                                              BSTR* name, WORD *ordinal)
1674 {
1675     DWORD flags = 0;
1676     BSTR dummy_dll_name, dummy_name;
1677     WORD dummy_ordinal;
1678     HRESULT hr;
1679     TRACE("(%p, %08x, %x, %p, %p, %p)\n", This, memid, invkind, dll_name, name, ordinal);
1680
1681     if(!dll_name) dll_name = &dummy_dll_name;
1682     else flags = 1;
1683
1684     if(!name) name = &dummy_name;
1685     else flags |= 2;
1686
1687     if(!ordinal) ordinal = &dummy_ordinal;
1688     else flags |= 4;
1689
1690     hr = ITypeInfo_RemoteGetDllEntry_Proxy(This, memid, invkind, flags, dll_name, name, ordinal);
1691
1692     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1693
1694     return hr;
1695 }
1696
1697 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(ITypeInfo *This, MEMBERID memid,
1698                                               INVOKEKIND invkind, DWORD flags,
1699                                               BSTR *dll_name, BSTR *name,
1700                                               WORD *ordinal)
1701 {
1702     TRACE("(%p, %08x, %x, %p, %p, %p)\n", This, memid, invkind, dll_name, name, ordinal);
1703
1704     *dll_name = *name = NULL;
1705     *ordinal = 0;
1706
1707     if(!(flags & 1)) dll_name = NULL;
1708     if(!(flags & 2)) name = NULL;
1709     if(!(flags & 4)) ordinal = NULL;
1710
1711     return ITypeInfo_GetDllEntry(This, memid, invkind, dll_name, name, ordinal);
1712 }
1713
1714 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1715     ITypeInfo* This,
1716     MEMBERID memid,
1717     INVOKEKIND invKind,
1718     PVOID* ppv)
1719 {
1720   FIXME("not implemented\n");
1721   return E_FAIL;
1722 }
1723
1724 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1725     ITypeInfo* This)
1726 {
1727   FIXME("not implemented\n");
1728   return E_FAIL;
1729 }
1730
1731 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1732     ITypeInfo* This,
1733     IUnknown* pUnkOuter,
1734     REFIID riid,
1735     PVOID* ppvObj)
1736 {
1737   FIXME("not implemented\n");
1738   return E_FAIL;
1739 }
1740
1741 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1742     ITypeInfo* This,
1743     REFIID riid,
1744     IUnknown** ppvObj)
1745 {
1746   FIXME("not implemented\n");
1747   return E_FAIL;
1748 }
1749
1750 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1751     ITypeInfo* This,
1752     ITypeLib** ppTLib,
1753     UINT* pIndex)
1754 {
1755     ITypeLib *pTL;
1756     UINT index;
1757     HRESULT hr;
1758
1759     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1760
1761     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1762     if(SUCCEEDED(hr))
1763     {
1764         if(pIndex)
1765             *pIndex = index;
1766
1767         if(ppTLib)
1768             *ppTLib = pTL;
1769         else
1770             ITypeLib_Release(pTL);
1771     }
1772     return hr;
1773 }
1774
1775 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1776     ITypeInfo* This,
1777     ITypeLib** ppTLib,
1778     UINT* pIndex)
1779 {
1780     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1781     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1782 }
1783
1784 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1785     ITypeInfo* This,
1786     TYPEATTR* pTypeAttr)
1787 {
1788     TRACE("(%p, %p)\n", This, pTypeAttr);
1789     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1790     CoTaskMemFree(pTypeAttr);
1791 }
1792
1793 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1794     ITypeInfo* This)
1795 {
1796     TRACE("nothing to do\n");
1797     return S_OK;
1798 }
1799
1800 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1801     ITypeInfo* This,
1802     FUNCDESC* pFuncDesc)
1803 {
1804     SHORT param;
1805     TRACE("(%p, %p)\n", This, pFuncDesc);
1806
1807     for(param = 0; param < pFuncDesc->cParams; param++)
1808         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1809     if(param)
1810         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1811
1812     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1813
1814     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1815         CoTaskMemFree(pFuncDesc->lprgscode);
1816
1817     CoTaskMemFree(pFuncDesc);
1818 }
1819
1820 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1821     ITypeInfo* This)
1822 {
1823     TRACE("nothing to do\n");
1824     return S_OK;
1825 }
1826
1827 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1828     ITypeInfo* This,
1829     VARDESC* pVarDesc)
1830 {
1831     TRACE("(%p, %p)\n", This, pVarDesc);
1832
1833     CoTaskMemFree(pVarDesc->lpstrSchema);
1834
1835     if(pVarDesc->varkind == VAR_CONST)
1836         CoTaskMemFree(pVarDesc->u.lpvarValue);
1837
1838     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1839     CoTaskMemFree(pVarDesc);
1840 }
1841
1842 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1843     ITypeInfo* This)
1844 {
1845     TRACE("nothing to do\n");
1846     return S_OK;
1847 }
1848
1849
1850 /* ITypeInfo2 */
1851
1852 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(ITypeInfo2 *This, MEMBERID memid,
1853                                                     LCID lcid, BSTR *help_string,
1854                                                     DWORD *help_context, BSTR *help_dll)
1855 {
1856     DWORD dummy_help_context, flags = 0;
1857     BSTR dummy_help_string, dummy_help_dll;
1858     HRESULT hr;
1859     TRACE("(%p, %08x, %08x, %p, %p, %p)\n", This, memid, lcid, help_string, help_context, help_dll);
1860
1861     if(!help_string) help_string = &dummy_help_string;
1862     else flags = 1;
1863
1864     if(!help_context) help_context = &dummy_help_context;
1865     else flags |= 2;
1866
1867     if(!help_dll) help_dll = &dummy_help_dll;
1868     else flags |= 4;
1869
1870     hr = ITypeInfo2_RemoteGetDocumentation2_Proxy(This, memid, lcid, flags, help_string, help_context, help_dll);
1871
1872     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1873
1874     return hr;
1875 }
1876
1877 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(ITypeInfo2 *This, MEMBERID memid,
1878                                                      LCID lcid, DWORD flags,
1879                                                      BSTR *help_string, DWORD *help_context,
1880                                                      BSTR *help_dll)
1881 {
1882     TRACE("(%p, %08x, %08x, %08x, %p, %p, %p)\n", This, memid, lcid, flags, help_string, help_context, help_dll);
1883
1884     *help_string = *help_dll = NULL;
1885     *help_context = 0;
1886
1887     if(!(flags & 1)) help_string = NULL;
1888     if(!(flags & 2)) help_context = NULL;
1889     if(!(flags & 4)) help_dll = NULL;
1890
1891     return ITypeInfo2_GetDocumentation2(This, memid, lcid, help_string, help_context, help_dll);
1892 }
1893
1894 /* ITypeLib */
1895
1896 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1897     ITypeLib* This)
1898 {
1899     UINT count = 0;
1900     TRACE("(%p)\n", This);
1901
1902     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1903
1904     return count;
1905 }
1906
1907 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1908     ITypeLib* This,
1909     UINT* pcTInfo)
1910 {
1911     TRACE("(%p, %p)\n", This, pcTInfo);
1912     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1913     return S_OK;
1914 }
1915
1916 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1917     ITypeLib* This,
1918     TLIBATTR** ppTLibAttr)
1919 {
1920     CLEANLOCALSTORAGE stg;
1921     TRACE("(%p, %p)\n", This, ppTLibAttr);
1922
1923     stg.flags = 0;
1924     stg.pStorage = NULL;
1925     stg.pInterface = NULL;
1926
1927     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1928 }
1929
1930 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1931     ITypeLib* This,
1932     LPTLIBATTR* ppTLibAttr,
1933     CLEANLOCALSTORAGE* pDummy)
1934 {
1935     HRESULT hr;
1936     TRACE("(%p, %p)\n", This, ppTLibAttr);
1937
1938     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1939     if(hr != S_OK)
1940         return hr;
1941
1942     pDummy->flags = CLS_LIBATTR;
1943     ITypeLib_AddRef(This);
1944     pDummy->pInterface = (IUnknown*)This;
1945     pDummy->pStorage = ppTLibAttr;
1946     return hr;
1947 }
1948
1949 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(ITypeLib *This, INT index, BSTR *name,
1950                                                  BSTR *doc_string, DWORD *help_context,
1951                                                  BSTR *help_file)
1952 {
1953     DWORD dummy_help_context, flags = 0;
1954     BSTR dummy_name, dummy_doc_string, dummy_help_file;
1955     HRESULT hr;
1956     TRACE("(%p, %d, %p, %p, %p, %p)\n", This, index, name, doc_string, help_context, help_file);
1957
1958     if(!name) name = &dummy_name;
1959     else flags = 1;
1960
1961     if(!doc_string) doc_string = &dummy_doc_string;
1962     else flags |= 2;
1963
1964     if(!help_context) help_context = &dummy_help_context;
1965     else flags |= 4;
1966
1967     if(!help_file) help_file = &dummy_help_file;
1968     else flags |= 8;
1969
1970     hr = ITypeLib_RemoteGetDocumentation_Proxy(This, index, flags, name, doc_string, help_context, help_file);
1971
1972     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1973
1974     return hr;
1975 }
1976
1977 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(ITypeLib *This, INT index, DWORD flags,
1978                                                   BSTR *name, BSTR *doc_string,
1979                                                   DWORD *help_context, BSTR *help_file)
1980 {
1981     TRACE("(%p, %d, %08x, %p, %p, %p, %p)\n", This, index, flags, name, doc_string, help_context, help_file);
1982
1983     *name = *doc_string = *help_file = NULL;
1984     *help_context = 0;
1985
1986     if(!(flags & 1)) name = NULL;
1987     if(!(flags & 2)) doc_string = NULL;
1988     if(!(flags & 4)) help_context = NULL;
1989     if(!(flags & 8)) help_file = NULL;
1990
1991     return ITypeLib_GetDocumentation(This, index, name, doc_string, help_context, help_file);
1992 }
1993
1994 HRESULT CALLBACK ITypeLib_IsName_Proxy(
1995     ITypeLib* This,
1996     LPOLESTR szNameBuf,
1997     ULONG lHashVal,
1998     BOOL* pfName)
1999 {
2000   FIXME("not implemented\n");
2001   return E_FAIL;
2002 }
2003
2004 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
2005     ITypeLib* This,
2006     LPOLESTR szNameBuf,
2007     ULONG lHashVal,
2008     BOOL* pfName,
2009     BSTR* pBstrLibName)
2010 {
2011   FIXME("not implemented\n");
2012   return E_FAIL;
2013 }
2014
2015 HRESULT CALLBACK ITypeLib_FindName_Proxy(
2016     ITypeLib* This,
2017     LPOLESTR szNameBuf,
2018     ULONG lHashVal,
2019     ITypeInfo** ppTInfo,
2020     MEMBERID* rgMemId,
2021     USHORT* pcFound)
2022 {
2023   FIXME("not implemented\n");
2024   return E_FAIL;
2025 }
2026
2027 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
2028     ITypeLib* This,
2029     LPOLESTR szNameBuf,
2030     ULONG lHashVal,
2031     ITypeInfo** ppTInfo,
2032     MEMBERID* rgMemId,
2033     USHORT* pcFound,
2034     BSTR* pBstrLibName)
2035 {
2036   FIXME("not implemented\n");
2037   return E_FAIL;
2038 }
2039
2040 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
2041     ITypeLib* This,
2042     TLIBATTR* pTLibAttr)
2043 {
2044     TRACE("(%p, %p)\n", This, pTLibAttr);
2045     CoTaskMemFree(pTLibAttr);
2046 }
2047
2048 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
2049     ITypeLib* This)
2050 {
2051     TRACE("nothing to do\n");
2052     return S_OK;
2053 }
2054
2055
2056 /* ITypeLib2 */
2057
2058 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
2059     ITypeLib2* This,
2060     ULONG* pcUniqueNames,
2061     ULONG* pcchUniqueNames)
2062 {
2063   FIXME("not implemented\n");
2064   return E_FAIL;
2065 }
2066
2067 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
2068     ITypeLib2* This,
2069     ULONG* pcUniqueNames,
2070     ULONG* pcchUniqueNames)
2071 {
2072   FIXME("not implemented\n");
2073   return E_FAIL;
2074 }
2075
2076 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(ITypeLib2 *This, INT index,
2077                                                    LCID lcid, BSTR *help_string,
2078                                                    DWORD *help_context, BSTR *help_dll)
2079 {
2080     DWORD dummy_help_context, flags = 0;
2081     BSTR dummy_help_string, dummy_help_dll;
2082     HRESULT hr;
2083     TRACE("(%p, %d, %08x, %p, %p, %p)\n", This, index, lcid, help_string, help_context, help_dll);
2084
2085     if(!help_string) help_string = &dummy_help_string;
2086     else flags = 1;
2087
2088     if(!help_context) help_context = &dummy_help_context;
2089     else flags |= 2;
2090
2091     if(!help_dll) help_dll = &dummy_help_dll;
2092     else flags |= 4;
2093
2094     hr = ITypeLib2_RemoteGetDocumentation2_Proxy(This, index, lcid, flags, help_string, help_context, help_dll);
2095
2096     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
2097
2098     return hr;
2099 }
2100
2101 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(ITypeLib2 *This, INT index, LCID lcid,
2102                                                     DWORD flags, BSTR *help_string,
2103                                                     DWORD *help_context, BSTR *help_dll)
2104 {
2105     TRACE("(%p, %d, %08x, %08x, %p, %p, %p)\n", This, index, lcid, flags, help_string, help_context, help_dll);
2106
2107     *help_string = *help_dll = NULL;
2108     *help_context = 0;
2109
2110     if(!(flags & 1)) help_string = NULL;
2111     if(!(flags & 2)) help_context = NULL;
2112     if(!(flags & 4)) help_dll = NULL;
2113
2114     return ITypeLib2_GetDocumentation2(This, index, lcid, help_string, help_context, help_dll);
2115 }
2116
2117 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2118     IPropertyBag* This,
2119     LPCOLESTR pszPropName,
2120     VARIANT *pVar,
2121     IErrorLog *pErrorLog)
2122 {
2123   IUnknown *pUnk = NULL;
2124   TRACE("(%p, %s, %p, %p)\n", This, debugstr_w(pszPropName), pVar, pErrorLog);
2125
2126   if(!pVar)
2127     return E_POINTER;
2128
2129   if(V_VT(pVar) & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2130   {
2131     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2132     return E_NOTIMPL;
2133   }
2134
2135   switch(V_VT(pVar))
2136   {
2137     case VT_DISPATCH:
2138       pUnk = (IUnknown*)V_DISPATCH(pVar);
2139       break;
2140     case VT_UNKNOWN:
2141       pUnk = V_UNKNOWN(pVar);
2142       break;
2143     case VT_SAFEARRAY:
2144       FIXME("Safearray support not yet implemented.\n");
2145       return E_NOTIMPL;
2146     default:
2147       FIXME("Unknown V_VT %d - support not yet implemented.\n", V_VT(pVar));
2148       return E_NOTIMPL;
2149   }
2150
2151   return IPropertyBag_RemoteRead_Proxy(This, pszPropName, pVar, pErrorLog,
2152                                        V_VT(pVar), pUnk);
2153 }
2154
2155 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2156     IPropertyBag* This,
2157     LPCOLESTR pszPropName,
2158     VARIANT *pVar,
2159     IErrorLog *pErrorLog,
2160     DWORD varType,
2161     IUnknown *pUnkObj)
2162 {
2163   static const WCHAR emptyWstr[] = {0};
2164   IDispatch *disp;
2165   HRESULT hr;
2166   TRACE("(%p, %s, %p, %p, %x, %p)\n", This, debugstr_w(pszPropName), pVar,
2167                                      pErrorLog, varType, pUnkObj);
2168
2169   if(varType & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2170   {
2171     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2172     return E_NOTIMPL;
2173   }
2174
2175   V_VT(pVar) = varType;
2176   switch(varType)
2177   {
2178     case VT_DISPATCH:
2179       hr = IUnknown_QueryInterface(pUnkObj, &IID_IDispatch, (LPVOID*)&disp);
2180       if(FAILED(hr))
2181         return hr;
2182       IUnknown_Release(pUnkObj);
2183       V_DISPATCH(pVar) = disp;
2184       break;
2185     case VT_UNKNOWN:
2186       V_UNKNOWN(pVar) = pUnkObj;
2187       break;
2188     case VT_BSTR:
2189       V_BSTR(pVar) = SysAllocString(emptyWstr);
2190       break;
2191     case VT_SAFEARRAY:
2192       FIXME("Safearray support not yet implemented.\n");
2193       return E_NOTIMPL;
2194     default:
2195       break;
2196   }
2197   hr = IPropertyBag_Read(This, pszPropName, pVar, pErrorLog);
2198   if(FAILED(hr))
2199     VariantClear(pVar);
2200
2201   return hr;
2202 }
2203
2204 /* call_as/local stubs for ocidl.idl */
2205
2206 HRESULT CALLBACK IClassFactory2_CreateInstanceLic_Proxy(
2207     IClassFactory2* This,
2208     IUnknown *pUnkOuter,
2209     IUnknown *pUnkReserved,
2210     REFIID riid,
2211     BSTR bstrKey,
2212     PVOID *ppvObj)
2213 {
2214     TRACE("(%p, %s, %p)\n", pUnkOuter, debugstr_guid(riid), ppvObj);
2215
2216     *ppvObj = NULL;
2217
2218     if (pUnkOuter)
2219     {
2220         ERR("aggregation is not allowed on remote objects\n");
2221         return CLASS_E_NOAGGREGATION;
2222     }
2223
2224     return IClassFactory2_RemoteCreateInstanceLic_Proxy(This, riid, bstrKey, (IUnknown**)ppvObj);
2225 }
2226
2227 HRESULT __RPC_STUB IClassFactory2_CreateInstanceLic_Stub(
2228     IClassFactory2* This,
2229     REFIID riid,
2230     BSTR bstrKey,
2231     IUnknown **ppvObj)
2232 {
2233     TRACE("(%s, %p)\n", debugstr_guid(riid), ppvObj);
2234     return IClassFactory2_CreateInstanceLic(This, NULL, NULL, riid, bstrKey, (void**)ppvObj);
2235 }
2236
2237 HRESULT CALLBACK IEnumConnections_Next_Proxy(
2238     IEnumConnections* This,
2239     ULONG cConnections,
2240     LPCONNECTDATA rgcd,
2241     ULONG *pcFetched)
2242 {
2243     ULONG fetched;
2244
2245     TRACE("(%u, %p %p)\n", cConnections, rgcd, pcFetched);
2246
2247     if (!pcFetched)
2248         pcFetched = &fetched;
2249
2250     return IEnumConnections_RemoteNext_Proxy(This, cConnections, rgcd, pcFetched);
2251 }
2252
2253 HRESULT __RPC_STUB IEnumConnections_Next_Stub(
2254     IEnumConnections* This,
2255     ULONG cConnections,
2256     LPCONNECTDATA rgcd,
2257     ULONG *pcFetched)
2258 {
2259     HRESULT hr;
2260
2261     TRACE("(%u, %p, %p)\n", cConnections, rgcd, pcFetched);
2262
2263     *pcFetched = 0;
2264     hr = IEnumConnections_Next(This, cConnections, rgcd, pcFetched);
2265     if (hr == S_OK)
2266         *pcFetched = cConnections;
2267
2268     return hr;
2269 }
2270
2271 HRESULT CALLBACK IEnumConnectionPoints_Next_Proxy(
2272     IEnumConnectionPoints* This,
2273     ULONG cConnections,
2274     IConnectionPoint **ppCP,
2275     ULONG *pcFetched)
2276 {
2277     ULONG fetched;
2278
2279     TRACE("(%u, %p %p)\n", cConnections, ppCP, pcFetched);
2280
2281     if (!pcFetched)
2282         pcFetched = &fetched;
2283
2284     return IEnumConnectionPoints_RemoteNext_Proxy(This, cConnections, ppCP, pcFetched);
2285 }
2286
2287 HRESULT __RPC_STUB IEnumConnectionPoints_Next_Stub(
2288     IEnumConnectionPoints* This,
2289     ULONG cConnections,
2290     IConnectionPoint **ppCP,
2291     ULONG *pcFetched)
2292 {
2293     HRESULT hr;
2294
2295     TRACE("(%u, %p, %p)\n", cConnections, ppCP, pcFetched);
2296
2297     *pcFetched = 0;
2298     hr = IEnumConnectionPoints_Next(This, cConnections, ppCP, pcFetched);
2299     if (hr == S_OK)
2300         *pcFetched = cConnections;
2301
2302     return hr;
2303 }
2304
2305 HRESULT CALLBACK IPersistMemory_Load_Proxy(
2306     IPersistMemory* This,
2307     LPVOID pMem,
2308     ULONG cbSize)
2309 {
2310     TRACE("(%p, %u)\n", pMem, cbSize);
2311
2312     if (!pMem)
2313         return E_POINTER;
2314
2315     return IPersistMemory_RemoteLoad_Proxy(This, pMem, cbSize);
2316 }
2317
2318 HRESULT __RPC_STUB IPersistMemory_Load_Stub(
2319     IPersistMemory* This,
2320     BYTE *pMem,
2321     ULONG cbSize)
2322 {
2323     TRACE("(%p, %u)\n", pMem, cbSize);
2324     return IPersistMemory_Load(This, pMem, cbSize);
2325 }
2326
2327 HRESULT CALLBACK IPersistMemory_Save_Proxy(
2328     IPersistMemory* This,
2329     LPVOID pMem,
2330     BOOL fClearDirty,
2331     ULONG cbSize)
2332 {
2333     TRACE("(%p, %d, %u)\n", pMem, fClearDirty, cbSize);
2334
2335     if (!pMem)
2336         return E_POINTER;
2337
2338     return IPersistMemory_RemoteSave_Proxy(This, pMem, fClearDirty, cbSize);
2339 }
2340
2341 HRESULT __RPC_STUB IPersistMemory_Save_Stub(
2342     IPersistMemory* This,
2343     BYTE *pMem,
2344     BOOL fClearDirty,
2345     ULONG cbSize)
2346 {
2347     TRACE("(%p, %d, %u)\n", pMem, fClearDirty, cbSize);
2348     return IPersistMemory_Save(This, pMem, fClearDirty, cbSize);
2349 }
2350
2351 void CALLBACK IAdviseSinkEx_OnViewStatusChange_Proxy(
2352     IAdviseSinkEx* This,
2353     DWORD dwViewStatus)
2354 {
2355     TRACE("(%p, 0x%08x)\n", This, dwViewStatus);
2356     IAdviseSinkEx_RemoteOnViewStatusChange_Proxy(This, dwViewStatus);
2357 }
2358
2359 HRESULT __RPC_STUB IAdviseSinkEx_OnViewStatusChange_Stub(
2360     IAdviseSinkEx* This,
2361     DWORD dwViewStatus)
2362 {
2363     TRACE("(%p, 0x%08x)\n", This, dwViewStatus);
2364     IAdviseSinkEx_OnViewStatusChange(This, dwViewStatus);
2365     return S_OK;
2366 }
2367
2368 HRESULT CALLBACK IEnumOleUndoUnits_Next_Proxy(
2369     IEnumOleUndoUnits* This,
2370     ULONG cElt,
2371     IOleUndoUnit **rgElt,
2372     ULONG *pcEltFetched)
2373 {
2374     ULONG fetched;
2375
2376     TRACE("(%u, %p %p)\n", cElt, rgElt, pcEltFetched);
2377
2378     if (!pcEltFetched)
2379         pcEltFetched = &fetched;
2380
2381     return IEnumOleUndoUnits_RemoteNext_Proxy(This, cElt, rgElt, pcEltFetched);
2382 }
2383
2384 HRESULT __RPC_STUB IEnumOleUndoUnits_Next_Stub(
2385     IEnumOleUndoUnits* This,
2386     ULONG cElt,
2387     IOleUndoUnit **rgElt,
2388     ULONG *pcEltFetched)
2389 {
2390     HRESULT hr;
2391
2392     TRACE("(%u, %p, %p)\n", cElt, rgElt, pcEltFetched);
2393
2394     *pcEltFetched = 0;
2395     hr = IEnumOleUndoUnits_Next(This, cElt, rgElt, pcEltFetched);
2396     if (hr == S_OK)
2397         *pcEltFetched = cElt;
2398
2399     return hr;
2400 }
2401
2402 HRESULT CALLBACK IQuickActivate_QuickActivate_Proxy(
2403     IQuickActivate* This,
2404     QACONTAINER *pQaContainer,
2405     QACONTROL *pQaControl)
2406 {
2407     FIXME("not implemented\n");
2408     return E_NOTIMPL;
2409 }
2410
2411 HRESULT __RPC_STUB IQuickActivate_QuickActivate_Stub(
2412     IQuickActivate* This,
2413     QACONTAINER *pQaContainer,
2414     QACONTROL *pQaControl)
2415 {
2416     FIXME("not implemented\n");
2417     return E_NOTIMPL;
2418 }