dlls/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #define COBJMACROS
  26 #define NONAMELESSUNION
  27
  28 #include "windef.h"
  29 #include "winbase.h"
  30 #include "wingdi.h"
  31 #include "winuser.h"
  32 #include "winerror.h"
  33
  34 #include "ole2.h"
  35 #include "oleauto.h"
  36 #include "typelib.h"
  37 #include "ocidl.h"
  38 #include "wine/debug.h"
  39
  40 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  41
  42 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  43 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  44 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  45 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  46
  47 /* ole32 exports those, not defined in public headers */
  48 ULONG __RPC_USER WdtpInterfacePointer_UserSize(ULONG*, ULONG, ULONG, IUnknown*, REFIID);
  49 unsigned char * __RPC_USER WdtpInterfacePointer_UserMarshal(ULONG*, ULONG, unsigned char*, IUnknown*, REFIID);
  50 unsigned char * __RPC_USER WdtpInterfacePointer_UserUnmarshal(ULONG*, unsigned char*, IUnknown**, REFIID);
  51
  52 static void dump_user_flags(const ULONG *pFlags)
  53 {
  54     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  55         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  56     else
  57         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  58     switch (LOWORD(*pFlags))
  59     {
  60         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  61         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  62         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  63         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  64         default: TRACE("%d)", LOWORD(*pFlags));
  65     }
  66 }
  67
  68 /* CLEANLOCALSTORAGE */
  69
  70 #define CLS_FUNCDESC  'f'
  71 #define CLS_LIBATTR   'l'
  72 #define CLS_TYPEATTR  't'
  73 #define CLS_VARDESC   'v'
  74
  75 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  76 {
  77     ALIGN_LENGTH(Start, 3);
  78     return Start + sizeof(DWORD);
  79 }
  80
  81 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  82 {
  83     ALIGN_POINTER(Buffer, 3);
  84     *(DWORD*)Buffer = pstg->flags;
  85     switch(pstg->flags)
  86     {
  87     case CLS_LIBATTR:
  88         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
  89         break;
  90     case CLS_TYPEATTR:
  91         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
  92         break;
  93     case CLS_FUNCDESC:
  94         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
  95         break;
  96     case CLS_VARDESC:
  97         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
  98         break;
  99
 100     default:
 101         ERR("Unknown type %x\n", pstg->flags);
 102     }
 103
 104     *(VOID**)pstg->pStorage = NULL;
 105     IUnknown_Release(pstg->pInterface);
 106     pstg->pInterface = NULL;
 107
 108     return Buffer + sizeof(DWORD);
 109 }
 110
 111 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
 112 {
 113     ALIGN_POINTER(Buffer, 3);
 114     pstr->flags = *(DWORD*)Buffer;
 115     return Buffer + sizeof(DWORD);
 116 }
 117
 118 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
 119 {
 120     /* Nothing to do */
 121 }
 122
 123 /* BSTR */
 124
 125 typedef struct
 126 {
 127     DWORD len;          /* No. of chars not including trailing '\0' */
 128     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 129     DWORD len2;         /* == len */
 130 } bstr_wire_t;
 131
 132 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 133 {
 134     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 135     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 136     ALIGN_LENGTH(Start, 3);
 137     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 138     TRACE("returning %d\n", Start);
 139     return Start;
 140 }
 141
 142 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 143 {
 144     bstr_wire_t *header;
 145     DWORD len = SysStringByteLen(*pstr);
 146
 147     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 148     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 149
 150     ALIGN_POINTER(Buffer, 3);
 151     header = (bstr_wire_t*)Buffer;
 152     header->len = header->len2 = (len + 1) / 2;
 153     if (*pstr)
 154     {
 155         header->byte_len = len;
 156         memcpy(header + 1, *pstr, header->len * 2);
 157     }
 158     else
 159         header->byte_len = 0xffffffff; /* special case for a null bstr */
 160
 161     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 162 }
 163
 164 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 165 {
 166     bstr_wire_t *header;
 167     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 168
 169     ALIGN_POINTER(Buffer, 3);
 170     header = (bstr_wire_t*)Buffer;
 171     if(header->len != header->len2)
 172         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 173
 174     if (header->byte_len == 0xffffffff)
 175     {
 176         SysFreeString(*pstr);
 177         *pstr = NULL;
 178     }
 179     else SysReAllocStringLen( pstr, (OLECHAR *)(header + 1), header->len );
 180
 181     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 182     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 183 }
 184
 185 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 186 {
 187     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 188     SysFreeString(*pstr);
 189     *pstr = NULL;
 190 }
 191
 192 /* VARIANT */
 193
 194 typedef struct
 195 {
 196     DWORD clSize;
 197     DWORD rpcReserved;
 198     USHORT vt;
 199     USHORT wReserved1;
 200     USHORT wReserved2;
 201     USHORT wReserved3;
 202     DWORD switch_is;
 203 } variant_wire_t;
 204
 205 unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 206 {
 207     if (vt & VT_ARRAY) return 4;
 208
 209     switch (vt & ~VT_BYREF) {
 210     case VT_EMPTY:
 211     case VT_NULL:
 212         return 0;
 213     case VT_I1:
 214     case VT_UI1:
 215         return sizeof(CHAR);
 216     case VT_I2:
 217     case VT_UI2:
 218         return sizeof(SHORT);
 219     case VT_I4:
 220     case VT_UI4:
 221     case VT_HRESULT:
 222         return sizeof(LONG);
 223     case VT_INT:
 224     case VT_UINT:
 225         return sizeof(INT);
 226     case VT_R4:
 227         return sizeof(FLOAT);
 228     case VT_R8:
 229         return sizeof(DOUBLE);
 230     case VT_BOOL:
 231         return sizeof(VARIANT_BOOL);
 232     case VT_ERROR:
 233         return sizeof(SCODE);
 234     case VT_DATE:
 235         return sizeof(DATE);
 236     case VT_CY:
 237         return sizeof(CY);
 238     case VT_DECIMAL:
 239         return sizeof(DECIMAL);
 240     case VT_BSTR:
 241         return sizeof(ULONG);
 242     case VT_VARIANT:
 243         return sizeof(VARIANT);
 244     case VT_UNKNOWN:
 245     case VT_DISPATCH:
 246     case VT_RECORD:
 247         return 0;
 248     default:
 249         FIXME("unhandled VT %d\n", vt);
 250         return 0;
 251     }
 252 }
 253
 254 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 255 {
 256     unsigned int size = get_type_size(pFlags, vt);
 257     if(vt & VT_BYREF) return 3;
 258     if(size == 0) return 0;
 259     if(size <= 4) return size - 1;
 260     return 7;
 261 }
 262
 263 /* WdtpInterfacePointer_UserSize takes care of 2 additional DWORDs to store marshalling buffer size */
 264 static unsigned interface_variant_size(ULONG *pFlags, REFIID riid, IUnknown *punk)
 265 {
 266     ULONG size = 0;
 267
 268     if (punk)
 269     {
 270         size = WdtpInterfacePointer_UserSize(pFlags, LOWORD(*pFlags), 0, punk, riid);
 271         if (!size)
 272         {
 273             ERR("interface variant buffer size calculation failed\n");
 274             return 0;
 275         }
 276     }
 277     size += sizeof(ULONG);
 278     TRACE("wire-size extra of interface variant is %d\n", size);
 279     return size;
 280 }
 281
 282 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 283 {
 284   if (V_ISARRAY(pvar))
 285   {
 286     if (V_ISBYREF(pvar))
 287       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 288     else
 289       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 290   }
 291
 292   switch (V_VT(pvar)) {
 293   case VT_BSTR:
 294     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 295   case VT_BSTR | VT_BYREF:
 296     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 297   case VT_VARIANT | VT_BYREF:
 298     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 299   case VT_UNKNOWN:
 300     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 301   case VT_UNKNOWN | VT_BYREF:
 302     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 303   case VT_DISPATCH:
 304     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 305   case VT_DISPATCH | VT_BYREF:
 306     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 307   case VT_RECORD:
 308     FIXME("wire-size record\n");
 309     return Start;
 310   case VT_SAFEARRAY:
 311   case VT_SAFEARRAY | VT_BYREF:
 312     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 313     return Start;
 314   default:
 315     return Start;
 316   }
 317 }
 318
 319 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer */
 320 static unsigned char* interface_variant_marshal(ULONG *pFlags, unsigned char *Buffer,
 321                                                 REFIID riid, IUnknown *punk)
 322 {
 323   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 324
 325   /* first DWORD is used to store pointer itself, truncated on win64 */
 326   if(!punk)
 327   {
 328       memset(Buffer, 0, sizeof(ULONG));
 329       return Buffer + sizeof(ULONG);
 330   }
 331   else
 332   {
 333       *(DWORD*)Buffer = (DWORD_PTR)punk;
 334       Buffer += sizeof(DWORD);
 335   }
 336
 337   return WdtpInterfacePointer_UserMarshal(pFlags, LOWORD(*pFlags), Buffer, punk, riid);
 338 }
 339
 340 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer */
 341 static unsigned char *interface_variant_unmarshal(ULONG *pFlags, unsigned char *Buffer,
 342                                                   REFIID riid, IUnknown **ppunk)
 343 {
 344   DWORD ptr;
 345
 346   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 347
 348   /* skip pointer part itself */
 349   ptr = *(DWORD*)Buffer;
 350   Buffer += sizeof(DWORD);
 351
 352   if(!ptr)
 353   {
 354       *ppunk = NULL;
 355       return Buffer;
 356   }
 357
 358   return WdtpInterfacePointer_UserUnmarshal(pFlags, Buffer, ppunk, riid);
 359 }
 360
 361 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 362 {
 363     int align;
 364     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 365     TRACE("vt=%04x\n", V_VT(pvar));
 366
 367     ALIGN_LENGTH(Start, 7);
 368     Start += sizeof(variant_wire_t);
 369     if(V_VT(pvar) & VT_BYREF)
 370         Start += 4;
 371
 372     align = get_type_alignment(pFlags, V_VT(pvar));
 373     ALIGN_LENGTH(Start, align);
 374     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 375         Start += 4;
 376     else
 377         Start += get_type_size(pFlags, V_VT(pvar));
 378     Start = wire_extra_user_size(pFlags, Start, pvar);
 379
 380     TRACE("returning %d\n", Start);
 381     return Start;
 382 }
 383
 384 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 385 {
 386     variant_wire_t *header;
 387     ULONG type_size;
 388     int align;
 389     unsigned char *Pos;
 390
 391     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 392     TRACE("vt=%04x\n", V_VT(pvar));
 393
 394     ALIGN_POINTER(Buffer, 7);
 395
 396     header = (variant_wire_t *)Buffer;
 397
 398     header->clSize = 0; /* fixed up at the end */
 399     header->rpcReserved = 0;
 400     header->vt = pvar->n1.n2.vt;
 401     header->wReserved1 = pvar->n1.n2.wReserved1;
 402     header->wReserved2 = pvar->n1.n2.wReserved2;
 403     header->wReserved3 = pvar->n1.n2.wReserved3;
 404     header->switch_is = pvar->n1.n2.vt;
 405     if(header->switch_is & VT_ARRAY)
 406         header->switch_is &= ~VT_TYPEMASK;
 407
 408     Pos = (unsigned char*)(header + 1);
 409     type_size = get_type_size(pFlags, V_VT(pvar));
 410     align = get_type_alignment(pFlags, V_VT(pvar));
 411     ALIGN_POINTER(Pos, align);
 412
 413     if(header->vt & VT_BYREF)
 414     {
 415         *(DWORD *)Pos = max(type_size, 4);
 416         Pos += 4;
 417         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 418         {
 419             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 420             Pos += type_size;
 421         }
 422         else
 423         {
 424             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 425             Pos += 4;
 426         }
 427     }
 428     else
 429     {
 430         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 431             memcpy(Pos, pvar, type_size);
 432         else
 433             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 434         Pos += type_size;
 435     }
 436
 437     if(header->vt & VT_ARRAY)
 438     {
 439         if(header->vt & VT_BYREF)
 440             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 441         else
 442             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 443     }
 444     else
 445     {
 446         switch (header->vt)
 447         {
 448         case VT_BSTR:
 449             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 450             break;
 451         case VT_BSTR | VT_BYREF:
 452             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 453             break;
 454         case VT_VARIANT | VT_BYREF:
 455             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 456             break;
 457         case VT_UNKNOWN:
 458             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 459             break;
 460         case VT_UNKNOWN | VT_BYREF:
 461             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 462             break;
 463         case VT_DISPATCH:
 464             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 465             break;
 466         case VT_DISPATCH | VT_BYREF:
 467             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 468             break;
 469         case VT_RECORD:
 470             FIXME("handle BRECORD by val\n");
 471             break;
 472         case VT_RECORD | VT_BYREF:
 473             FIXME("handle BRECORD by ref\n");
 474             break;
 475         }
 476     }
 477     header->clSize = ((Pos - Buffer) + 7) >> 3;
 478     TRACE("marshalled size=%d\n", header->clSize);
 479     return Pos;
 480 }
 481
 482 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 483 {
 484     variant_wire_t *header;
 485     ULONG type_size;
 486     int align;
 487     unsigned char *Pos;
 488
 489     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 490
 491     ALIGN_POINTER(Buffer, 7);
 492
 493     header = (variant_wire_t *)Buffer;
 494
 495     Pos = (unsigned char*)(header + 1);
 496     type_size = get_type_size(pFlags, header->vt);
 497     align = get_type_alignment(pFlags, header->vt);
 498     ALIGN_POINTER(Pos, align);
 499
 500     if(header->vt & VT_BYREF)
 501     {
 502         ULONG mem_size;
 503         Pos += 4;
 504
 505         switch (header->vt & ~VT_BYREF)
 506         {
 507         /* these types have a different memory size compared to wire size */
 508         case VT_UNKNOWN:
 509         case VT_DISPATCH:
 510         case VT_BSTR:
 511             mem_size = sizeof(void *);
 512             break;
 513         default:
 514             mem_size = type_size;
 515             break;
 516         }
 517
 518         if (V_VT(pvar) != header->vt)
 519         {
 520             VariantClear(pvar);
 521             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 522         }
 523         else if (!V_BYREF(pvar))
 524             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 525         memcpy(V_BYREF(pvar), Pos, type_size);
 526         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 527             Pos += type_size;
 528         else
 529             Pos += 4;
 530     }
 531     else
 532     {
 533         VariantClear(pvar);
 534         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 535             memcpy(pvar, Pos, type_size);
 536         else
 537             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 538         Pos += type_size;
 539     }
 540
 541     pvar->n1.n2.vt = header->vt;
 542     pvar->n1.n2.wReserved1 = header->wReserved1;
 543     pvar->n1.n2.wReserved2 = header->wReserved2;
 544     pvar->n1.n2.wReserved3 = header->wReserved3;
 545
 546     if(header->vt & VT_ARRAY)
 547     {
 548         if(header->vt & VT_BYREF)
 549             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 550         else
 551             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 552     }
 553     else
 554     {
 555         switch (header->vt)
 556         {
 557         case VT_BSTR:
 558             V_BSTR(pvar) = NULL;
 559             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 560             break;
 561         case VT_BSTR | VT_BYREF:
 562             *V_BSTRREF(pvar) = NULL;
 563             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 564             break;
 565         case VT_VARIANT | VT_BYREF:
 566             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 567             break;
 568         case VT_UNKNOWN:
 569             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 570             break;
 571         case VT_UNKNOWN | VT_BYREF:
 572             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 573             break;
 574         case VT_DISPATCH:
 575             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 576             break;
 577         case VT_DISPATCH | VT_BYREF:
 578             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 579             break;
 580         case VT_RECORD:
 581             FIXME("handle BRECORD by val\n");
 582             break;
 583         case VT_RECORD | VT_BYREF:
 584             FIXME("handle BRECORD by ref\n");
 585             break;
 586         }
 587     }
 588     return Pos;
 589 }
 590
 591 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 592 {
 593   VARTYPE vt = V_VT(pvar);
 594   PVOID ref = NULL;
 595
 596   TRACE("(%x,%p)\n", *pFlags, pvar);
 597   TRACE("vt=%04x\n", V_VT(pvar));
 598
 599   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 600
 601   VariantClear(pvar);
 602   if (!ref) return;
 603
 604   if(vt & VT_ARRAY)
 605   {
 606     if (vt & VT_BYREF)
 607       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 608     else
 609       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 610   }
 611   else
 612   {
 613     switch (vt)
 614     {
 615     case VT_BSTR | VT_BYREF:
 616       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 617       break;
 618     case VT_VARIANT | VT_BYREF:
 619       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 620       break;
 621     case VT_RECORD | VT_BYREF:
 622       FIXME("handle BRECORD by ref\n");
 623       break;
 624     case VT_UNKNOWN | VT_BYREF:
 625     case VT_DISPATCH | VT_BYREF:
 626       IUnknown_Release(*V_UNKNOWNREF(pvar));
 627       break;
 628     }
 629   }
 630
 631   CoTaskMemFree(ref);
 632 }
 633
 634 /* LPSAFEARRAY */
 635
 636 /* Get the number of cells in a SafeArray */
 637 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 638 {
 639     const SAFEARRAYBOUND* psab = psa->rgsabound;
 640     USHORT cCount = psa->cDims;
 641     ULONG ulNumCells = 1;
 642
 643     while (cCount--)
 644     {
 645         /* This is a valid bordercase. See testcases. -Marcus */
 646         if (!psab->cElements)
 647             return 0;
 648         ulNumCells *= psab->cElements;
 649         psab++;
 650     }
 651     return ulNumCells;
 652 }
 653
 654 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 655 {
 656     VARTYPE vt;
 657     HRESULT hr;
 658
 659     hr = SafeArrayGetVartype(psa, &vt);
 660     if (FAILED(hr))
 661     {
 662         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 663
 664         switch(psa->cbElements)
 665         {
 666         case 1: vt = VT_I1; break;
 667         case 2: vt = VT_I2; break;
 668         case 4: vt = VT_I4; break;
 669         case 8: vt = VT_I8; break;
 670         default:
 671             RpcRaiseException(hr);
 672         }
 673     }
 674
 675     if (psa->fFeatures & FADF_HAVEIID)
 676         return SF_HAVEIID;
 677
 678     switch (vt)
 679     {
 680     case VT_I1:
 681     case VT_UI1:      return SF_I1;
 682     case VT_BOOL:
 683     case VT_I2:
 684     case VT_UI2:      return SF_I2;
 685     case VT_INT:
 686     case VT_UINT:
 687     case VT_I4:
 688     case VT_UI4:
 689     case VT_R4:       return SF_I4;
 690     case VT_DATE:
 691     case VT_CY:
 692     case VT_R8:
 693     case VT_I8:
 694     case VT_UI8:      return SF_I8;
 695     case VT_INT_PTR:
 696     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 697     case VT_BSTR:     return SF_BSTR;
 698     case VT_DISPATCH: return SF_DISPATCH;
 699     case VT_VARIANT:  return SF_VARIANT;
 700     case VT_UNKNOWN:  return SF_UNKNOWN;
 701     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 702      * of a UDT is taken from the result of IRecordInfo_GetSize().
 703      */
 704     case VT_RECORD:   return SF_RECORD;
 705     default:          return SF_ERROR;
 706     }
 707 }
 708
 709 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 710 {
 711     if (sftype == SF_BSTR)
 712         return sizeof(DWORD);
 713     else if (sftype == SF_VARIANT)
 714         return sizeof(variant_wire_t) - sizeof(DWORD);
 715     else
 716         return lpsa->cbElements;
 717 }
 718
 719 static DWORD elem_mem_size(wireSAFEARRAY wiresa, SF_TYPE sftype)
 720 {
 721     if (sftype == SF_BSTR)
 722         return sizeof(BSTR);
 723     else if (sftype == SF_VARIANT)
 724         return sizeof(VARIANT);
 725     else
 726         return wiresa->cbElements;
 727 }
 728
 729 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 730 {
 731     ULONG size = StartingSize;
 732
 733     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 734
 735     ALIGN_LENGTH(size, 3);
 736     size += sizeof(ULONG);
 737     if (*ppsa)
 738     {
 739         SAFEARRAY *psa = *ppsa;
 740         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 741         SF_TYPE sftype;
 742         HRESULT hr;
 743
 744         size += sizeof(ULONG);
 745         size += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 746
 747         sftype = SAFEARRAY_GetUnionType(psa);
 748         size += sizeof(ULONG);
 749
 750         size += sizeof(ULONG);
 751         size += sizeof(ULONG);
 752         if (sftype == SF_HAVEIID)
 753             size += sizeof(IID);
 754
 755         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 756
 757         size += sizeof(ULONG);
 758
 759         switch (sftype)
 760         {
 761             case SF_BSTR:
 762             {
 763                 BSTR* lpBstr;
 764
 765                 for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 766                     size = BSTR_UserSize(pFlags, size, lpBstr);
 767
 768                 break;
 769             }
 770             case SF_DISPATCH:
 771             case SF_UNKNOWN:
 772             case SF_HAVEIID:
 773                 FIXME("size interfaces\n");
 774                 break;
 775             case SF_VARIANT:
 776             {
 777                 VARIANT* lpVariant;
 778
 779                 for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 780                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 781
 782                 break;
 783             }
 784             case SF_RECORD:
 785             {
 786                 IRecordInfo* pRecInfo = NULL;
 787
 788                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 789                 if (FAILED(hr))
 790                     RpcRaiseException(hr);
 791
 792                 if (pRecInfo)
 793                 {
 794                     FIXME("size record info %p\n", pRecInfo);
 795
 796                     IRecordInfo_Release(pRecInfo);
 797                 }
 798                 break;
 799             }
 800             case SF_I8:
 801                 ALIGN_LENGTH(size, 7);
 802                 /* fallthrough */
 803             case SF_I1:
 804             case SF_I2:
 805             case SF_I4:
 806                 size += ulCellCount * psa->cbElements;
 807                 break;
 808             default:
 809                 break;
 810         }
 811
 812     }
 813
 814     return size;
 815 }
 816
 817 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 818 {
 819     HRESULT hr;
 820
 821     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 822
 823     ALIGN_POINTER(Buffer, 3);
 824     *(ULONG *)Buffer = *ppsa ? 0x1 : 0x0;
 825     Buffer += sizeof(ULONG);
 826     if (*ppsa)
 827     {
 828         VARTYPE vt;
 829         SAFEARRAY *psa = *ppsa;
 830         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 831         SAFEARRAYBOUND *bound;
 832         SF_TYPE sftype;
 833         GUID guid;
 834         INT i;
 835
 836         sftype = SAFEARRAY_GetUnionType(psa);
 837
 838         *(ULONG *)Buffer = psa->cDims;
 839         Buffer += sizeof(ULONG);
 840         *(USHORT *)Buffer = psa->cDims;
 841         Buffer += sizeof(USHORT);
 842         *(USHORT *)Buffer = psa->fFeatures;
 843         Buffer += sizeof(USHORT);
 844         *(ULONG *)Buffer = elem_wire_size(psa, sftype);
 845         Buffer += sizeof(ULONG);
 846
 847         hr = SafeArrayGetVartype(psa, &vt);
 848         if (FAILED(hr)) vt = 0;
 849
 850         *(ULONG *)Buffer = (USHORT)psa->cLocks | (vt << 16);
 851         Buffer += sizeof(ULONG);
 852
 853         *(ULONG *)Buffer = sftype;
 854         Buffer += sizeof(ULONG);
 855
 856         *(ULONG *)Buffer = ulCellCount;
 857         Buffer += sizeof(ULONG);
 858         *(ULONG *)Buffer = psa->pvData ? 0x2 : 0x0;
 859         Buffer += sizeof(ULONG);
 860         if (sftype == SF_HAVEIID)
 861         {
 862             SafeArrayGetIID(psa, &guid);
 863             memcpy(Buffer, &guid, sizeof(guid));
 864             Buffer += sizeof(guid);
 865         }
 866
 867         /* bounds are marshaled in opposite order comparing to storage layout */
 868         bound = (SAFEARRAYBOUND*)Buffer;
 869         for (i = 0; i < psa->cDims; i++)
 870         {
 871             memcpy(bound++, &psa->rgsabound[psa->cDims-i-1], sizeof(psa->rgsabound[0]));
 872         }
 873         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 874
 875         *(ULONG *)Buffer = ulCellCount;
 876         Buffer += sizeof(ULONG);
 877
 878         if (psa->pvData)
 879         {
 880             switch (sftype)
 881             {
 882                 case SF_BSTR:
 883                 {
 884                     BSTR* lpBstr;
 885
 886                     for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 887                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 888
 889                     break;
 890                 }
 891                 case SF_DISPATCH:
 892                 case SF_UNKNOWN:
 893                 case SF_HAVEIID:
 894                     FIXME("marshal interfaces\n");
 895                     break;
 896                 case SF_VARIANT:
 897                 {
 898                     VARIANT* lpVariant;
 899
 900                     for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 901                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 902
 903                     break;
 904                 }
 905                 case SF_RECORD:
 906                 {
 907                     IRecordInfo* pRecInfo = NULL;
 908
 909                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 910                     if (FAILED(hr))
 911                         RpcRaiseException(hr);
 912
 913                     if (pRecInfo)
 914                     {
 915                         FIXME("write record info %p\n", pRecInfo);
 916
 917                         IRecordInfo_Release(pRecInfo);
 918                     }
 919                     break;
 920                 }
 921
 922                 case SF_I8:
 923                     ALIGN_POINTER(Buffer, 7);
 924                     /* fallthrough */
 925                 case SF_I1:
 926                 case SF_I2:
 927                 case SF_I4:
 928                     /* Just copy the data over */
 929                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
 930                     Buffer += ulCellCount * psa->cbElements;
 931                     break;
 932                 default:
 933                     break;
 934             }
 935         }
 936
 937     }
 938     return Buffer;
 939 }
 940
 941 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
 942                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
 943                            FADF_VARIANT | FADF_CREATEVECTOR)
 944
 945 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 946 {
 947     ULONG ptr;
 948     wireSAFEARRAY wiresa;
 949     ULONG cDims;
 950     HRESULT hr;
 951     SF_TYPE sftype;
 952     ULONG cell_count;
 953     GUID guid;
 954     VARTYPE vt;
 955     SAFEARRAYBOUND *wiresab;
 956
 957     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
 958
 959     ALIGN_POINTER(Buffer, 3);
 960     ptr = *(ULONG *)Buffer;
 961     Buffer += sizeof(ULONG);
 962
 963     if (!ptr)
 964     {
 965         *ppsa = NULL;
 966
 967         TRACE("NULL safe array unmarshaled\n");
 968
 969         return Buffer;
 970     }
 971
 972     cDims = *(ULONG *)Buffer;
 973     Buffer += sizeof(ULONG);
 974
 975     wiresa = (wireSAFEARRAY)Buffer;
 976     Buffer += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 977
 978     if (cDims != wiresa->cDims)
 979         RpcRaiseException(RPC_S_INVALID_BOUND);
 980
 981     /* FIXME: there should be a limit on how large cDims can be */
 982
 983     vt = HIWORD(wiresa->cLocks);
 984
 985     sftype = *(ULONG *)Buffer;
 986     Buffer += sizeof(ULONG);
 987
 988     cell_count = *(ULONG *)Buffer;
 989     Buffer += sizeof(ULONG);
 990     ptr = *(ULONG *)Buffer;
 991     Buffer += sizeof(ULONG);
 992     if (sftype == SF_HAVEIID)
 993     {
 994         memcpy(&guid, Buffer, sizeof(guid));
 995         Buffer += sizeof(guid);
 996     }
 997
 998     wiresab = (SAFEARRAYBOUND *)Buffer;
 999     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1000
1001     if(vt)
1002     {
1003         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1004         if (!*ppsa) RpcRaiseException(E_OUTOFMEMORY);
1005     }
1006     else
1007     {
1008         if (FAILED(SafeArrayAllocDescriptor(wiresa->cDims, ppsa)))
1009             RpcRaiseException(E_OUTOFMEMORY);
1010         memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1011     }
1012
1013     /* be careful about which flags we set since they could be a security
1014      * risk */
1015     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1016     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1017     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1018     (*ppsa)->cbElements = elem_mem_size(wiresa, sftype);
1019     (*ppsa)->cLocks = 0;
1020
1021     /* SafeArrayCreateEx allocates the data for us, but
1022      * SafeArrayAllocDescriptor doesn't */
1023     if(!vt)
1024     {
1025         hr = SafeArrayAllocData(*ppsa);
1026         if (FAILED(hr))
1027             RpcRaiseException(hr);
1028     }
1029
1030     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1031         RpcRaiseException(RPC_S_INVALID_BOUND);
1032     Buffer += sizeof(ULONG);
1033
1034     if (ptr)
1035     {
1036         switch (sftype)
1037         {
1038             case SF_BSTR:
1039             {
1040                 BSTR* lpBstr;
1041
1042                 for (lpBstr = (*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1043                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1044
1045                 break;
1046             }
1047             case SF_DISPATCH:
1048             case SF_UNKNOWN:
1049             case SF_HAVEIID:
1050                 FIXME("marshal interfaces\n");
1051                 break;
1052             case SF_VARIANT:
1053             {
1054                 VARIANT* lpVariant;
1055
1056                 for (lpVariant = (*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1057                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1058
1059                 break;
1060             }
1061             case SF_RECORD:
1062             {
1063                 FIXME("set record info\n");
1064
1065                 break;
1066             }
1067
1068             case SF_I8:
1069                 ALIGN_POINTER(Buffer, 7);
1070                 /* fallthrough */
1071             case SF_I1:
1072             case SF_I2:
1073             case SF_I4:
1074                 /* Just copy the data over */
1075                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1076                 Buffer += cell_count * (*ppsa)->cbElements;
1077                 break;
1078             default:
1079                 break;
1080         }
1081     }
1082
1083     TRACE("safe array unmarshaled: %p\n", *ppsa);
1084
1085     return Buffer;
1086 }
1087
1088 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1089 {
1090     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1091
1092     SafeArrayDestroy(*ppsa);
1093 }
1094
1095
1096 ULONG WINAPI HFONT_UserSize(ULONG *pFlags, ULONG Start, HFONT *phfont)
1097 {
1098     FIXME(":stub\n");
1099     return 0;
1100 }
1101
1102 unsigned char * WINAPI HFONT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1103 {
1104     FIXME(":stub\n");
1105     return NULL;
1106 }
1107
1108 unsigned char * WINAPI HFONT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1109 {
1110     FIXME(":stub\n");
1111     return NULL;
1112 }
1113
1114 void WINAPI HFONT_UserFree(ULONG *pFlags, HFONT *phfont)
1115 {
1116     FIXME(":stub\n");
1117     return;
1118 }
1119
1120
1121 /* IDispatch */
1122 /* exactly how Invoke is marshalled is not very clear to me yet,
1123  * but the way I've done it seems to work for me */
1124
1125 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1126     IDispatch* This,
1127     DISPID dispIdMember,
1128     REFIID riid,
1129     LCID lcid,
1130     WORD wFlags,
1131     DISPPARAMS* pDispParams,
1132     VARIANT* pVarResult,
1133     EXCEPINFO* pExcepInfo,
1134     UINT* puArgErr)
1135 {
1136   HRESULT hr;
1137   VARIANT VarResult;
1138   UINT* rgVarRefIdx = NULL;
1139   VARIANTARG* rgVarRef = NULL;
1140   UINT u, cVarRef;
1141   UINT uArgErr;
1142   EXCEPINFO ExcepInfo;
1143
1144   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1145         dispIdMember, debugstr_guid(riid),
1146         lcid, wFlags, pDispParams, pVarResult,
1147         pExcepInfo, puArgErr);
1148
1149   /* [out] args can't be null, use dummy vars if needed */
1150   if (!pVarResult) pVarResult = &VarResult;
1151   if (!puArgErr) puArgErr = &uArgErr;
1152   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1153
1154   /* count by-ref args */
1155   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1156     VARIANTARG* arg = &pDispParams->rgvarg[u];
1157     if (V_ISBYREF(arg)) {
1158       cVarRef++;
1159     }
1160   }
1161   if (cVarRef) {
1162     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1163     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1164     /* make list of by-ref args */
1165     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1166       VARIANTARG* arg = &pDispParams->rgvarg[u];
1167       if (V_ISBYREF(arg)) {
1168         rgVarRefIdx[cVarRef] = u;
1169         VariantInit(&rgVarRef[cVarRef]);
1170         VariantCopy(&rgVarRef[cVarRef], arg);
1171         VariantClear(arg);
1172         cVarRef++;
1173       }
1174     }
1175   } else {
1176     /* [out] args still can't be null,
1177      * but we can point these anywhere in this case,
1178      * since they won't be written to when cVarRef is 0 */
1179     rgVarRefIdx = puArgErr;
1180     rgVarRef = pVarResult;
1181   }
1182   TRACE("passed by ref: %d args\n", cVarRef);
1183   hr = IDispatch_RemoteInvoke_Proxy(This,
1184                                     dispIdMember,
1185                                     riid,
1186                                     lcid,
1187                                     wFlags,
1188                                     pDispParams,
1189                                     pVarResult,
1190                                     pExcepInfo,
1191                                     puArgErr,
1192                                     cVarRef,
1193                                     rgVarRefIdx,
1194                                     rgVarRef);
1195   if (cVarRef) {
1196     for (u=0; u<cVarRef; u++) {
1197       unsigned i = rgVarRefIdx[u];
1198       VariantCopy(&pDispParams->rgvarg[i],
1199                   &rgVarRef[u]);
1200       VariantClear(&rgVarRef[u]);
1201     }
1202     CoTaskMemFree(rgVarRef);
1203     CoTaskMemFree(rgVarRefIdx);
1204   }
1205
1206   if(pExcepInfo == &ExcepInfo)
1207   {
1208     SysFreeString(pExcepInfo->bstrSource);
1209     SysFreeString(pExcepInfo->bstrDescription);
1210     SysFreeString(pExcepInfo->bstrHelpFile);
1211   }
1212   return hr;
1213 }
1214
1215 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1216     IDispatch* This,
1217     DISPID dispIdMember,
1218     REFIID riid,
1219     LCID lcid,
1220     DWORD dwFlags,
1221     DISPPARAMS* pDispParams,
1222     VARIANT* pVarResult,
1223     EXCEPINFO* pExcepInfo,
1224     UINT* pArgErr,
1225     UINT cVarRef,
1226     UINT* rgVarRefIdx,
1227     VARIANTARG* rgVarRef)
1228 {
1229   HRESULT hr = S_OK;
1230   VARIANTARG *rgvarg, *arg;
1231   UINT u;
1232
1233   /* initialize out parameters, so that they can be marshalled
1234    * in case the real Invoke doesn't initialize them */
1235   VariantInit(pVarResult);
1236   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1237   *pArgErr = 0;
1238
1239   /* let the real Invoke operate on a copy of the in parameters,
1240    * so we don't risk losing pointers to allocated memory */
1241   rgvarg = pDispParams->rgvarg;
1242   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1243   if (!arg) return E_OUTOFMEMORY;
1244
1245   /* init all args so we can call VariantClear on all the args if the copy
1246    * below fails */
1247   for (u = 0; u < pDispParams->cArgs; u++)
1248     VariantInit(&arg[u]);
1249
1250   for (u = 0; u < pDispParams->cArgs; u++) {
1251     hr = VariantCopy(&arg[u], &rgvarg[u]);
1252     if (FAILED(hr))
1253         break;
1254   }
1255
1256   if (SUCCEEDED(hr)) {
1257     /* copy ref args to arg array */
1258     for (u=0; u<cVarRef; u++) {
1259       unsigned i = rgVarRefIdx[u];
1260       VariantCopy(&arg[i], &rgVarRef[u]);
1261     }
1262
1263     pDispParams->rgvarg = arg;
1264
1265     hr = IDispatch_Invoke(This,
1266                           dispIdMember,
1267                           riid,
1268                           lcid,
1269                           dwFlags,
1270                           pDispParams,
1271                           pVarResult,
1272                           pExcepInfo,
1273                           pArgErr);
1274
1275     /* copy ref args from arg array */
1276     for (u=0; u<cVarRef; u++) {
1277       unsigned i = rgVarRefIdx[u];
1278       VariantCopy(&rgVarRef[u], &arg[i]);
1279     }
1280   }
1281
1282   /* clear the duplicate argument list */
1283   for (u=0; u<pDispParams->cArgs; u++)
1284     VariantClear(&arg[u]);
1285
1286   pDispParams->rgvarg = rgvarg;
1287   CoTaskMemFree(arg);
1288
1289   return hr;
1290 }
1291
1292 /* IEnumVARIANT */
1293
1294 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1295     IEnumVARIANT* This,
1296     ULONG celt,
1297     VARIANT* rgVar,
1298     ULONG* pCeltFetched)
1299 {
1300   ULONG fetched;
1301   if (!pCeltFetched)
1302     pCeltFetched = &fetched;
1303   return IEnumVARIANT_RemoteNext_Proxy(This,
1304                                        celt,
1305                                        rgVar,
1306                                        pCeltFetched);
1307 }
1308
1309 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1310     IEnumVARIANT* This,
1311     ULONG celt,
1312     VARIANT* rgVar,
1313     ULONG* pCeltFetched)
1314 {
1315   HRESULT hr;
1316   *pCeltFetched = 0;
1317   hr = IEnumVARIANT_Next(This,
1318                          celt,
1319                          rgVar,
1320                          pCeltFetched);
1321   if (hr == S_OK) *pCeltFetched = celt;
1322   return hr;
1323 }
1324
1325 /* TypeInfo related freers */
1326
1327 static void free_embedded_typedesc(TYPEDESC *tdesc);
1328 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1329 {
1330     switch(adesc->tdescElem.vt)
1331     {
1332     case VT_PTR:
1333     case VT_SAFEARRAY:
1334         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1335         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1336         break;
1337     case VT_CARRAY:
1338         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1339         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1340         break;
1341     }
1342 }
1343
1344 static void free_embedded_typedesc(TYPEDESC *tdesc)
1345 {
1346     switch(tdesc->vt)
1347     {
1348     case VT_PTR:
1349     case VT_SAFEARRAY:
1350         free_embedded_typedesc(tdesc->u.lptdesc);
1351         CoTaskMemFree(tdesc->u.lptdesc);
1352         break;
1353     case VT_CARRAY:
1354         free_embedded_arraydesc(tdesc->u.lpadesc);
1355         CoTaskMemFree(tdesc->u.lpadesc);
1356         break;
1357     }
1358 }
1359
1360 static void free_embedded_elemdesc(ELEMDESC *edesc)
1361 {
1362     free_embedded_typedesc(&edesc->tdesc);
1363     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1364         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1365 }
1366
1367 /* ITypeComp */
1368
1369 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1370     ITypeComp* This,
1371     LPOLESTR szName,
1372     ULONG lHashVal,
1373     WORD wFlags,
1374     ITypeInfo** ppTInfo,
1375     DESCKIND* pDescKind,
1376     BINDPTR* pBindPtr)
1377 {
1378   FIXME("not implemented\n");
1379   return E_FAIL;
1380 }
1381
1382 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1383     ITypeComp* This,
1384     LPOLESTR szName,
1385     ULONG lHashVal,
1386     WORD wFlags,
1387     ITypeInfo** ppTInfo,
1388     DESCKIND* pDescKind,
1389     LPFUNCDESC* ppFuncDesc,
1390     LPVARDESC* ppVarDesc,
1391     ITypeComp** ppTypeComp,
1392     CLEANLOCALSTORAGE* pDummy)
1393 {
1394   FIXME("not implemented\n");
1395   return E_FAIL;
1396 }
1397
1398 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1399     ITypeComp* This,
1400     LPOLESTR szName,
1401     ULONG lHashVal,
1402     ITypeInfo** ppTInfo,
1403     ITypeComp** ppTComp)
1404 {
1405   FIXME("not implemented\n");
1406   return E_FAIL;
1407 }
1408
1409 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1410     ITypeComp* This,
1411     LPOLESTR szName,
1412     ULONG lHashVal,
1413     ITypeInfo** ppTInfo)
1414 {
1415   FIXME("not implemented\n");
1416   return E_FAIL;
1417 }
1418
1419 /* ITypeInfo */
1420
1421 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1422     ITypeInfo* This,
1423     TYPEATTR** ppTypeAttr)
1424
1425 {
1426     CLEANLOCALSTORAGE stg;
1427     TRACE("(%p, %p)\n", This, ppTypeAttr);
1428
1429     stg.flags = 0;
1430     stg.pStorage = NULL;
1431     stg.pInterface = NULL;
1432
1433     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1434 }
1435
1436 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1437     ITypeInfo* This,
1438     LPTYPEATTR* ppTypeAttr,
1439     CLEANLOCALSTORAGE* pDummy)
1440 {
1441     HRESULT hr;
1442     TRACE("(%p, %p)\n", This, ppTypeAttr);
1443
1444     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1445     if(hr != S_OK)
1446         return hr;
1447
1448     pDummy->flags = CLS_TYPEATTR;
1449     ITypeInfo_AddRef(This);
1450     pDummy->pInterface = (IUnknown*)This;
1451     pDummy->pStorage = ppTypeAttr;
1452     return hr;
1453 }
1454
1455 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1456     ITypeInfo* This,
1457     UINT index,
1458     FUNCDESC** ppFuncDesc)
1459 {
1460     CLEANLOCALSTORAGE stg;
1461     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1462
1463     stg.flags = 0;
1464     stg.pStorage = NULL;
1465     stg.pInterface = NULL;
1466
1467     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1468 }
1469
1470 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1471     ITypeInfo* This,
1472     UINT index,
1473     LPFUNCDESC* ppFuncDesc,
1474     CLEANLOCALSTORAGE* pDummy)
1475 {
1476     HRESULT hr;
1477     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1478
1479     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1480     if(hr != S_OK)
1481         return hr;
1482
1483     pDummy->flags = CLS_FUNCDESC;
1484     ITypeInfo_AddRef(This);
1485     pDummy->pInterface = (IUnknown*)This;
1486     pDummy->pStorage = ppFuncDesc;
1487     return hr;
1488 }
1489
1490 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1491     ITypeInfo* This,
1492     UINT index,
1493     VARDESC** ppVarDesc)
1494 {
1495     CLEANLOCALSTORAGE stg;
1496     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1497
1498     stg.flags = 0;
1499     stg.pStorage = NULL;
1500     stg.pInterface = NULL;
1501
1502     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1503 }
1504
1505 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1506     ITypeInfo* This,
1507     UINT index,
1508     LPVARDESC* ppVarDesc,
1509     CLEANLOCALSTORAGE* pDummy)
1510 {
1511     HRESULT hr;
1512     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1513
1514     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1515     if(hr != S_OK)
1516         return hr;
1517
1518     pDummy->flags = CLS_VARDESC;
1519     ITypeInfo_AddRef(This);
1520     pDummy->pInterface = (IUnknown*)This;
1521     pDummy->pStorage = ppVarDesc;
1522     return hr;
1523 }
1524
1525 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1526     ITypeInfo* This,
1527     MEMBERID memid,
1528     BSTR* rgBstrNames,
1529     UINT cMaxNames,
1530     UINT* pcNames)
1531 {
1532     TRACE("(%p, %08x, %p, %d, %p)\n", This, memid, rgBstrNames, cMaxNames, pcNames);
1533
1534     return ITypeInfo_RemoteGetNames_Proxy(This, memid, rgBstrNames, cMaxNames, pcNames);
1535 }
1536
1537 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1538     ITypeInfo* This,
1539     MEMBERID memid,
1540     BSTR* rgBstrNames,
1541     UINT cMaxNames,
1542     UINT* pcNames)
1543 {
1544     TRACE("(%p, %08x, %p, %d, %p)\n", This, memid, rgBstrNames, cMaxNames, pcNames);
1545
1546     return ITypeInfo_GetNames(This, memid, rgBstrNames, cMaxNames, pcNames);
1547 }
1548
1549 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1550     ITypeInfo* This,
1551     LPOLESTR* rgszNames,
1552     UINT cNames,
1553     MEMBERID* pMemId)
1554 {
1555   FIXME("not implemented\n");
1556   return E_FAIL;
1557 }
1558
1559 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1560     ITypeInfo* This)
1561 {
1562   FIXME("not implemented\n");
1563   return E_FAIL;
1564 }
1565
1566 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1567     ITypeInfo* This,
1568     PVOID pvInstance,
1569     MEMBERID memid,
1570     WORD wFlags,
1571     DISPPARAMS* pDispParams,
1572     VARIANT* pVarResult,
1573     EXCEPINFO* pExcepInfo,
1574     UINT* puArgErr)
1575 {
1576   FIXME("not implemented\n");
1577   return E_FAIL;
1578 }
1579
1580 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1581     ITypeInfo* This)
1582 {
1583   FIXME("not implemented\n");
1584   return E_FAIL;
1585 }
1586
1587 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(ITypeInfo *This, MEMBERID memid,
1588                                                   BSTR *name, BSTR *doc_string,
1589                                                   DWORD *help_context, BSTR *help_file)
1590 {
1591     DWORD dummy_help_context, flags = 0;
1592     BSTR dummy_name, dummy_doc_string, dummy_help_file;
1593     HRESULT hr;
1594     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, name, doc_string, help_context, help_file);
1595
1596     if(!name) name = &dummy_name;
1597     else flags = 1;
1598
1599     if(!doc_string) doc_string = &dummy_doc_string;
1600     else flags |= 2;
1601
1602     if(!help_context) help_context = &dummy_help_context;
1603     else flags |= 4;
1604
1605     if(!help_file) help_file = &dummy_help_file;
1606     else flags |= 8;
1607
1608     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, flags, name, doc_string, help_context, help_file);
1609
1610     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1611
1612     return hr;
1613 }
1614
1615 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(ITypeInfo *This, MEMBERID memid,
1616                                                    DWORD flags, BSTR *name, BSTR *doc_string,
1617                                                    DWORD *help_context, BSTR *help_file)
1618 {
1619     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, flags, name, doc_string, help_context, help_file);
1620
1621     *name = *doc_string = *help_file = NULL;
1622     *help_context = 0;
1623
1624     if(!(flags & 1)) name = NULL;
1625     if(!(flags & 2)) doc_string = NULL;
1626     if(!(flags & 4)) help_context = NULL;
1627     if(!(flags & 8)) help_file = NULL;
1628
1629     return ITypeInfo_GetDocumentation(This, memid, name, doc_string, help_context, help_file);
1630 }
1631
1632 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(ITypeInfo *This, MEMBERID memid,
1633                                              INVOKEKIND invkind, BSTR *dll_name,
1634                                              BSTR* name, WORD *ordinal)
1635 {
1636     DWORD flags = 0;
1637     BSTR dummy_dll_name, dummy_name;
1638     WORD dummy_ordinal;
1639     HRESULT hr;
1640     TRACE("(%p, %08x, %x, %p, %p, %p)\n", This, memid, invkind, dll_name, name, ordinal);
1641
1642     if(!dll_name) dll_name = &dummy_dll_name;
1643     else flags = 1;
1644
1645     if(!name) name = &dummy_name;
1646     else flags |= 2;
1647
1648     if(!ordinal) ordinal = &dummy_ordinal;
1649     else flags |= 4;
1650
1651     hr = ITypeInfo_RemoteGetDllEntry_Proxy(This, memid, invkind, flags, dll_name, name, ordinal);
1652
1653     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1654
1655     return hr;
1656 }
1657
1658 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(ITypeInfo *This, MEMBERID memid,
1659                                               INVOKEKIND invkind, DWORD flags,
1660                                               BSTR *dll_name, BSTR *name,
1661                                               WORD *ordinal)
1662 {
1663     TRACE("(%p, %08x, %x, %p, %p, %p)\n", This, memid, invkind, dll_name, name, ordinal);
1664
1665     *dll_name = *name = NULL;
1666     *ordinal = 0;
1667
1668     if(!(flags & 1)) dll_name = NULL;
1669     if(!(flags & 2)) name = NULL;
1670     if(!(flags & 4)) ordinal = NULL;
1671
1672     return ITypeInfo_GetDllEntry(This, memid, invkind, dll_name, name, ordinal);
1673 }
1674
1675 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1676     ITypeInfo* This,
1677     MEMBERID memid,
1678     INVOKEKIND invKind,
1679     PVOID* ppv)
1680 {
1681   FIXME("not implemented\n");
1682   return E_FAIL;
1683 }
1684
1685 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1686     ITypeInfo* This)
1687 {
1688   FIXME("not implemented\n");
1689   return E_FAIL;
1690 }
1691
1692 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1693     ITypeInfo* This,
1694     IUnknown* pUnkOuter,
1695     REFIID riid,
1696     PVOID* ppvObj)
1697 {
1698   FIXME("not implemented\n");
1699   return E_FAIL;
1700 }
1701
1702 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1703     ITypeInfo* This,
1704     REFIID riid,
1705     IUnknown** ppvObj)
1706 {
1707   FIXME("not implemented\n");
1708   return E_FAIL;
1709 }
1710
1711 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1712     ITypeInfo* This,
1713     ITypeLib** ppTLib,
1714     UINT* pIndex)
1715 {
1716     ITypeLib *pTL;
1717     UINT index;
1718     HRESULT hr;
1719
1720     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1721
1722     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1723     if(SUCCEEDED(hr))
1724     {
1725         if(pIndex)
1726             *pIndex = index;
1727
1728         if(ppTLib)
1729             *ppTLib = pTL;
1730         else
1731             ITypeLib_Release(pTL);
1732     }
1733     return hr;
1734 }
1735
1736 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1737     ITypeInfo* This,
1738     ITypeLib** ppTLib,
1739     UINT* pIndex)
1740 {
1741     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1742     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1743 }
1744
1745 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1746     ITypeInfo* This,
1747     TYPEATTR* pTypeAttr)
1748 {
1749     TRACE("(%p, %p)\n", This, pTypeAttr);
1750     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1751     CoTaskMemFree(pTypeAttr);
1752 }
1753
1754 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1755     ITypeInfo* This)
1756 {
1757     TRACE("nothing to do\n");
1758     return S_OK;
1759 }
1760
1761 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1762     ITypeInfo* This,
1763     FUNCDESC* pFuncDesc)
1764 {
1765     SHORT param;
1766     TRACE("(%p, %p)\n", This, pFuncDesc);
1767
1768     for(param = 0; param < pFuncDesc->cParams; param++)
1769         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1770     if(param)
1771         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1772
1773     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1774
1775     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1776         CoTaskMemFree(pFuncDesc->lprgscode);
1777
1778     CoTaskMemFree(pFuncDesc);
1779 }
1780
1781 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1782     ITypeInfo* This)
1783 {
1784     TRACE("nothing to do\n");
1785     return S_OK;
1786 }
1787
1788 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1789     ITypeInfo* This,
1790     VARDESC* pVarDesc)
1791 {
1792     TRACE("(%p, %p)\n", This, pVarDesc);
1793
1794     CoTaskMemFree(pVarDesc->lpstrSchema);
1795
1796     if(pVarDesc->varkind == VAR_CONST)
1797         CoTaskMemFree(pVarDesc->u.lpvarValue);
1798
1799     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1800     CoTaskMemFree(pVarDesc);
1801 }
1802
1803 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1804     ITypeInfo* This)
1805 {
1806     TRACE("nothing to do\n");
1807     return S_OK;
1808 }
1809
1810
1811 /* ITypeInfo2 */
1812
1813 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(ITypeInfo2 *This, MEMBERID memid,
1814                                                     LCID lcid, BSTR *help_string,
1815                                                     DWORD *help_context, BSTR *help_dll)
1816 {
1817     DWORD dummy_help_context, flags = 0;
1818     BSTR dummy_help_string, dummy_help_dll;
1819     HRESULT hr;
1820     TRACE("(%p, %08x, %08x, %p, %p, %p)\n", This, memid, lcid, help_string, help_context, help_dll);
1821
1822     if(!help_string) help_string = &dummy_help_string;
1823     else flags = 1;
1824
1825     if(!help_context) help_context = &dummy_help_context;
1826     else flags |= 2;
1827
1828     if(!help_dll) help_dll = &dummy_help_dll;
1829     else flags |= 4;
1830
1831     hr = ITypeInfo2_RemoteGetDocumentation2_Proxy(This, memid, lcid, flags, help_string, help_context, help_dll);
1832
1833     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1834
1835     return hr;
1836 }
1837
1838 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(ITypeInfo2 *This, MEMBERID memid,
1839                                                      LCID lcid, DWORD flags,
1840                                                      BSTR *help_string, DWORD *help_context,
1841                                                      BSTR *help_dll)
1842 {
1843     TRACE("(%p, %08x, %08x, %08x, %p, %p, %p)\n", This, memid, lcid, flags, help_string, help_context, help_dll);
1844
1845     *help_string = *help_dll = NULL;
1846     *help_context = 0;
1847
1848     if(!(flags & 1)) help_string = NULL;
1849     if(!(flags & 2)) help_context = NULL;
1850     if(!(flags & 4)) help_dll = NULL;
1851
1852     return ITypeInfo2_GetDocumentation2(This, memid, lcid, help_string, help_context, help_dll);
1853 }
1854
1855 /* ITypeLib */
1856
1857 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1858     ITypeLib* This)
1859 {
1860     UINT count = 0;
1861     TRACE("(%p)\n", This);
1862
1863     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1864
1865     return count;
1866 }
1867
1868 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1869     ITypeLib* This,
1870     UINT* pcTInfo)
1871 {
1872     TRACE("(%p, %p)\n", This, pcTInfo);
1873     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1874     return S_OK;
1875 }
1876
1877 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1878     ITypeLib* This,
1879     TLIBATTR** ppTLibAttr)
1880 {
1881     CLEANLOCALSTORAGE stg;
1882     TRACE("(%p, %p)\n", This, ppTLibAttr);
1883
1884     stg.flags = 0;
1885     stg.pStorage = NULL;
1886     stg.pInterface = NULL;
1887
1888     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1889 }
1890
1891 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1892     ITypeLib* This,
1893     LPTLIBATTR* ppTLibAttr,
1894     CLEANLOCALSTORAGE* pDummy)
1895 {
1896     HRESULT hr;
1897     TRACE("(%p, %p)\n", This, ppTLibAttr);
1898
1899     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1900     if(hr != S_OK)
1901         return hr;
1902
1903     pDummy->flags = CLS_LIBATTR;
1904     ITypeLib_AddRef(This);
1905     pDummy->pInterface = (IUnknown*)This;
1906     pDummy->pStorage = ppTLibAttr;
1907     return hr;
1908 }
1909
1910 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(ITypeLib *This, INT index, BSTR *name,
1911                                                  BSTR *doc_string, DWORD *help_context,
1912                                                  BSTR *help_file)
1913 {
1914     DWORD dummy_help_context, flags = 0;
1915     BSTR dummy_name, dummy_doc_string, dummy_help_file;
1916     HRESULT hr;
1917     TRACE("(%p, %d, %p, %p, %p, %p)\n", This, index, name, doc_string, help_context, help_file);
1918
1919     if(!name) name = &dummy_name;
1920     else flags = 1;
1921
1922     if(!doc_string) doc_string = &dummy_doc_string;
1923     else flags |= 2;
1924
1925     if(!help_context) help_context = &dummy_help_context;
1926     else flags |= 4;
1927
1928     if(!help_file) help_file = &dummy_help_file;
1929     else flags |= 8;
1930
1931     hr = ITypeLib_RemoteGetDocumentation_Proxy(This, index, flags, name, doc_string, help_context, help_file);
1932
1933     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1934
1935     return hr;
1936 }
1937
1938 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(ITypeLib *This, INT index, DWORD flags,
1939                                                   BSTR *name, BSTR *doc_string,
1940                                                   DWORD *help_context, BSTR *help_file)
1941 {
1942     TRACE("(%p, %d, %08x, %p, %p, %p, %p)\n", This, index, flags, name, doc_string, help_context, help_file);
1943
1944     *name = *doc_string = *help_file = NULL;
1945     *help_context = 0;
1946
1947     if(!(flags & 1)) name = NULL;
1948     if(!(flags & 2)) doc_string = NULL;
1949     if(!(flags & 4)) help_context = NULL;
1950     if(!(flags & 8)) help_file = NULL;
1951
1952     return ITypeLib_GetDocumentation(This, index, name, doc_string, help_context, help_file);
1953 }
1954
1955 HRESULT CALLBACK ITypeLib_IsName_Proxy(
1956     ITypeLib* This,
1957     LPOLESTR szNameBuf,
1958     ULONG lHashVal,
1959     BOOL* pfName)
1960 {
1961   FIXME("not implemented\n");
1962   return E_FAIL;
1963 }
1964
1965 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
1966     ITypeLib* This,
1967     LPOLESTR szNameBuf,
1968     ULONG lHashVal,
1969     BOOL* pfName,
1970     BSTR* pBstrLibName)
1971 {
1972   FIXME("not implemented\n");
1973   return E_FAIL;
1974 }
1975
1976 HRESULT CALLBACK ITypeLib_FindName_Proxy(
1977     ITypeLib* This,
1978     LPOLESTR szNameBuf,
1979     ULONG lHashVal,
1980     ITypeInfo** ppTInfo,
1981     MEMBERID* rgMemId,
1982     USHORT* pcFound)
1983 {
1984   FIXME("not implemented\n");
1985   return E_FAIL;
1986 }
1987
1988 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
1989     ITypeLib* This,
1990     LPOLESTR szNameBuf,
1991     ULONG lHashVal,
1992     ITypeInfo** ppTInfo,
1993     MEMBERID* rgMemId,
1994     USHORT* pcFound,
1995     BSTR* pBstrLibName)
1996 {
1997   FIXME("not implemented\n");
1998   return E_FAIL;
1999 }
2000
2001 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
2002     ITypeLib* This,
2003     TLIBATTR* pTLibAttr)
2004 {
2005     TRACE("(%p, %p)\n", This, pTLibAttr);
2006     CoTaskMemFree(pTLibAttr);
2007 }
2008
2009 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
2010     ITypeLib* This)
2011 {
2012     TRACE("nothing to do\n");
2013     return S_OK;
2014 }
2015
2016
2017 /* ITypeLib2 */
2018
2019 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
2020     ITypeLib2* This,
2021     ULONG* pcUniqueNames,
2022     ULONG* pcchUniqueNames)
2023 {
2024   FIXME("not implemented\n");
2025   return E_FAIL;
2026 }
2027
2028 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
2029     ITypeLib2* This,
2030     ULONG* pcUniqueNames,
2031     ULONG* pcchUniqueNames)
2032 {
2033   FIXME("not implemented\n");
2034   return E_FAIL;
2035 }
2036
2037 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(ITypeLib2 *This, INT index,
2038                                                    LCID lcid, BSTR *help_string,
2039                                                    DWORD *help_context, BSTR *help_dll)
2040 {
2041     DWORD dummy_help_context, flags = 0;
2042     BSTR dummy_help_string, dummy_help_dll;
2043     HRESULT hr;
2044     TRACE("(%p, %d, %08x, %p, %p, %p)\n", This, index, lcid, help_string, help_context, help_dll);
2045
2046     if(!help_string) help_string = &dummy_help_string;
2047     else flags = 1;
2048
2049     if(!help_context) help_context = &dummy_help_context;
2050     else flags |= 2;
2051
2052     if(!help_dll) help_dll = &dummy_help_dll;
2053     else flags |= 4;
2054
2055     hr = ITypeLib2_RemoteGetDocumentation2_Proxy(This, index, lcid, flags, help_string, help_context, help_dll);
2056
2057     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
2058
2059     return hr;
2060 }
2061
2062 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(ITypeLib2 *This, INT index, LCID lcid,
2063                                                     DWORD flags, BSTR *help_string,
2064                                                     DWORD *help_context, BSTR *help_dll)
2065 {
2066     TRACE("(%p, %d, %08x, %08x, %p, %p, %p)\n", This, index, lcid, flags, help_string, help_context, help_dll);
2067
2068     *help_string = *help_dll = NULL;
2069     *help_context = 0;
2070
2071     if(!(flags & 1)) help_string = NULL;
2072     if(!(flags & 2)) help_context = NULL;
2073     if(!(flags & 4)) help_dll = NULL;
2074
2075     return ITypeLib2_GetDocumentation2(This, index, lcid, help_string, help_context, help_dll);
2076 }
2077
2078 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2079     IPropertyBag* This,
2080     LPCOLESTR pszPropName,
2081     VARIANT *pVar,
2082     IErrorLog *pErrorLog)
2083 {
2084   IUnknown *pUnk = NULL;
2085   TRACE("(%p, %s, %p, %p)\n", This, debugstr_w(pszPropName), pVar, pErrorLog);
2086
2087   if(!pVar)
2088     return E_POINTER;
2089
2090   if(V_VT(pVar) & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2091   {
2092     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2093     return E_NOTIMPL;
2094   }
2095
2096   switch(V_VT(pVar))
2097   {
2098     case VT_DISPATCH:
2099       pUnk = (IUnknown*)V_DISPATCH(pVar);
2100       break;
2101     case VT_UNKNOWN:
2102       pUnk = V_UNKNOWN(pVar);
2103       break;
2104     case VT_SAFEARRAY:
2105       FIXME("Safearray support not yet implemented.\n");
2106       return E_NOTIMPL;
2107     default:
2108       FIXME("Unknown V_VT %d - support not yet implemented.\n", V_VT(pVar));
2109       return E_NOTIMPL;
2110   }
2111
2112   return IPropertyBag_RemoteRead_Proxy(This, pszPropName, pVar, pErrorLog,
2113                                        V_VT(pVar), pUnk);
2114 }
2115
2116 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2117     IPropertyBag* This,
2118     LPCOLESTR pszPropName,
2119     VARIANT *pVar,
2120     IErrorLog *pErrorLog,
2121     DWORD varType,
2122     IUnknown *pUnkObj)
2123 {
2124   static const WCHAR emptyWstr[] = {0};
2125   IDispatch *disp;
2126   HRESULT hr;
2127   TRACE("(%p, %s, %p, %p, %x, %p)\n", This, debugstr_w(pszPropName), pVar,
2128                                      pErrorLog, varType, pUnkObj);
2129
2130   if(varType & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2131   {
2132     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2133     return E_NOTIMPL;
2134   }
2135
2136   V_VT(pVar) = varType;
2137   switch(varType)
2138   {
2139     case VT_DISPATCH:
2140       hr = IUnknown_QueryInterface(pUnkObj, &IID_IDispatch, (LPVOID*)&disp);
2141       if(FAILED(hr))
2142         return hr;
2143       IUnknown_Release(pUnkObj);
2144       V_DISPATCH(pVar) = disp;
2145       break;
2146     case VT_UNKNOWN:
2147       V_UNKNOWN(pVar) = pUnkObj;
2148       break;
2149     case VT_BSTR:
2150       V_BSTR(pVar) = SysAllocString(emptyWstr);
2151       break;
2152     case VT_SAFEARRAY:
2153       FIXME("Safearray support not yet implemented.\n");
2154       return E_NOTIMPL;
2155     default:
2156       break;
2157   }
2158   hr = IPropertyBag_Read(This, pszPropName, pVar, pErrorLog);
2159   if(FAILED(hr))
2160     VariantClear(pVar);
2161
2162   return hr;
2163 }
2164
2165 /* call_as/local stubs for ocidl.idl */
2166
2167 HRESULT CALLBACK IClassFactory2_CreateInstanceLic_Proxy(
2168     IClassFactory2* This,
2169     IUnknown *pUnkOuter,
2170     IUnknown *pUnkReserved,
2171     REFIID riid,
2172     BSTR bstrKey,
2173     PVOID *ppvObj)
2174 {
2175     TRACE("(%p, %s, %p)\n", pUnkOuter, debugstr_guid(riid), ppvObj);
2176
2177     *ppvObj = NULL;
2178
2179     if (pUnkOuter)
2180     {
2181         ERR("aggregation is not allowed on remote objects\n");
2182         return CLASS_E_NOAGGREGATION;
2183     }
2184
2185     return IClassFactory2_RemoteCreateInstanceLic_Proxy(This, riid, bstrKey, (IUnknown**)ppvObj);
2186 }
2187
2188 HRESULT __RPC_STUB IClassFactory2_CreateInstanceLic_Stub(
2189     IClassFactory2* This,
2190     REFIID riid,
2191     BSTR bstrKey,
2192     IUnknown **ppvObj)
2193 {
2194     TRACE("(%s, %p)\n", debugstr_guid(riid), ppvObj);
2195     return IClassFactory2_CreateInstanceLic(This, NULL, NULL, riid, bstrKey, (void**)ppvObj);
2196 }
2197
2198 HRESULT CALLBACK IEnumConnections_Next_Proxy(
2199     IEnumConnections* This,
2200     ULONG cConnections,
2201     LPCONNECTDATA rgcd,
2202     ULONG *pcFetched)
2203 {
2204     ULONG fetched;
2205
2206     TRACE("(%u, %p %p)\n", cConnections, rgcd, pcFetched);
2207
2208     if (!pcFetched)
2209         pcFetched = &fetched;
2210
2211     return IEnumConnections_RemoteNext_Proxy(This, cConnections, rgcd, pcFetched);
2212 }
2213
2214 HRESULT __RPC_STUB IEnumConnections_Next_Stub(
2215     IEnumConnections* This,
2216     ULONG cConnections,
2217     LPCONNECTDATA rgcd,
2218     ULONG *pcFetched)
2219 {
2220     HRESULT hr;
2221
2222     TRACE("(%u, %p, %p)\n", cConnections, rgcd, pcFetched);
2223
2224     *pcFetched = 0;
2225     hr = IEnumConnections_Next(This, cConnections, rgcd, pcFetched);
2226     if (hr == S_OK)
2227         *pcFetched = cConnections;
2228
2229     return hr;
2230 }
2231
2232 HRESULT CALLBACK IEnumConnectionPoints_Next_Proxy(
2233     IEnumConnectionPoints* This,
2234     ULONG cConnections,
2235     IConnectionPoint **ppCP,
2236     ULONG *pcFetched)
2237 {
2238     ULONG fetched;
2239
2240     TRACE("(%u, %p %p)\n", cConnections, ppCP, pcFetched);
2241
2242     if (!pcFetched)
2243         pcFetched = &fetched;
2244
2245     return IEnumConnectionPoints_RemoteNext_Proxy(This, cConnections, ppCP, pcFetched);
2246 }
2247
2248 HRESULT __RPC_STUB IEnumConnectionPoints_Next_Stub(
2249     IEnumConnectionPoints* This,
2250     ULONG cConnections,
2251     IConnectionPoint **ppCP,
2252     ULONG *pcFetched)
2253 {
2254     HRESULT hr;
2255
2256     TRACE("(%u, %p, %p)\n", cConnections, ppCP, pcFetched);
2257
2258     *pcFetched = 0;
2259     hr = IEnumConnectionPoints_Next(This, cConnections, ppCP, pcFetched);
2260     if (hr == S_OK)
2261         *pcFetched = cConnections;
2262
2263     return hr;
2264 }
2265
2266 HRESULT CALLBACK IPersistMemory_Load_Proxy(
2267     IPersistMemory* This,
2268     LPVOID pMem,
2269     ULONG cbSize)
2270 {
2271     TRACE("(%p, %u)\n", pMem, cbSize);
2272
2273     if (!pMem)
2274         return E_POINTER;
2275
2276     return IPersistMemory_RemoteLoad_Proxy(This, pMem, cbSize);
2277 }
2278
2279 HRESULT __RPC_STUB IPersistMemory_Load_Stub(
2280     IPersistMemory* This,
2281     BYTE *pMem,
2282     ULONG cbSize)
2283 {
2284     TRACE("(%p, %u)\n", pMem, cbSize);
2285     return IPersistMemory_Load(This, pMem, cbSize);
2286 }
2287
2288 HRESULT CALLBACK IPersistMemory_Save_Proxy(
2289     IPersistMemory* This,
2290     LPVOID pMem,
2291     BOOL fClearDirty,
2292     ULONG cbSize)
2293 {
2294     TRACE("(%p, %d, %u)\n", pMem, fClearDirty, cbSize);
2295
2296     if (!pMem)
2297         return E_POINTER;
2298
2299     return IPersistMemory_RemoteSave_Proxy(This, pMem, fClearDirty, cbSize);
2300 }
2301
2302 HRESULT __RPC_STUB IPersistMemory_Save_Stub(
2303     IPersistMemory* This,
2304     BYTE *pMem,
2305     BOOL fClearDirty,
2306     ULONG cbSize)
2307 {
2308     TRACE("(%p, %d, %u)\n", pMem, fClearDirty, cbSize);
2309     return IPersistMemory_Save(This, pMem, fClearDirty, cbSize);
2310 }
2311
2312 void CALLBACK IAdviseSinkEx_OnViewStatusChange_Proxy(
2313     IAdviseSinkEx* This,
2314     DWORD dwViewStatus)
2315 {
2316     TRACE("(%p, 0x%08x)\n", This, dwViewStatus);
2317     IAdviseSinkEx_RemoteOnViewStatusChange_Proxy(This, dwViewStatus);
2318 }
2319
2320 HRESULT __RPC_STUB IAdviseSinkEx_OnViewStatusChange_Stub(
2321     IAdviseSinkEx* This,
2322     DWORD dwViewStatus)
2323 {
2324     TRACE("(%p, 0x%08x)\n", This, dwViewStatus);
2325     IAdviseSinkEx_OnViewStatusChange(This, dwViewStatus);
2326     return S_OK;
2327 }
2328
2329 HRESULT CALLBACK IEnumOleUndoUnits_Next_Proxy(
2330     IEnumOleUndoUnits* This,
2331     ULONG cElt,
2332     IOleUndoUnit **rgElt,
2333     ULONG *pcEltFetched)
2334 {
2335     ULONG fetched;
2336
2337     TRACE("(%u, %p %p)\n", cElt, rgElt, pcEltFetched);
2338
2339     if (!pcEltFetched)
2340         pcEltFetched = &fetched;
2341
2342     return IEnumOleUndoUnits_RemoteNext_Proxy(This, cElt, rgElt, pcEltFetched);
2343 }
2344
2345 HRESULT __RPC_STUB IEnumOleUndoUnits_Next_Stub(
2346     IEnumOleUndoUnits* This,
2347     ULONG cElt,
2348     IOleUndoUnit **rgElt,
2349     ULONG *pcEltFetched)
2350 {
2351     HRESULT hr;
2352
2353     TRACE("(%u, %p, %p)\n", cElt, rgElt, pcEltFetched);
2354
2355     *pcEltFetched = 0;
2356     hr = IEnumOleUndoUnits_Next(This, cElt, rgElt, pcEltFetched);
2357     if (hr == S_OK)
2358         *pcEltFetched = cElt;
2359
2360     return hr;
2361 }
2362
2363 HRESULT CALLBACK IQuickActivate_QuickActivate_Proxy(
2364     IQuickActivate* This,
2365     QACONTAINER *pQaContainer,
2366     QACONTROL *pQaControl)
2367 {
2368     FIXME("not implemented\n");
2369     return E_NOTIMPL;
2370 }
2371
2372 HRESULT __RPC_STUB IQuickActivate_QuickActivate_Stub(
2373     IQuickActivate* This,
2374     QACONTAINER *pQaContainer,
2375     QACONTROL *pQaControl)
2376 {
2377     FIXME("not implemented\n");
2378     return E_NOTIMPL;
2379 }