dlls/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #define COBJMACROS
  26 #define NONAMELESSUNION
  27 #define NONAMELESSSTRUCT
  28
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "wingdi.h"
  32 #include "winuser.h"
  33 #include "winerror.h"
  34
  35 #include "ole2.h"
  36 #include "oleauto.h"
  37 #include "typelib.h"
  38 #include "ocidl.h"
  39 #include "wine/debug.h"
  40
  41 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  42
  43 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  44 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  45 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  46 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  47
  48 static void dump_user_flags(const ULONG *pFlags)
  49 {
  50     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  51         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  52     else
  53         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  54     switch (LOWORD(*pFlags))
  55     {
  56         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  57         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  58         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  59         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  60         default: TRACE("%d)", LOWORD(*pFlags));
  61     }
  62 }
  63
  64 /* CLEANLOCALSTORAGE */
  65
  66 #define CLS_FUNCDESC  'f'
  67 #define CLS_LIBATTR   'l'
  68 #define CLS_TYPEATTR  't'
  69 #define CLS_VARDESC   'v'
  70
  71 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  72 {
  73     ALIGN_LENGTH(Start, 3);
  74     return Start + sizeof(DWORD);
  75 }
  76
  77 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  78 {
  79     ALIGN_POINTER(Buffer, 3);
  80     *(DWORD*)Buffer = pstg->flags;
  81     switch(pstg->flags)
  82     {
  83     case CLS_LIBATTR:
  84         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
  85         break;
  86     case CLS_TYPEATTR:
  87         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
  88         break;
  89     case CLS_FUNCDESC:
  90         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
  91         break;
  92     case CLS_VARDESC:
  93         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
  94         break;
  95
  96     default:
  97         ERR("Unknown type %x\n", pstg->flags);
  98     }
  99
 100     *(VOID**)pstg->pStorage = NULL;
 101     IUnknown_Release(pstg->pInterface);
 102     pstg->pInterface = NULL;
 103
 104     return Buffer + sizeof(DWORD);
 105 }
 106
 107 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
 108 {
 109     ALIGN_POINTER(Buffer, 3);
 110     pstr->flags = *(DWORD*)Buffer;
 111     return Buffer + sizeof(DWORD);
 112 }
 113
 114 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
 115 {
 116     /* Nothing to do */
 117 }
 118
 119 /* BSTR */
 120
 121 typedef struct
 122 {
 123     DWORD len;          /* No. of chars not including trailing '\0' */
 124     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 125     DWORD len2;         /* == len */
 126 } bstr_wire_t;
 127
 128 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 129 {
 130     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 131     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 132     ALIGN_LENGTH(Start, 3);
 133     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 134     TRACE("returning %d\n", Start);
 135     return Start;
 136 }
 137
 138 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 139 {
 140     bstr_wire_t *header;
 141     DWORD len = SysStringByteLen(*pstr);
 142
 143     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 144     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 145
 146     ALIGN_POINTER(Buffer, 3);
 147     header = (bstr_wire_t*)Buffer;
 148     header->len = header->len2 = (len + 1) / 2;
 149     if (*pstr)
 150     {
 151         header->byte_len = len;
 152         memcpy(header + 1, *pstr, header->len * 2);
 153     }
 154     else
 155         header->byte_len = 0xffffffff; /* special case for a null bstr */
 156
 157     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 158 }
 159
 160 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 161 {
 162     bstr_wire_t *header;
 163     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 164
 165     ALIGN_POINTER(Buffer, 3);
 166     header = (bstr_wire_t*)Buffer;
 167     if(header->len != header->len2)
 168         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 169
 170     SysFreeString(*pstr);
 171     *pstr = NULL;
 172
 173     if(header->byte_len != 0xffffffff)
 174         *pstr = SysAllocStringByteLen((char*)(header + 1), header->byte_len);
 175
 176     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 177     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 178 }
 179
 180 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 181 {
 182     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 183     SysFreeString(*pstr);
 184     *pstr = NULL;
 185 }
 186
 187 /* VARIANT */
 188
 189 typedef struct
 190 {
 191     DWORD clSize;
 192     DWORD rpcReserverd;
 193     USHORT vt;
 194     USHORT wReserved1;
 195     USHORT wReserved2;
 196     USHORT wReserved3;
 197     DWORD switch_is;
 198 } variant_wire_t;
 199
 200 static unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 201 {
 202     if (vt & VT_ARRAY) return 4;
 203
 204     switch (vt & ~VT_BYREF) {
 205     case VT_EMPTY:
 206     case VT_NULL:
 207         return 0;
 208     case VT_I1:
 209     case VT_UI1:
 210         return sizeof(CHAR);
 211     case VT_I2:
 212     case VT_UI2:
 213         return sizeof(SHORT);
 214     case VT_I4:
 215     case VT_UI4:
 216         return sizeof(LONG);
 217     case VT_INT:
 218     case VT_UINT:
 219         return sizeof(INT);
 220     case VT_R4:
 221         return sizeof(FLOAT);
 222     case VT_R8:
 223         return sizeof(DOUBLE);
 224     case VT_BOOL:
 225         return sizeof(VARIANT_BOOL);
 226     case VT_ERROR:
 227         return sizeof(SCODE);
 228     case VT_DATE:
 229         return sizeof(DATE);
 230     case VT_CY:
 231         return sizeof(CY);
 232     case VT_DECIMAL:
 233         return sizeof(DECIMAL);
 234     case VT_BSTR:
 235         return sizeof(ULONG);
 236     case VT_VARIANT:
 237         return sizeof(VARIANT);
 238     case VT_UNKNOWN:
 239     case VT_DISPATCH:
 240     case VT_RECORD:
 241         return 0;
 242     default:
 243         FIXME("unhandled VT %d\n", vt);
 244         return 0;
 245     }
 246 }
 247
 248 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 249 {
 250     unsigned int size = get_type_size(pFlags, vt);
 251     if(vt & VT_BYREF) return 3;
 252     if(size == 0) return 0;
 253     if(size <= 4) return size - 1;
 254     return 7;
 255 }
 256
 257 static unsigned interface_variant_size(const ULONG *pFlags, REFIID riid, IUnknown *punk)
 258 {
 259     ULONG size = 0;
 260     HRESULT hr;
 261
 262     if (punk)
 263     {
 264         hr = CoGetMarshalSizeMax(&size, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 265         if (FAILED(hr))
 266         {
 267             ERR("interface variant buffer size calculation failed, HRESULT=0x%x\n", hr);
 268             return 0;
 269         }
 270     }
 271     size += sizeof(ULONG); /* we have to store the buffersize in the stream */
 272     TRACE("wire-size extra of interface variant is %d\n", size);
 273     return size;
 274 }
 275
 276 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 277 {
 278   if (V_ISARRAY(pvar))
 279   {
 280     if (V_ISBYREF(pvar))
 281       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 282     else
 283       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 284   }
 285
 286   switch (V_VT(pvar)) {
 287   case VT_BSTR:
 288     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 289   case VT_BSTR | VT_BYREF:
 290     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 291   case VT_VARIANT | VT_BYREF:
 292     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 293   case VT_UNKNOWN:
 294     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 295   case VT_UNKNOWN | VT_BYREF:
 296     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 297   case VT_DISPATCH:
 298     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 299   case VT_DISPATCH | VT_BYREF:
 300     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 301   case VT_RECORD:
 302     FIXME("wire-size record\n");
 303     return Start;
 304   case VT_SAFEARRAY:
 305   case VT_SAFEARRAY | VT_BYREF:
 306     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 307     return Start;
 308   default:
 309     return Start;
 310   }
 311 }
 312
 313 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer. returns Buffer on failure, new position otherwise */
 314 static unsigned char* interface_variant_marshal(const ULONG *pFlags, unsigned char *Buffer,
 315                                                 REFIID riid, IUnknown *punk)
 316 {
 317   IStream *working;
 318   HGLOBAL working_mem;
 319   void *working_memlocked;
 320   unsigned char *oldpos;
 321   ULONG size;
 322   HRESULT hr;
 323
 324   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 325
 326   if(!punk)
 327   {
 328       memset(Buffer, 0, sizeof(ULONG));
 329       return Buffer + sizeof(ULONG);
 330   }
 331
 332   oldpos = Buffer;
 333
 334   /* CoMarshalInterface needs a stream, whereas at this level we are operating in terms of buffers.
 335    * We create a stream on an HGLOBAL, so we can simply do a memcpy to move it to the buffer.
 336    * in rpcrt4/ndr_ole.c, a simple IStream implementation is wrapped around the buffer object,
 337    * but that would be overkill here, hence this implementation. We save the size because the unmarshal
 338    * code has no way to know how long the marshalled buffer is. */
 339
 340   size = interface_variant_size(pFlags, riid, punk);
 341
 342   working_mem = GlobalAlloc(0, size);
 343   if (!working_mem) return oldpos;
 344
 345   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 346   if (hr != S_OK) {
 347     GlobalFree(working_mem);
 348     return oldpos;
 349   }
 350
 351   hr = CoMarshalInterface(working, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 352   if (hr != S_OK) {
 353     IStream_Release(working); /* this also releases the hglobal */
 354     return oldpos;
 355   }
 356
 357   working_memlocked = GlobalLock(working_mem);
 358   memcpy(Buffer, &size, sizeof(ULONG)); /* copy the buffersize */
 359   memcpy(Buffer + sizeof(ULONG), working_memlocked, size - sizeof(ULONG));
 360   GlobalUnlock(working_mem);
 361
 362   IStream_Release(working);
 363
 364   /* size includes the ULONG for the size written above */
 365   TRACE("done, size=%d\n", size);
 366   return Buffer + size;
 367 }
 368
 369 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer. returns Buffer on failure, new position otherwise */
 370 static unsigned char *interface_variant_unmarshal(const ULONG *pFlags, unsigned char *Buffer,
 371                                                   REFIID riid, IUnknown **ppunk)
 372 {
 373   IStream *working;
 374   HGLOBAL working_mem;
 375   void *working_memlocked;
 376   unsigned char *oldpos;
 377   ULONG size;
 378   HRESULT hr;
 379
 380   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 381
 382   oldpos = Buffer;
 383
 384   /* get the buffersize */
 385   memcpy(&size, Buffer, sizeof(ULONG));
 386   TRACE("buffersize=%d\n", size);
 387
 388   if(!size)
 389   {
 390       *ppunk = NULL;
 391       return Buffer + sizeof(ULONG);
 392   }
 393
 394   working_mem = GlobalAlloc(0, size);
 395   if (!working_mem) return oldpos;
 396
 397   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 398   if (hr != S_OK) {
 399     GlobalFree(working_mem);
 400     return oldpos;
 401   }
 402
 403   working_memlocked = GlobalLock(working_mem);
 404
 405   /* now we copy the contents of the marshalling buffer to working_memlocked, unlock it, and demarshal the stream */
 406   memcpy(working_memlocked, Buffer + sizeof(ULONG), size);
 407   GlobalUnlock(working_mem);
 408
 409   hr = CoUnmarshalInterface(working, riid, (void**)ppunk);
 410   if (hr != S_OK) {
 411     IStream_Release(working);
 412     return oldpos;
 413   }
 414
 415   IStream_Release(working); /* this also frees the underlying hglobal */
 416
 417   /* size includes the ULONG for the size written above */
 418   TRACE("done, processed=%d bytes\n", size);
 419   return Buffer + size;
 420 }
 421
 422
 423 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 424 {
 425     int align;
 426     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 427     TRACE("vt=%04x\n", V_VT(pvar));
 428
 429     ALIGN_LENGTH(Start, 7);
 430     Start += sizeof(variant_wire_t);
 431     if(V_VT(pvar) & VT_BYREF)
 432         Start += 4;
 433
 434     align = get_type_alignment(pFlags, V_VT(pvar));
 435     ALIGN_LENGTH(Start, align);
 436     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 437         Start += 4;
 438     else
 439         Start += get_type_size(pFlags, V_VT(pvar));
 440     Start = wire_extra_user_size(pFlags, Start, pvar);
 441
 442     TRACE("returning %d\n", Start);
 443     return Start;
 444 }
 445
 446 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 447 {
 448     variant_wire_t *header;
 449     ULONG type_size;
 450     int align;
 451     unsigned char *Pos;
 452
 453     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 454     TRACE("vt=%04x\n", V_VT(pvar));
 455
 456     ALIGN_POINTER(Buffer, 7);
 457
 458     header = (variant_wire_t *)Buffer;
 459
 460     header->clSize = 0; /* fixed up at the end */
 461     header->rpcReserverd = 0;
 462     header->vt = pvar->n1.n2.vt;
 463     header->wReserved1 = pvar->n1.n2.wReserved1;
 464     header->wReserved2 = pvar->n1.n2.wReserved2;
 465     header->wReserved3 = pvar->n1.n2.wReserved3;
 466     header->switch_is = pvar->n1.n2.vt;
 467     if(header->switch_is & VT_ARRAY)
 468         header->switch_is &= ~VT_TYPEMASK;
 469
 470     Pos = (unsigned char*)(header + 1);
 471     type_size = get_type_size(pFlags, V_VT(pvar));
 472     align = get_type_alignment(pFlags, V_VT(pvar));
 473     ALIGN_POINTER(Pos, align);
 474
 475     if(header->vt & VT_BYREF)
 476     {
 477         *(DWORD *)Pos = max(type_size, 4);
 478         Pos += 4;
 479         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 480         {
 481             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 482             Pos += type_size;
 483         }
 484         else
 485         {
 486             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 487             Pos += 4;
 488         }
 489     }
 490     else
 491     {
 492         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 493             memcpy(Pos, pvar, type_size);
 494         else
 495             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 496         Pos += type_size;
 497     }
 498
 499     if(header->vt & VT_ARRAY)
 500     {
 501         if(header->vt & VT_BYREF)
 502             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 503         else
 504             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 505     }
 506     else
 507     {
 508         switch (header->vt)
 509         {
 510         case VT_BSTR:
 511             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 512             break;
 513         case VT_BSTR | VT_BYREF:
 514             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 515             break;
 516         case VT_VARIANT | VT_BYREF:
 517             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 518             break;
 519         case VT_UNKNOWN:
 520             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 521             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 522             break;
 523         case VT_UNKNOWN | VT_BYREF:
 524             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 525             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 526             break;
 527         case VT_DISPATCH:
 528             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 529             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 530             break;
 531         case VT_DISPATCH | VT_BYREF:
 532             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 533             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 534             break;
 535         case VT_RECORD:
 536             FIXME("handle BRECORD by val\n");
 537             break;
 538         case VT_RECORD | VT_BYREF:
 539             FIXME("handle BRECORD by ref\n");
 540             break;
 541         }
 542     }
 543     header->clSize = ((Pos - Buffer) + 7) >> 3;
 544     TRACE("marshalled size=%d\n", header->clSize);
 545     return Pos;
 546 }
 547
 548 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 549 {
 550     variant_wire_t *header;
 551     ULONG type_size;
 552     int align;
 553     unsigned char *Pos;
 554
 555     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 556
 557     ALIGN_POINTER(Buffer, 7);
 558
 559     header = (variant_wire_t *)Buffer;
 560
 561     Pos = (unsigned char*)(header + 1);
 562     type_size = get_type_size(pFlags, header->vt);
 563     align = get_type_alignment(pFlags, header->vt);
 564     ALIGN_POINTER(Pos, align);
 565
 566     if(header->vt & VT_BYREF)
 567     {
 568         ULONG mem_size;
 569         Pos += 4;
 570
 571         switch (header->vt & ~VT_BYREF)
 572         {
 573         /* these types have a different memory size compared to wire size */
 574         case VT_UNKNOWN:
 575         case VT_DISPATCH:
 576         case VT_BSTR:
 577             mem_size = sizeof(void *);
 578             break;
 579         default:
 580             mem_size = type_size;
 581             break;
 582         }
 583
 584         if (V_VT(pvar) != header->vt)
 585         {
 586             VariantClear(pvar);
 587             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 588         }
 589         else if (!V_BYREF(pvar))
 590             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 591         memcpy(V_BYREF(pvar), Pos, type_size);
 592         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 593             Pos += type_size;
 594         else
 595             Pos += 4;
 596     }
 597     else
 598     {
 599         VariantClear(pvar);
 600         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 601             memcpy(pvar, Pos, type_size);
 602         else
 603             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 604         Pos += type_size;
 605     }
 606
 607     pvar->n1.n2.vt = header->vt;
 608     pvar->n1.n2.wReserved1 = header->wReserved1;
 609     pvar->n1.n2.wReserved2 = header->wReserved2;
 610     pvar->n1.n2.wReserved3 = header->wReserved3;
 611
 612     if(header->vt & VT_ARRAY)
 613     {
 614         if(header->vt & VT_BYREF)
 615             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 616         else
 617             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 618     }
 619     else
 620     {
 621         switch (header->vt)
 622         {
 623         case VT_BSTR:
 624             V_BSTR(pvar) = NULL;
 625             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 626             break;
 627         case VT_BSTR | VT_BYREF:
 628             *V_BSTRREF(pvar) = NULL;
 629             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 630             break;
 631         case VT_VARIANT | VT_BYREF:
 632             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 633             break;
 634         case VT_UNKNOWN:
 635             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 636             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 637             break;
 638         case VT_UNKNOWN | VT_BYREF:
 639             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 640             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 641             break;
 642         case VT_DISPATCH:
 643             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 644             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 645             break;
 646         case VT_DISPATCH | VT_BYREF:
 647             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 648             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 649             break;
 650         case VT_RECORD:
 651             FIXME("handle BRECORD by val\n");
 652             break;
 653         case VT_RECORD | VT_BYREF:
 654             FIXME("handle BRECORD by ref\n");
 655             break;
 656         }
 657     }
 658     return Pos;
 659 }
 660
 661 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 662 {
 663   VARTYPE vt = V_VT(pvar);
 664   PVOID ref = NULL;
 665
 666   TRACE("(%x,%p)\n", *pFlags, pvar);
 667   TRACE("vt=%04x\n", V_VT(pvar));
 668
 669   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 670
 671   VariantClear(pvar);
 672   if (!ref) return;
 673
 674   if(vt & VT_ARRAY)
 675   {
 676     if (vt & VT_BYREF)
 677       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 678     else
 679       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 680   }
 681   else
 682   {
 683     switch (vt)
 684     {
 685     case VT_BSTR | VT_BYREF:
 686       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 687       break;
 688     case VT_VARIANT | VT_BYREF:
 689       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 690       break;
 691     case VT_RECORD | VT_BYREF:
 692       FIXME("handle BRECORD by ref\n");
 693       break;
 694     case VT_UNKNOWN | VT_BYREF:
 695     case VT_DISPATCH | VT_BYREF:
 696       IUnknown_Release(*V_UNKNOWNREF(pvar));
 697       break;
 698     }
 699   }
 700
 701   CoTaskMemFree(ref);
 702 }
 703
 704 /* LPSAFEARRAY */
 705
 706 /* Get the number of cells in a SafeArray */
 707 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 708 {
 709     const SAFEARRAYBOUND* psab = psa->rgsabound;
 710     USHORT cCount = psa->cDims;
 711     ULONG ulNumCells = 1;
 712
 713     while (cCount--)
 714     {
 715         /* This is a valid bordercase. See testcases. -Marcus */
 716         if (!psab->cElements)
 717             return 0;
 718         ulNumCells *= psab->cElements;
 719         psab++;
 720     }
 721     return ulNumCells;
 722 }
 723
 724 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 725 {
 726     VARTYPE vt;
 727     HRESULT hr;
 728
 729     hr = SafeArrayGetVartype(psa, &vt);
 730     if (FAILED(hr))
 731     {
 732         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 733
 734         switch(psa->cbElements)
 735         {
 736         case 1: vt = VT_I1; break;
 737         case 2: vt = VT_I2; break;
 738         case 4: vt = VT_I4; break;
 739         case 8: vt = VT_I8; break;
 740         default:
 741             RpcRaiseException(hr);
 742         }
 743     }
 744
 745     if (psa->fFeatures & FADF_HAVEIID)
 746         return SF_HAVEIID;
 747
 748     switch (vt)
 749     {
 750     case VT_I1:
 751     case VT_UI1:      return SF_I1;
 752     case VT_BOOL:
 753     case VT_I2:
 754     case VT_UI2:      return SF_I2;
 755     case VT_INT:
 756     case VT_UINT:
 757     case VT_I4:
 758     case VT_UI4:
 759     case VT_R4:       return SF_I4;
 760     case VT_DATE:
 761     case VT_CY:
 762     case VT_R8:
 763     case VT_I8:
 764     case VT_UI8:      return SF_I8;
 765     case VT_INT_PTR:
 766     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 767     case VT_BSTR:     return SF_BSTR;
 768     case VT_DISPATCH: return SF_DISPATCH;
 769     case VT_VARIANT:  return SF_VARIANT;
 770     case VT_UNKNOWN:  return SF_UNKNOWN;
 771     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 772      * of a UDT is taken from the result of IRecordInfo_GetSize().
 773      */
 774     case VT_RECORD:   return SF_RECORD;
 775     default:          return SF_ERROR;
 776     }
 777 }
 778
 779 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 780 {
 781     if (sftype == SF_BSTR)
 782         return sizeof(DWORD);
 783     else if (sftype == SF_VARIANT)
 784         return sizeof(variant_wire_t) - sizeof(DWORD);
 785     else
 786         return lpsa->cbElements;
 787 }
 788
 789 static DWORD elem_mem_size(wireSAFEARRAY wiresa, SF_TYPE sftype)
 790 {
 791     if (sftype == SF_BSTR)
 792         return sizeof(BSTR);
 793     else if (sftype == SF_VARIANT)
 794         return sizeof(VARIANT);
 795     else
 796         return wiresa->cbElements;
 797 }
 798
 799 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 800 {
 801     ULONG size = StartingSize;
 802
 803     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 804
 805     ALIGN_LENGTH(size, 3);
 806     size += sizeof(ULONG);
 807     if (*ppsa)
 808     {
 809         SAFEARRAY *psa = *ppsa;
 810         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 811         SF_TYPE sftype;
 812         HRESULT hr;
 813
 814         size += sizeof(ULONG);
 815         size += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 816
 817         sftype = SAFEARRAY_GetUnionType(psa);
 818         size += sizeof(ULONG);
 819
 820         size += sizeof(ULONG);
 821         size += sizeof(ULONG);
 822         if (sftype == SF_HAVEIID)
 823             size += sizeof(IID);
 824
 825         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 826
 827         size += sizeof(ULONG);
 828
 829         switch (sftype)
 830         {
 831             case SF_BSTR:
 832             {
 833                 BSTR* lpBstr;
 834
 835                 for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 836                     size = BSTR_UserSize(pFlags, size, lpBstr);
 837
 838                 break;
 839             }
 840             case SF_DISPATCH:
 841             case SF_UNKNOWN:
 842             case SF_HAVEIID:
 843                 FIXME("size interfaces\n");
 844                 break;
 845             case SF_VARIANT:
 846             {
 847                 VARIANT* lpVariant;
 848
 849                 for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 850                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 851
 852                 break;
 853             }
 854             case SF_RECORD:
 855             {
 856                 IRecordInfo* pRecInfo = NULL;
 857
 858                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 859                 if (FAILED(hr))
 860                     RpcRaiseException(hr);
 861
 862                 if (pRecInfo)
 863                 {
 864                     FIXME("size record info %p\n", pRecInfo);
 865
 866                     IRecordInfo_Release(pRecInfo);
 867                 }
 868                 break;
 869             }
 870             case SF_I8:
 871                 ALIGN_LENGTH(size, 7);
 872                 /* fallthrough */
 873             case SF_I1:
 874             case SF_I2:
 875             case SF_I4:
 876                 size += ulCellCount * psa->cbElements;
 877                 break;
 878             default:
 879                 break;
 880         }
 881
 882     }
 883
 884     return size;
 885 }
 886
 887 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 888 {
 889     HRESULT hr;
 890
 891     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 892
 893     ALIGN_POINTER(Buffer, 3);
 894     *(ULONG *)Buffer = *ppsa ? 0x1 : 0x0;
 895     Buffer += sizeof(ULONG);
 896     if (*ppsa)
 897     {
 898         VARTYPE vt;
 899         SAFEARRAY *psa = *ppsa;
 900         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 901         SAFEARRAYBOUND *bound;
 902         SF_TYPE sftype;
 903         GUID guid;
 904         INT i;
 905
 906         sftype = SAFEARRAY_GetUnionType(psa);
 907
 908         *(ULONG *)Buffer = psa->cDims;
 909         Buffer += sizeof(ULONG);
 910         *(USHORT *)Buffer = psa->cDims;
 911         Buffer += sizeof(USHORT);
 912         *(USHORT *)Buffer = psa->fFeatures;
 913         Buffer += sizeof(USHORT);
 914         *(ULONG *)Buffer = elem_wire_size(psa, sftype);
 915         Buffer += sizeof(ULONG);
 916
 917         hr = SafeArrayGetVartype(psa, &vt);
 918         if (FAILED(hr)) vt = 0;
 919
 920         *(ULONG *)Buffer = (USHORT)psa->cLocks | (vt << 16);
 921         Buffer += sizeof(ULONG);
 922
 923         *(ULONG *)Buffer = sftype;
 924         Buffer += sizeof(ULONG);
 925
 926         *(ULONG *)Buffer = ulCellCount;
 927         Buffer += sizeof(ULONG);
 928         *(ULONG *)Buffer = psa->pvData ? 0x2 : 0x0;
 929         Buffer += sizeof(ULONG);
 930         if (sftype == SF_HAVEIID)
 931         {
 932             SafeArrayGetIID(psa, &guid);
 933             memcpy(Buffer, &guid, sizeof(guid));
 934             Buffer += sizeof(guid);
 935         }
 936
 937         /* bounds are marshaled in opposite order comparing to storage layout */
 938         bound = (SAFEARRAYBOUND*)Buffer;
 939         for (i = 0; i < psa->cDims; i++)
 940         {
 941             memcpy(bound++, &psa->rgsabound[psa->cDims-i-1], sizeof(psa->rgsabound[0]));
 942         }
 943         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 944
 945         *(ULONG *)Buffer = ulCellCount;
 946         Buffer += sizeof(ULONG);
 947
 948         if (psa->pvData)
 949         {
 950             switch (sftype)
 951             {
 952                 case SF_BSTR:
 953                 {
 954                     BSTR* lpBstr;
 955
 956                     for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 957                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 958
 959                     break;
 960                 }
 961                 case SF_DISPATCH:
 962                 case SF_UNKNOWN:
 963                 case SF_HAVEIID:
 964                     FIXME("marshal interfaces\n");
 965                     break;
 966                 case SF_VARIANT:
 967                 {
 968                     VARIANT* lpVariant;
 969
 970                     for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 971                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 972
 973                     break;
 974                 }
 975                 case SF_RECORD:
 976                 {
 977                     IRecordInfo* pRecInfo = NULL;
 978
 979                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 980                     if (FAILED(hr))
 981                         RpcRaiseException(hr);
 982
 983                     if (pRecInfo)
 984                     {
 985                         FIXME("write record info %p\n", pRecInfo);
 986
 987                         IRecordInfo_Release(pRecInfo);
 988                     }
 989                     break;
 990                 }
 991
 992                 case SF_I8:
 993                     ALIGN_POINTER(Buffer, 7);
 994                     /* fallthrough */
 995                 case SF_I1:
 996                 case SF_I2:
 997                 case SF_I4:
 998                     /* Just copy the data over */
 999                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
1000                     Buffer += ulCellCount * psa->cbElements;
1001                     break;
1002                 default:
1003                     break;
1004             }
1005         }
1006
1007     }
1008     return Buffer;
1009 }
1010
1011 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
1012                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
1013                            FADF_VARIANT | FADF_CREATEVECTOR)
1014
1015 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
1016 {
1017     ULONG ptr;
1018     wireSAFEARRAY wiresa;
1019     ULONG cDims;
1020     HRESULT hr;
1021     SF_TYPE sftype;
1022     ULONG cell_count;
1023     GUID guid;
1024     VARTYPE vt;
1025     SAFEARRAYBOUND *wiresab;
1026
1027     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
1028
1029     ALIGN_POINTER(Buffer, 3);
1030     ptr = *(ULONG *)Buffer;
1031     Buffer += sizeof(ULONG);
1032
1033     if (!ptr)
1034     {
1035         *ppsa = NULL;
1036
1037         TRACE("NULL safe array unmarshaled\n");
1038
1039         return Buffer;
1040     }
1041
1042     cDims = *(ULONG *)Buffer;
1043     Buffer += sizeof(ULONG);
1044
1045     wiresa = (wireSAFEARRAY)Buffer;
1046     Buffer += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
1047
1048     if (cDims != wiresa->cDims)
1049         RpcRaiseException(RPC_S_INVALID_BOUND);
1050
1051     /* FIXME: there should be a limit on how large cDims can be */
1052
1053     vt = HIWORD(wiresa->cLocks);
1054
1055     sftype = *(ULONG *)Buffer;
1056     Buffer += sizeof(ULONG);
1057
1058     cell_count = *(ULONG *)Buffer;
1059     Buffer += sizeof(ULONG);
1060     ptr = *(ULONG *)Buffer;
1061     Buffer += sizeof(ULONG);
1062     if (sftype == SF_HAVEIID)
1063     {
1064         memcpy(&guid, Buffer, sizeof(guid));
1065         Buffer += sizeof(guid);
1066     }
1067
1068     wiresab = (SAFEARRAYBOUND *)Buffer;
1069     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1070
1071     if(vt)
1072         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1073     else
1074     {
1075         SafeArrayAllocDescriptor(wiresa->cDims, ppsa);
1076         if(*ppsa)
1077             memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1078     }
1079     if (!*ppsa)
1080         RpcRaiseException(E_OUTOFMEMORY);
1081
1082     /* be careful about which flags we set since they could be a security
1083      * risk */
1084     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1085     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1086     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1087     (*ppsa)->cbElements = elem_mem_size(wiresa, sftype);
1088     (*ppsa)->cLocks = LOWORD(wiresa->cLocks);
1089
1090     /* SafeArrayCreateEx allocates the data for us, but
1091      * SafeArrayAllocDescriptor doesn't */
1092     if(!vt)
1093     {
1094         hr = SafeArrayAllocData(*ppsa);
1095         if (FAILED(hr))
1096             RpcRaiseException(hr);
1097     }
1098
1099     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1100         RpcRaiseException(RPC_S_INVALID_BOUND);
1101     Buffer += sizeof(ULONG);
1102
1103     if (ptr)
1104     {
1105         switch (sftype)
1106         {
1107             case SF_BSTR:
1108             {
1109                 BSTR* lpBstr;
1110
1111                 for (lpBstr = (*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1112                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1113
1114                 break;
1115             }
1116             case SF_DISPATCH:
1117             case SF_UNKNOWN:
1118             case SF_HAVEIID:
1119                 FIXME("marshal interfaces\n");
1120                 break;
1121             case SF_VARIANT:
1122             {
1123                 VARIANT* lpVariant;
1124
1125                 for (lpVariant = (*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1126                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1127
1128                 break;
1129             }
1130             case SF_RECORD:
1131             {
1132                 FIXME("set record info\n");
1133
1134                 break;
1135             }
1136
1137             case SF_I8:
1138                 ALIGN_POINTER(Buffer, 7);
1139                 /* fallthrough */
1140             case SF_I1:
1141             case SF_I2:
1142             case SF_I4:
1143                 /* Just copy the data over */
1144                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1145                 Buffer += cell_count * (*ppsa)->cbElements;
1146                 break;
1147             default:
1148                 break;
1149         }
1150     }
1151
1152     TRACE("safe array unmarshaled: %p\n", *ppsa);
1153
1154     return Buffer;
1155 }
1156
1157 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1158 {
1159     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1160
1161     SafeArrayDestroy(*ppsa);
1162 }
1163
1164
1165 ULONG WINAPI HFONT_UserSize(ULONG *pFlags, ULONG Start, HFONT *phfont)
1166 {
1167     FIXME(":stub\n");
1168     return 0;
1169 }
1170
1171 unsigned char * WINAPI HFONT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1172 {
1173     FIXME(":stub\n");
1174     return NULL;
1175 }
1176
1177 unsigned char * WINAPI HFONT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1178 {
1179     FIXME(":stub\n");
1180     return NULL;
1181 }
1182
1183 void WINAPI HFONT_UserFree(ULONG *pFlags, HFONT *phfont)
1184 {
1185     FIXME(":stub\n");
1186     return;
1187 }
1188
1189
1190 /* IDispatch */
1191 /* exactly how Invoke is marshalled is not very clear to me yet,
1192  * but the way I've done it seems to work for me */
1193
1194 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1195     IDispatch* This,
1196     DISPID dispIdMember,
1197     REFIID riid,
1198     LCID lcid,
1199     WORD wFlags,
1200     DISPPARAMS* pDispParams,
1201     VARIANT* pVarResult,
1202     EXCEPINFO* pExcepInfo,
1203     UINT* puArgErr)
1204 {
1205   HRESULT hr;
1206   VARIANT VarResult;
1207   UINT* rgVarRefIdx = NULL;
1208   VARIANTARG* rgVarRef = NULL;
1209   UINT u, cVarRef;
1210   UINT uArgErr;
1211   EXCEPINFO ExcepInfo;
1212
1213   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1214         dispIdMember, debugstr_guid(riid),
1215         lcid, wFlags, pDispParams, pVarResult,
1216         pExcepInfo, puArgErr);
1217
1218   /* [out] args can't be null, use dummy vars if needed */
1219   if (!pVarResult) pVarResult = &VarResult;
1220   if (!puArgErr) puArgErr = &uArgErr;
1221   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1222
1223   /* count by-ref args */
1224   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1225     VARIANTARG* arg = &pDispParams->rgvarg[u];
1226     if (V_ISBYREF(arg)) {
1227       cVarRef++;
1228     }
1229   }
1230   if (cVarRef) {
1231     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1232     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1233     /* make list of by-ref args */
1234     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1235       VARIANTARG* arg = &pDispParams->rgvarg[u];
1236       if (V_ISBYREF(arg)) {
1237         rgVarRefIdx[cVarRef] = u;
1238         VariantInit(&rgVarRef[cVarRef]);
1239         VariantCopy(&rgVarRef[cVarRef], arg);
1240         VariantClear(arg);
1241         cVarRef++;
1242       }
1243     }
1244   } else {
1245     /* [out] args still can't be null,
1246      * but we can point these anywhere in this case,
1247      * since they won't be written to when cVarRef is 0 */
1248     rgVarRefIdx = puArgErr;
1249     rgVarRef = pVarResult;
1250   }
1251   TRACE("passed by ref: %d args\n", cVarRef);
1252   hr = IDispatch_RemoteInvoke_Proxy(This,
1253                                     dispIdMember,
1254                                     riid,
1255                                     lcid,
1256                                     wFlags,
1257                                     pDispParams,
1258                                     pVarResult,
1259                                     pExcepInfo,
1260                                     puArgErr,
1261                                     cVarRef,
1262                                     rgVarRefIdx,
1263                                     rgVarRef);
1264   if (cVarRef) {
1265     for (u=0; u<cVarRef; u++) {
1266       unsigned i = rgVarRefIdx[u];
1267       VariantCopy(&pDispParams->rgvarg[i],
1268                   &rgVarRef[u]);
1269       VariantClear(&rgVarRef[u]);
1270     }
1271     CoTaskMemFree(rgVarRef);
1272     CoTaskMemFree(rgVarRefIdx);
1273   }
1274
1275   if(pExcepInfo == &ExcepInfo)
1276   {
1277     SysFreeString(pExcepInfo->bstrSource);
1278     SysFreeString(pExcepInfo->bstrDescription);
1279     SysFreeString(pExcepInfo->bstrHelpFile);
1280   }
1281   return hr;
1282 }
1283
1284 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1285     IDispatch* This,
1286     DISPID dispIdMember,
1287     REFIID riid,
1288     LCID lcid,
1289     DWORD dwFlags,
1290     DISPPARAMS* pDispParams,
1291     VARIANT* pVarResult,
1292     EXCEPINFO* pExcepInfo,
1293     UINT* pArgErr,
1294     UINT cVarRef,
1295     UINT* rgVarRefIdx,
1296     VARIANTARG* rgVarRef)
1297 {
1298   HRESULT hr = S_OK;
1299   VARIANTARG *rgvarg, *arg;
1300   UINT u;
1301
1302   /* initialize out parameters, so that they can be marshalled
1303    * in case the real Invoke doesn't initialize them */
1304   VariantInit(pVarResult);
1305   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1306   *pArgErr = 0;
1307
1308   /* let the real Invoke operate on a copy of the in parameters,
1309    * so we don't risk losing pointers to allocated memory */
1310   rgvarg = pDispParams->rgvarg;
1311   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1312   if (!arg) return E_OUTOFMEMORY;
1313
1314   /* init all args so we can call VariantClear on all the args if the copy
1315    * below fails */
1316   for (u = 0; u < pDispParams->cArgs; u++)
1317     VariantInit(&arg[u]);
1318
1319   for (u = 0; u < pDispParams->cArgs; u++) {
1320     hr = VariantCopy(&arg[u], &rgvarg[u]);
1321     if (FAILED(hr))
1322         break;
1323   }
1324
1325   if (SUCCEEDED(hr)) {
1326     /* copy ref args to arg array */
1327     for (u=0; u<cVarRef; u++) {
1328       unsigned i = rgVarRefIdx[u];
1329       VariantCopy(&arg[i], &rgVarRef[u]);
1330     }
1331
1332     pDispParams->rgvarg = arg;
1333
1334     hr = IDispatch_Invoke(This,
1335                           dispIdMember,
1336                           riid,
1337                           lcid,
1338                           dwFlags,
1339                           pDispParams,
1340                           pVarResult,
1341                           pExcepInfo,
1342                           pArgErr);
1343
1344     /* copy ref args from arg array */
1345     for (u=0; u<cVarRef; u++) {
1346       unsigned i = rgVarRefIdx[u];
1347       VariantCopy(&rgVarRef[u], &arg[i]);
1348     }
1349   }
1350
1351   /* clear the duplicate argument list */
1352   for (u=0; u<pDispParams->cArgs; u++)
1353     VariantClear(&arg[u]);
1354
1355   pDispParams->rgvarg = rgvarg;
1356   CoTaskMemFree(arg);
1357
1358   return hr;
1359 }
1360
1361 /* IEnumVARIANT */
1362
1363 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1364     IEnumVARIANT* This,
1365     ULONG celt,
1366     VARIANT* rgVar,
1367     ULONG* pCeltFetched)
1368 {
1369   ULONG fetched;
1370   if (!pCeltFetched)
1371     pCeltFetched = &fetched;
1372   return IEnumVARIANT_RemoteNext_Proxy(This,
1373                                        celt,
1374                                        rgVar,
1375                                        pCeltFetched);
1376 }
1377
1378 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1379     IEnumVARIANT* This,
1380     ULONG celt,
1381     VARIANT* rgVar,
1382     ULONG* pCeltFetched)
1383 {
1384   HRESULT hr;
1385   *pCeltFetched = 0;
1386   hr = IEnumVARIANT_Next(This,
1387                          celt,
1388                          rgVar,
1389                          pCeltFetched);
1390   if (hr == S_OK) *pCeltFetched = celt;
1391   return hr;
1392 }
1393
1394 /* TypeInfo related freers */
1395
1396 static void free_embedded_typedesc(TYPEDESC *tdesc);
1397 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1398 {
1399     switch(adesc->tdescElem.vt)
1400     {
1401     case VT_PTR:
1402     case VT_SAFEARRAY:
1403         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1404         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1405         break;
1406     case VT_CARRAY:
1407         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1408         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1409         break;
1410     }
1411 }
1412
1413 static void free_embedded_typedesc(TYPEDESC *tdesc)
1414 {
1415     switch(tdesc->vt)
1416     {
1417     case VT_PTR:
1418     case VT_SAFEARRAY:
1419         free_embedded_typedesc(tdesc->u.lptdesc);
1420         CoTaskMemFree(tdesc->u.lptdesc);
1421         break;
1422     case VT_CARRAY:
1423         free_embedded_arraydesc(tdesc->u.lpadesc);
1424         CoTaskMemFree(tdesc->u.lpadesc);
1425         break;
1426     }
1427 }
1428
1429 static void free_embedded_elemdesc(ELEMDESC *edesc)
1430 {
1431     free_embedded_typedesc(&edesc->tdesc);
1432     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1433         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1434 }
1435
1436 /* ITypeComp */
1437
1438 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1439     ITypeComp* This,
1440     LPOLESTR szName,
1441     ULONG lHashVal,
1442     WORD wFlags,
1443     ITypeInfo** ppTInfo,
1444     DESCKIND* pDescKind,
1445     BINDPTR* pBindPtr)
1446 {
1447   FIXME("not implemented\n");
1448   return E_FAIL;
1449 }
1450
1451 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1452     ITypeComp* This,
1453     LPOLESTR szName,
1454     ULONG lHashVal,
1455     WORD wFlags,
1456     ITypeInfo** ppTInfo,
1457     DESCKIND* pDescKind,
1458     LPFUNCDESC* ppFuncDesc,
1459     LPVARDESC* ppVarDesc,
1460     ITypeComp** ppTypeComp,
1461     CLEANLOCALSTORAGE* pDummy)
1462 {
1463   FIXME("not implemented\n");
1464   return E_FAIL;
1465 }
1466
1467 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1468     ITypeComp* This,
1469     LPOLESTR szName,
1470     ULONG lHashVal,
1471     ITypeInfo** ppTInfo,
1472     ITypeComp** ppTComp)
1473 {
1474   FIXME("not implemented\n");
1475   return E_FAIL;
1476 }
1477
1478 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1479     ITypeComp* This,
1480     LPOLESTR szName,
1481     ULONG lHashVal,
1482     ITypeInfo** ppTInfo)
1483 {
1484   FIXME("not implemented\n");
1485   return E_FAIL;
1486 }
1487
1488 /* ITypeInfo */
1489
1490 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1491     ITypeInfo* This,
1492     TYPEATTR** ppTypeAttr)
1493
1494 {
1495     CLEANLOCALSTORAGE stg;
1496     TRACE("(%p, %p)\n", This, ppTypeAttr);
1497
1498     stg.flags = 0;
1499     stg.pStorage = NULL;
1500     stg.pInterface = NULL;
1501
1502     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1503 }
1504
1505 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1506     ITypeInfo* This,
1507     LPTYPEATTR* ppTypeAttr,
1508     CLEANLOCALSTORAGE* pDummy)
1509 {
1510     HRESULT hr;
1511     TRACE("(%p, %p)\n", This, ppTypeAttr);
1512
1513     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1514     if(hr != S_OK)
1515         return hr;
1516
1517     pDummy->flags = CLS_TYPEATTR;
1518     ITypeInfo_AddRef(This);
1519     pDummy->pInterface = (IUnknown*)This;
1520     pDummy->pStorage = ppTypeAttr;
1521     return hr;
1522 }
1523
1524 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1525     ITypeInfo* This,
1526     UINT index,
1527     FUNCDESC** ppFuncDesc)
1528 {
1529     CLEANLOCALSTORAGE stg;
1530     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1531
1532     stg.flags = 0;
1533     stg.pStorage = NULL;
1534     stg.pInterface = NULL;
1535
1536     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1537 }
1538
1539 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1540     ITypeInfo* This,
1541     UINT index,
1542     LPFUNCDESC* ppFuncDesc,
1543     CLEANLOCALSTORAGE* pDummy)
1544 {
1545     HRESULT hr;
1546     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1547
1548     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1549     if(hr != S_OK)
1550         return hr;
1551
1552     pDummy->flags = CLS_FUNCDESC;
1553     ITypeInfo_AddRef(This);
1554     pDummy->pInterface = (IUnknown*)This;
1555     pDummy->pStorage = ppFuncDesc;
1556     return hr;
1557 }
1558
1559 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1560     ITypeInfo* This,
1561     UINT index,
1562     VARDESC** ppVarDesc)
1563 {
1564     CLEANLOCALSTORAGE stg;
1565     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1566
1567     stg.flags = 0;
1568     stg.pStorage = NULL;
1569     stg.pInterface = NULL;
1570
1571     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1572 }
1573
1574 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1575     ITypeInfo* This,
1576     UINT index,
1577     LPVARDESC* ppVarDesc,
1578     CLEANLOCALSTORAGE* pDummy)
1579 {
1580     HRESULT hr;
1581     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1582
1583     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1584     if(hr != S_OK)
1585         return hr;
1586
1587     pDummy->flags = CLS_VARDESC;
1588     ITypeInfo_AddRef(This);
1589     pDummy->pInterface = (IUnknown*)This;
1590     pDummy->pStorage = ppVarDesc;
1591     return hr;
1592 }
1593
1594 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1595     ITypeInfo* This,
1596     MEMBERID memid,
1597     BSTR* rgBstrNames,
1598     UINT cMaxNames,
1599     UINT* pcNames)
1600 {
1601   FIXME("not implemented\n");
1602   return E_FAIL;
1603 }
1604
1605 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1606     ITypeInfo* This,
1607     MEMBERID memid,
1608     BSTR* rgBstrNames,
1609     UINT cMaxNames,
1610     UINT* pcNames)
1611 {
1612   FIXME("not implemented\n");
1613   return E_FAIL;
1614 }
1615
1616 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1617     ITypeInfo* This,
1618     LPOLESTR* rgszNames,
1619     UINT cNames,
1620     MEMBERID* pMemId)
1621 {
1622   FIXME("not implemented\n");
1623   return E_FAIL;
1624 }
1625
1626 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1627     ITypeInfo* This)
1628 {
1629   FIXME("not implemented\n");
1630   return E_FAIL;
1631 }
1632
1633 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1634     ITypeInfo* This,
1635     PVOID pvInstance,
1636     MEMBERID memid,
1637     WORD wFlags,
1638     DISPPARAMS* pDispParams,
1639     VARIANT* pVarResult,
1640     EXCEPINFO* pExcepInfo,
1641     UINT* puArgErr)
1642 {
1643   FIXME("not implemented\n");
1644   return E_FAIL;
1645 }
1646
1647 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1648     ITypeInfo* This)
1649 {
1650   FIXME("not implemented\n");
1651   return E_FAIL;
1652 }
1653
1654 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(
1655     ITypeInfo* This,
1656     MEMBERID memid,
1657     BSTR* pBstrName,
1658     BSTR* pBstrDocString,
1659     DWORD* pdwHelpContext,
1660     BSTR* pBstrHelpFile)
1661 {
1662     DWORD help_context;
1663     BSTR name, doc_string, help_file;
1664     HRESULT hr;
1665     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1666
1667     /* FIXME: presumably refPtrFlags is supposed to be a bitmask of which ptrs we actually want? */
1668     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, 0, &name, &doc_string, &help_context, &help_file);
1669     if(SUCCEEDED(hr))
1670     {
1671         if(pBstrName) *pBstrName = name;
1672         else SysFreeString(name);
1673
1674         if(pBstrDocString) *pBstrDocString = doc_string;
1675         else SysFreeString(doc_string);
1676
1677         if(pBstrHelpFile) *pBstrHelpFile = help_file;
1678         else SysFreeString(help_file);
1679
1680         if(pdwHelpContext) *pdwHelpContext = help_context;
1681     }
1682     return hr;
1683 }
1684
1685 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(
1686     ITypeInfo* This,
1687     MEMBERID memid,
1688     DWORD refPtrFlags,
1689     BSTR* pBstrName,
1690     BSTR* pBstrDocString,
1691     DWORD* pdwHelpContext,
1692     BSTR* pBstrHelpFile)
1693 {
1694     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, refPtrFlags, pBstrName, pBstrDocString,
1695           pdwHelpContext, pBstrHelpFile);
1696     return ITypeInfo_GetDocumentation(This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1697 }
1698
1699 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(
1700     ITypeInfo* This,
1701     MEMBERID memid,
1702     INVOKEKIND invKind,
1703     BSTR* pBstrDllName,
1704     BSTR* pBstrName,
1705     WORD* pwOrdinal)
1706 {
1707   FIXME("not implemented\n");
1708   return E_FAIL;
1709 }
1710
1711 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(
1712     ITypeInfo* This,
1713     MEMBERID memid,
1714     INVOKEKIND invKind,
1715     DWORD refPtrFlags,
1716     BSTR* pBstrDllName,
1717     BSTR* pBstrName,
1718     WORD* pwOrdinal)
1719 {
1720   FIXME("not implemented\n");
1721   return E_FAIL;
1722 }
1723
1724 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1725     ITypeInfo* This,
1726     MEMBERID memid,
1727     INVOKEKIND invKind,
1728     PVOID* ppv)
1729 {
1730   FIXME("not implemented\n");
1731   return E_FAIL;
1732 }
1733
1734 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1735     ITypeInfo* This)
1736 {
1737   FIXME("not implemented\n");
1738   return E_FAIL;
1739 }
1740
1741 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1742     ITypeInfo* This,
1743     IUnknown* pUnkOuter,
1744     REFIID riid,
1745     PVOID* ppvObj)
1746 {
1747   FIXME("not implemented\n");
1748   return E_FAIL;
1749 }
1750
1751 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1752     ITypeInfo* This,
1753     REFIID riid,
1754     IUnknown** ppvObj)
1755 {
1756   FIXME("not implemented\n");
1757   return E_FAIL;
1758 }
1759
1760 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1761     ITypeInfo* This,
1762     ITypeLib** ppTLib,
1763     UINT* pIndex)
1764 {
1765     ITypeLib *pTL;
1766     UINT index;
1767     HRESULT hr;
1768
1769     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1770
1771     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1772     if(SUCCEEDED(hr))
1773     {
1774         if(pIndex)
1775             *pIndex = index;
1776
1777         if(ppTLib)
1778             *ppTLib = pTL;
1779         else
1780             ITypeLib_Release(pTL);
1781     }
1782     return hr;
1783 }
1784
1785 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1786     ITypeInfo* This,
1787     ITypeLib** ppTLib,
1788     UINT* pIndex)
1789 {
1790     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1791     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1792 }
1793
1794 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1795     ITypeInfo* This,
1796     TYPEATTR* pTypeAttr)
1797 {
1798     TRACE("(%p, %p)\n", This, pTypeAttr);
1799     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1800     CoTaskMemFree(pTypeAttr);
1801 }
1802
1803 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1804     ITypeInfo* This)
1805 {
1806     TRACE("nothing to do\n");
1807     return S_OK;
1808 }
1809
1810 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1811     ITypeInfo* This,
1812     FUNCDESC* pFuncDesc)
1813 {
1814     SHORT param;
1815     TRACE("(%p, %p)\n", This, pFuncDesc);
1816
1817     for(param = 0; param < pFuncDesc->cParams; param++)
1818         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1819     if(param)
1820         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1821
1822     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1823
1824     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1825         CoTaskMemFree(pFuncDesc->lprgscode);
1826
1827     CoTaskMemFree(pFuncDesc);
1828 }
1829
1830 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1831     ITypeInfo* This)
1832 {
1833     TRACE("nothing to do\n");
1834     return S_OK;
1835 }
1836
1837 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1838     ITypeInfo* This,
1839     VARDESC* pVarDesc)
1840 {
1841     TRACE("(%p, %p)\n", This, pVarDesc);
1842
1843     CoTaskMemFree(pVarDesc->lpstrSchema);
1844
1845     if(pVarDesc->varkind == VAR_CONST)
1846         CoTaskMemFree(pVarDesc->u.lpvarValue);
1847
1848     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1849     CoTaskMemFree(pVarDesc);
1850 }
1851
1852 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1853     ITypeInfo* This)
1854 {
1855     TRACE("nothing to do\n");
1856     return S_OK;
1857 }
1858
1859
1860 /* ITypeInfo2 */
1861
1862 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(
1863     ITypeInfo2* This,
1864     MEMBERID memid,
1865     LCID lcid,
1866     BSTR* pbstrHelpString,
1867     DWORD* pdwHelpStringContext,
1868     BSTR* pbstrHelpStringDll)
1869 {
1870   FIXME("not implemented\n");
1871   return E_FAIL;
1872 }
1873
1874 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(
1875     ITypeInfo2* This,
1876     MEMBERID memid,
1877     LCID lcid,
1878     DWORD refPtrFlags,
1879     BSTR* pbstrHelpString,
1880     DWORD* pdwHelpStringContext,
1881     BSTR* pbstrHelpStringDll)
1882 {
1883   FIXME("not implemented\n");
1884   return E_FAIL;
1885 }
1886
1887 /* ITypeLib */
1888
1889 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1890     ITypeLib* This)
1891 {
1892     UINT count = 0;
1893     TRACE("(%p)\n", This);
1894
1895     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1896
1897     return count;
1898 }
1899
1900 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1901     ITypeLib* This,
1902     UINT* pcTInfo)
1903 {
1904     TRACE("(%p, %p)\n", This, pcTInfo);
1905     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1906     return S_OK;
1907 }
1908
1909 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1910     ITypeLib* This,
1911     TLIBATTR** ppTLibAttr)
1912 {
1913     CLEANLOCALSTORAGE stg;
1914     TRACE("(%p, %p)\n", This, ppTLibAttr);
1915
1916     stg.flags = 0;
1917     stg.pStorage = NULL;
1918     stg.pInterface = NULL;
1919
1920     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1921 }
1922
1923 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1924     ITypeLib* This,
1925     LPTLIBATTR* ppTLibAttr,
1926     CLEANLOCALSTORAGE* pDummy)
1927 {
1928     HRESULT hr;
1929     TRACE("(%p, %p)\n", This, ppTLibAttr);
1930
1931     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1932     if(hr != S_OK)
1933         return hr;
1934
1935     pDummy->flags = CLS_LIBATTR;
1936     ITypeLib_AddRef(This);
1937     pDummy->pInterface = (IUnknown*)This;
1938     pDummy->pStorage = ppTLibAttr;
1939     return hr;
1940 }
1941
1942 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(
1943     ITypeLib* This,
1944     INT index,
1945     BSTR* pBstrName,
1946     BSTR* pBstrDocString,
1947     DWORD* pdwHelpContext,
1948     BSTR* pBstrHelpFile)
1949 {
1950   FIXME("not implemented\n");
1951   return E_FAIL;
1952 }
1953
1954 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(
1955     ITypeLib* This,
1956     INT index,
1957     DWORD refPtrFlags,
1958     BSTR* pBstrName,
1959     BSTR* pBstrDocString,
1960     DWORD* pdwHelpContext,
1961     BSTR* pBstrHelpFile)
1962 {
1963   FIXME("not implemented\n");
1964   return E_FAIL;
1965 }
1966
1967 HRESULT CALLBACK ITypeLib_IsName_Proxy(
1968     ITypeLib* This,
1969     LPOLESTR szNameBuf,
1970     ULONG lHashVal,
1971     BOOL* pfName)
1972 {
1973   FIXME("not implemented\n");
1974   return E_FAIL;
1975 }
1976
1977 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
1978     ITypeLib* This,
1979     LPOLESTR szNameBuf,
1980     ULONG lHashVal,
1981     BOOL* pfName,
1982     BSTR* pBstrLibName)
1983 {
1984   FIXME("not implemented\n");
1985   return E_FAIL;
1986 }
1987
1988 HRESULT CALLBACK ITypeLib_FindName_Proxy(
1989     ITypeLib* This,
1990     LPOLESTR szNameBuf,
1991     ULONG lHashVal,
1992     ITypeInfo** ppTInfo,
1993     MEMBERID* rgMemId,
1994     USHORT* pcFound)
1995 {
1996   FIXME("not implemented\n");
1997   return E_FAIL;
1998 }
1999
2000 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
2001     ITypeLib* This,
2002     LPOLESTR szNameBuf,
2003     ULONG lHashVal,
2004     ITypeInfo** ppTInfo,
2005     MEMBERID* rgMemId,
2006     USHORT* pcFound,
2007     BSTR* pBstrLibName)
2008 {
2009   FIXME("not implemented\n");
2010   return E_FAIL;
2011 }
2012
2013 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
2014     ITypeLib* This,
2015     TLIBATTR* pTLibAttr)
2016 {
2017     TRACE("(%p, %p)\n", This, pTLibAttr);
2018     CoTaskMemFree(pTLibAttr);
2019 }
2020
2021 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
2022     ITypeLib* This)
2023 {
2024     TRACE("nothing to do\n");
2025     return S_OK;
2026 }
2027
2028
2029 /* ITypeLib2 */
2030
2031 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
2032     ITypeLib2* This,
2033     ULONG* pcUniqueNames,
2034     ULONG* pcchUniqueNames)
2035 {
2036   FIXME("not implemented\n");
2037   return E_FAIL;
2038 }
2039
2040 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
2041     ITypeLib2* This,
2042     ULONG* pcUniqueNames,
2043     ULONG* pcchUniqueNames)
2044 {
2045   FIXME("not implemented\n");
2046   return E_FAIL;
2047 }
2048
2049 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(
2050     ITypeLib2* This,
2051     INT index,
2052     LCID lcid,
2053     BSTR* pbstrHelpString,
2054     DWORD* pdwHelpStringContext,
2055     BSTR* pbstrHelpStringDll)
2056 {
2057   FIXME("not implemented\n");
2058   return E_FAIL;
2059 }
2060
2061 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(
2062     ITypeLib2* This,
2063     INT index,
2064     LCID lcid,
2065     DWORD refPtrFlags,
2066     BSTR* pbstrHelpString,
2067     DWORD* pdwHelpStringContext,
2068     BSTR* pbstrHelpStringDll)
2069 {
2070   FIXME("not implemented\n");
2071   return E_FAIL;
2072 }
2073
2074 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2075     IPropertyBag* This,
2076     LPCOLESTR pszPropName,
2077     VARIANT *pVar,
2078     IErrorLog *pErrorLog)
2079 {
2080   IUnknown *pUnk = NULL;
2081   TRACE("(%p, %s, %p, %p)\n", This, debugstr_w(pszPropName), pVar, pErrorLog);
2082
2083   if(!pVar)
2084     return E_POINTER;
2085
2086   if(V_VT(pVar) & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2087   {
2088     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2089     return E_NOTIMPL;
2090   }
2091
2092   switch(V_VT(pVar))
2093   {
2094     case VT_DISPATCH:
2095       pUnk = (IUnknown*)V_DISPATCH(pVar);
2096       break;
2097     case VT_UNKNOWN:
2098       pUnk = V_UNKNOWN(pVar);
2099       break;
2100     case VT_SAFEARRAY:
2101       FIXME("Safearray support not yet implemented.\n");
2102       return E_NOTIMPL;
2103     default:
2104       FIXME("Unknown V_VT %d - support not yet implemented.\n", V_VT(pVar));
2105       return E_NOTIMPL;
2106   }
2107
2108   return IPropertyBag_RemoteRead_Proxy(This, pszPropName, pVar, pErrorLog,
2109                                        V_VT(pVar), pUnk);
2110 }
2111
2112 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2113     IPropertyBag* This,
2114     LPCOLESTR pszPropName,
2115     VARIANT *pVar,
2116     IErrorLog *pErrorLog,
2117     DWORD varType,
2118     IUnknown *pUnkObj)
2119 {
2120   static const WCHAR emptyWstr[1] = {0};
2121   IDispatch *disp;
2122   HRESULT hr;
2123   TRACE("(%p, %s, %p, %p, %x, %p)\n", This, debugstr_w(pszPropName), pVar,
2124                                      pErrorLog, varType, pUnkObj);
2125
2126   if(varType & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2127   {
2128     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2129     return E_NOTIMPL;
2130   }
2131
2132   V_VT(pVar) = varType;
2133   switch(varType)
2134   {
2135     case VT_DISPATCH:
2136       hr = IUnknown_QueryInterface(pUnkObj, &IID_IDispatch, (LPVOID*)&disp);
2137       if(FAILED(hr))
2138         return hr;
2139       IUnknown_Release(pUnkObj);
2140       V_DISPATCH(pVar) = disp;
2141       break;
2142     case VT_UNKNOWN:
2143       V_UNKNOWN(pVar) = pUnkObj;
2144       break;
2145     case VT_BSTR:
2146       V_BSTR(pVar) = SysAllocString(emptyWstr);
2147       break;
2148     case VT_SAFEARRAY:
2149       FIXME("Safearray support not yet implemented.\n");
2150       return E_NOTIMPL;
2151     default:
2152       break;
2153   }
2154   hr = IPropertyBag_Read(This, pszPropName, pVar, pErrorLog);
2155   if(FAILED(hr))
2156     VariantClear(pVar);
2157
2158   return hr;
2159 }
2160
2161 /* call_as/local stubs for ocidl.idl */
2162
2163 HRESULT CALLBACK IClassFactory2_CreateInstanceLic_Proxy(
2164     IClassFactory2* This,
2165     IUnknown *pUnkOuter,
2166     IUnknown *pUnkReserved,
2167     REFIID riid,
2168     BSTR bstrKey,
2169     PVOID *ppvObj)
2170 {
2171     FIXME("not implemented\n");
2172     return E_NOTIMPL;
2173 }
2174
2175 HRESULT __RPC_STUB IClassFactory2_CreateInstanceLic_Stub(
2176     IClassFactory2* This,
2177     REFIID riid,
2178     BSTR bstrKey,
2179     IUnknown **ppvObj)
2180 {
2181     FIXME("not implemented\n");
2182     return E_NOTIMPL;
2183 }
2184
2185 HRESULT CALLBACK IEnumConnections_Next_Proxy(
2186     IEnumConnections* This,
2187     ULONG cConnections,
2188     LPCONNECTDATA rgcd,
2189     ULONG *pcFetched)
2190 {
2191     FIXME("not implemented\n");
2192     return E_NOTIMPL;
2193 }
2194
2195 HRESULT __RPC_STUB IEnumConnections_Next_Stub(
2196     IEnumConnections* This,
2197     ULONG cConnections,
2198     LPCONNECTDATA rgcd,
2199     ULONG *pcFetched)
2200 {
2201     FIXME("not implemented\n");
2202     return E_NOTIMPL;
2203 }
2204
2205 HRESULT CALLBACK IEnumConnectionPoints_Next_Proxy(
2206     IEnumConnectionPoints* This,
2207     ULONG cConnections,
2208     LPCONNECTIONPOINT *ppCP,
2209     ULONG *pcFetched)
2210 {
2211     FIXME("not implemented\n");
2212     return E_NOTIMPL;
2213 }
2214
2215 HRESULT __RPC_STUB IEnumConnectionPoints_Next_Stub(
2216     IEnumConnectionPoints* This,
2217     ULONG cConnections,
2218     LPCONNECTIONPOINT *ppCP,
2219     ULONG *pcFetched)
2220 {
2221     FIXME("not implemented\n");
2222     return E_NOTIMPL;
2223 }
2224
2225 HRESULT CALLBACK IPersistMemory_Load_Proxy(
2226     IPersistMemory* This,
2227     LPVOID pMem,
2228     ULONG cbSize)
2229 {
2230     FIXME("not implemented\n");
2231     return E_NOTIMPL;
2232 }
2233
2234 HRESULT __RPC_STUB IPersistMemory_Load_Stub(
2235     IPersistMemory* This,
2236     BYTE *pMem,
2237     ULONG cbSize)
2238 {
2239     FIXME("not implemented\n");
2240     return E_NOTIMPL;
2241 }
2242
2243 HRESULT CALLBACK IPersistMemory_Save_Proxy(
2244     IPersistMemory* This,
2245     LPVOID pMem,
2246     BOOL fClearDirty,
2247     ULONG cbSize)
2248 {
2249     FIXME("not implemented\n");
2250     return E_NOTIMPL;
2251 }
2252
2253 HRESULT __RPC_STUB IPersistMemory_Save_Stub(
2254     IPersistMemory* This,
2255     BYTE *pMem,
2256     BOOL fClearDirty,
2257     ULONG cbSize)
2258 {
2259     FIXME("not implemented\n");
2260     return E_NOTIMPL;
2261 }
2262
2263 void CALLBACK IAdviseSinkEx_OnViewStatusChange_Proxy(
2264     IAdviseSinkEx* This,
2265     DWORD dwViewStatus)
2266 {
2267     FIXME("not implemented\n");
2268 }
2269
2270 HRESULT __RPC_STUB IAdviseSinkEx_OnViewStatusChange_Stub(
2271     IAdviseSinkEx* This,
2272     DWORD dwViewStatus)
2273 {
2274     FIXME("not implemented\n");
2275     return E_NOTIMPL;
2276 }
2277
2278 HRESULT CALLBACK IEnumOleUndoUnits_Next_Proxy(
2279     IEnumOleUndoUnits* This,
2280     ULONG cElt,
2281     IOleUndoUnit **rgElt,
2282     ULONG *pcEltFetched)
2283 {
2284     FIXME("not implemented\n");
2285     return E_NOTIMPL;
2286 }
2287
2288 HRESULT __RPC_STUB IEnumOleUndoUnits_Next_Stub(
2289     IEnumOleUndoUnits* This,
2290     ULONG cElt,
2291     IOleUndoUnit **rgElt,
2292     ULONG *pcEltFetched)
2293 {
2294     FIXME("not implemented\n");
2295     return E_NOTIMPL;
2296 }
2297
2298 HRESULT CALLBACK IQuickActivate_QuickActivate_Proxy(
2299     IQuickActivate* This,
2300     QACONTAINER *pQaContainer,
2301     QACONTROL *pQaControl)
2302 {
2303     FIXME("not implemented\n");
2304     return E_NOTIMPL;
2305 }
2306
2307 HRESULT __RPC_STUB IQuickActivate_QuickActivate_Stub(
2308     IQuickActivate* This,
2309     QACONTAINER *pQaContainer,
2310     QACONTROL *pQaControl)
2311 {
2312     FIXME("not implemented\n");
2313     return E_NOTIMPL;
2314 }