dlls/oleaut32/tmarshal.c

   1 /*
   2  *      TYPELIB Marshaler
   3  *
   4  *      Copyright 2002  Marcus Meissner
   5  *
   6  * The olerelay debug channel allows you to see calls marshalled by
   7  * the typelib marshaller. It is not a generic COM relaying system.
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  22  */
  23
  24 #include "config.h"
  25
  26 #include <assert.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <stdarg.h>
  30 #include <stdio.h>
  31 #include <ctype.h>
  32
  33 #define NONAMELESSUNION
  34 #define NONAMELESSSTRUCT
  35 #include "winerror.h"
  36 #include "windef.h"
  37 #include "winbase.h"
  38 #include "winnls.h"
  39 #include "winreg.h"
  40 #include "winuser.h"
  41
  42 #include "ole2.h"
  43 #include "wine/unicode.h"
  44 #include "ole2disp.h"
  45 #include "typelib.h"
  46 #include "wine/debug.h"
  47 #include "winternl.h"
  48
  49 static const WCHAR riidW[5] = {'r','i','i','d',0};
  50 static const WCHAR pdispparamsW[] = {'p','d','i','s','p','p','a','r','a','m','s',0};
  51 static const WCHAR ppvObjectW[] = {'p','p','v','O','b','j','e','c','t',0};
  52
  53 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  54 WINE_DECLARE_DEBUG_CHANNEL(olerelay);
  55
  56 typedef struct _marshal_state {
  57     LPBYTE      base;
  58     int         size;
  59     int         curoff;
  60
  61     BOOL        thisisiid;
  62     IID         iid;    /* HACK: for VT_VOID */
  63 } marshal_state;
  64
  65 /* used in the olerelay code to avoid having the L"" stuff added by debugstr_w */
  66 static char *relaystr(WCHAR *in) {
  67     char *tmp = (char *)debugstr_w(in);
  68     tmp += 2;
  69     tmp[strlen(tmp)-1] = '\0';
  70     return tmp;
  71 }
  72
  73 static HRESULT
  74 xbuf_add(marshal_state *buf, LPBYTE stuff, DWORD size) {
  75     while (buf->size - buf->curoff < size) {
  76         if (buf->base) {
  77             buf->size += 100;
  78             buf->base = HeapReAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,buf->base,buf->size);
  79             if (!buf->base)
  80                 return E_OUTOFMEMORY;
  81         } else {
  82             buf->base = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,32);
  83             buf->size = 32;
  84             if (!buf->base)
  85                 return E_OUTOFMEMORY;
  86         }
  87     }
  88     memcpy(buf->base+buf->curoff,stuff,size);
  89     buf->curoff += size;
  90     return S_OK;
  91 }
  92
  93 static HRESULT
  94 xbuf_get(marshal_state *buf, LPBYTE stuff, DWORD size) {
  95     if (buf->size < buf->curoff+size) return E_FAIL;
  96     memcpy(stuff,buf->base+buf->curoff,size);
  97     buf->curoff += size;
  98     return S_OK;
  99 }
 100
 101 static HRESULT
 102 xbuf_skip(marshal_state *buf, DWORD size) {
 103     if (buf->size < buf->curoff+size) return E_FAIL;
 104     buf->curoff += size;
 105     return S_OK;
 106 }
 107
 108 static HRESULT
 109 _unmarshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN *pUnk) {
 110     IStream             *pStm;
 111     ULARGE_INTEGER      newpos;
 112     LARGE_INTEGER       seekto;
 113     ULONG               res;
 114     HRESULT             hres;
 115     DWORD               xsize;
 116
 117     TRACE("...%s...\n",debugstr_guid(riid));
 118     *pUnk = NULL;
 119     hres = xbuf_get(buf,(LPBYTE)&xsize,sizeof(xsize));
 120     if (hres) return hres;
 121     if (xsize == 0) return S_OK;
 122     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 123     if (hres) {
 124         FIXME("Stream create failed %lx\n",hres);
 125         return hres;
 126     }
 127     hres = IStream_Write(pStm,buf->base+buf->curoff,xsize,&res);
 128     if (hres) { FIXME("stream write %lx\n",hres); return hres; }
 129     memset(&seekto,0,sizeof(seekto));
 130     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 131     if (hres) { FIXME("Failed Seek %lx\n",hres); return hres;}
 132     hres = CoUnmarshalInterface(pStm,riid,(LPVOID*)pUnk);
 133     if (hres) {
 134         FIXME("Marshalling interface %s failed with %lx\n",debugstr_guid(riid),hres);
 135         return hres;
 136     }
 137     IStream_Release(pStm);
 138     return xbuf_skip(buf,xsize);
 139 }
 140
 141 static HRESULT
 142 _marshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN pUnk) {
 143     LPUNKNOWN           newiface;
 144     LPBYTE              tempbuf;
 145     IStream             *pStm;
 146     STATSTG             ststg;
 147     ULARGE_INTEGER      newpos;
 148     LARGE_INTEGER       seekto;
 149     ULONG               res;
 150     DWORD               xsize;
 151     HRESULT             hres;
 152
 153     hres = S_OK;
 154     if (!pUnk)
 155         goto fail;
 156
 157     TRACE("...%s...\n",debugstr_guid(riid));
 158     hres=IUnknown_QueryInterface(pUnk,riid,(LPVOID*)&newiface);
 159     if (hres) {
 160         TRACE("%p does not support iface %s\n",pUnk,debugstr_guid(riid));
 161         goto fail;
 162     }
 163     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 164     if (hres) {
 165         FIXME("Stream create failed %lx\n",hres);
 166         goto fail;
 167     }
 168     hres = CoMarshalInterface(pStm,riid,newiface,0,NULL,0);
 169     IUnknown_Release(newiface);
 170     if (hres) {
 171         FIXME("Marshalling interface %s failed with %lx\n",
 172                 debugstr_guid(riid),hres
 173         );
 174         goto fail;
 175     }
 176     hres = IStream_Stat(pStm,&ststg,0);
 177     tempbuf = HeapAlloc(GetProcessHeap(), 0, ststg.cbSize.u.LowPart);
 178     memset(&seekto,0,sizeof(seekto));
 179     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 180     if (hres) { FIXME("Failed Seek %lx\n",hres); goto fail;}
 181     hres = IStream_Read(pStm,tempbuf,ststg.cbSize.u.LowPart,&res);
 182     if (hres) { FIXME("Failed Read %lx\n",hres); goto fail;}
 183     IStream_Release(pStm);
 184     xsize = ststg.cbSize.u.LowPart;
 185     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 186     hres = xbuf_add(buf,tempbuf,ststg.cbSize.u.LowPart);
 187     HeapFree(GetProcessHeap(),0,tempbuf);
 188     return hres;
 189 fail:
 190     xsize = 0;
 191     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 192     return hres;
 193 }
 194
 195 /********************* OLE Proxy/Stub Factory ********************************/
 196 static HRESULT WINAPI
 197 PSFacBuf_QueryInterface(LPPSFACTORYBUFFER iface, REFIID iid, LPVOID *ppv) {
 198     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)||IsEqualIID(iid,&IID_IUnknown)) {
 199         *ppv = (LPVOID)iface;
 200         /* No ref counting, static class */
 201         return S_OK;
 202     }
 203     FIXME("(%s) unknown IID?\n",debugstr_guid(iid));
 204     return E_NOINTERFACE;
 205 }
 206
 207 static ULONG WINAPI PSFacBuf_AddRef(LPPSFACTORYBUFFER iface) { return 2; }
 208 static ULONG WINAPI PSFacBuf_Release(LPPSFACTORYBUFFER iface) { return 1; }
 209
 210 static HRESULT
 211 _get_typeinfo_for_iid(REFIID riid, ITypeInfo**ti) {
 212     HRESULT     hres;
 213     HKEY        ikey;
 214     char        tlguid[200],typelibkey[300],interfacekey[300],ver[100];
 215     char        tlfn[260];
 216     OLECHAR     tlfnW[260];
 217     DWORD       tlguidlen, verlen, type, tlfnlen;
 218     ITypeLib    *tl;
 219
 220     sprintf( interfacekey, "Interface\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\Typelib",
 221         riid->Data1, riid->Data2, riid->Data3,
 222         riid->Data4[0], riid->Data4[1], riid->Data4[2], riid->Data4[3],
 223         riid->Data4[4], riid->Data4[5], riid->Data4[6], riid->Data4[7]
 224     );
 225
 226     if (RegOpenKeyA(HKEY_CLASSES_ROOT,interfacekey,&ikey)) {
 227         FIXME("No %s key found.\n",interfacekey);
 228         return E_FAIL;
 229     }
 230     type = (1<<REG_SZ);
 231     tlguidlen = sizeof(tlguid);
 232     if (RegQueryValueExA(ikey,NULL,NULL,&type,tlguid,&tlguidlen)) {
 233         FIXME("Getting typelib guid failed.\n");
 234         RegCloseKey(ikey);
 235         return E_FAIL;
 236     }
 237     type = (1<<REG_SZ);
 238     verlen = sizeof(ver);
 239     if (RegQueryValueExA(ikey,"Version",NULL,&type,ver,&verlen)) {
 240         FIXME("Could not get version value?\n");
 241         RegCloseKey(ikey);
 242         return E_FAIL;
 243     }
 244     RegCloseKey(ikey);
 245     sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win32",tlguid,ver);
 246     tlfnlen = sizeof(tlfn);
 247     if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 248         FIXME("Could not get typelib fn?\n");
 249         return E_FAIL;
 250     }
 251     MultiByteToWideChar(CP_ACP, 0, tlfn, -1, tlfnW, -1);
 252     hres = LoadTypeLib(tlfnW,&tl);
 253     if (hres) {
 254         ERR("Failed to load typelib for %s, but it should be there.\n",debugstr_guid(riid));
 255         return hres;
 256     }
 257     hres = ITypeLib_GetTypeInfoOfGuid(tl,riid,ti);
 258     if (hres) {
 259         ERR("typelib does not contain info for %s?\n",debugstr_guid(riid));
 260         ITypeLib_Release(tl);
 261         return hres;
 262     }
 263     /* FIXME: do this?  ITypeLib_Release(tl); */
 264     return hres;
 265 }
 266
 267 /* Determine nr of functions. Since we use the toplevel interface and all
 268  * inherited ones have lower numbers, we are ok to not to descent into
 269  * the inheritance tree I think.
 270  */
 271 static int _nroffuncs(ITypeInfo *tinfo) {
 272     int         n, max = 0;
 273     FUNCDESC    *fdesc;
 274     HRESULT     hres;
 275
 276     n=0;
 277     while (1) {
 278         hres = ITypeInfo_GetFuncDesc(tinfo,n,&fdesc);
 279         if (hres)
 280             return max+1;
 281         if (fdesc->oVft/4 > max)
 282             max = fdesc->oVft/4;
 283         n++;
 284     }
 285     /*NOTREACHED*/
 286 }
 287
 288 #include "pshpack1.h"
 289
 290 typedef struct _TMAsmProxy {
 291     BYTE        popleax;
 292     BYTE        pushlval;
 293     BYTE        nr;
 294     BYTE        pushleax;
 295     BYTE        lcall;
 296     DWORD       xcall;
 297     BYTE        lret;
 298     WORD        bytestopop;
 299 } TMAsmProxy;
 300
 301 #include "poppack.h"
 302
 303 typedef struct _TMProxyImpl {
 304     DWORD                               *lpvtbl;
 305     ICOM_VTABLE(IRpcProxyBuffer)        *lpvtbl2;
 306     DWORD                               ref;
 307
 308     TMAsmProxy                          *asmstubs;
 309     ITypeInfo*                          tinfo;
 310     IRpcChannelBuffer*                  chanbuf;
 311     IID                                 iid;
 312 } TMProxyImpl;
 313
 314 static HRESULT WINAPI
 315 TMProxyImpl_QueryInterface(LPRPCPROXYBUFFER iface, REFIID riid, LPVOID *ppv) {
 316     TRACE("()\n");
 317     if (IsEqualIID(riid,&IID_IUnknown)||IsEqualIID(riid,&IID_IRpcProxyBuffer)) {
 318         *ppv = (LPVOID)iface;
 319         IRpcProxyBuffer_AddRef(iface);
 320         return S_OK;
 321     }
 322     FIXME("no interface for %s\n",debugstr_guid(riid));
 323     return E_NOINTERFACE;
 324 }
 325
 326 static ULONG WINAPI
 327 TMProxyImpl_AddRef(LPRPCPROXYBUFFER iface) {
 328     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 329
 330     TRACE("()\n");
 331     This->ref++;
 332     return This->ref;
 333 }
 334
 335 static ULONG WINAPI
 336 TMProxyImpl_Release(LPRPCPROXYBUFFER iface) {
 337     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 338
 339     TRACE("()\n");
 340     This->ref--;
 341     if (This->ref) return This->ref;
 342     if (This->chanbuf) IRpcChannelBuffer_Release(This->chanbuf);
 343     HeapFree(GetProcessHeap(),0,This);
 344     return 0;
 345 }
 346
 347 static HRESULT WINAPI
 348 TMProxyImpl_Connect(
 349     LPRPCPROXYBUFFER iface,IRpcChannelBuffer* pRpcChannelBuffer
 350 ) {
 351     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 352
 353     TRACE("(%p)\n",pRpcChannelBuffer);
 354     This->chanbuf = pRpcChannelBuffer;
 355     IRpcChannelBuffer_AddRef(This->chanbuf);
 356     return S_OK;
 357 }
 358
 359 static void WINAPI
 360 TMProxyImpl_Disconnect(LPRPCPROXYBUFFER iface) {
 361     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 362
 363     FIXME("()\n");
 364     IRpcChannelBuffer_Release(This->chanbuf);
 365     This->chanbuf = NULL;
 366 }
 367
 368
 369 static ICOM_VTABLE(IRpcProxyBuffer) tmproxyvtable = {
 370     ICOM_MSVTABLE_COMPAT_DummyRTTIVALUE
 371     TMProxyImpl_QueryInterface,
 372     TMProxyImpl_AddRef,
 373     TMProxyImpl_Release,
 374     TMProxyImpl_Connect,
 375     TMProxyImpl_Disconnect
 376 };
 377
 378 /* how much space do we use on stack in DWORD steps. */
 379 int const
 380 _argsize(DWORD vt) {
 381     switch (vt) {
 382     case VT_DATE:
 383         return sizeof(DATE)/sizeof(DWORD);
 384     case VT_VARIANT:
 385         return (sizeof(VARIANT)+3)/sizeof(DWORD);
 386     default:
 387         return 1;
 388     }
 389 }
 390
 391 static int
 392 _xsize(TYPEDESC *td) {
 393     switch (td->vt) {
 394     case VT_DATE:
 395         return sizeof(DATE);
 396     case VT_VARIANT:
 397         return sizeof(VARIANT)+3;
 398     case VT_CARRAY: {
 399         int i, arrsize = 1;
 400         ARRAYDESC *adesc = td->u.lpadesc;
 401
 402         for (i=0;i<adesc->cDims;i++)
 403             arrsize *= adesc->rgbounds[i].cElements;
 404         return arrsize*_xsize(&adesc->tdescElem);
 405     }
 406     case VT_UI2:
 407     case VT_I2:
 408         return 2;
 409     case VT_UI1:
 410     case VT_I1:
 411         return 1;
 412     default:
 413         return 4;
 414     }
 415 }
 416
 417 static HRESULT
 418 serialize_param(
 419     ITypeInfo           *tinfo,
 420     BOOL                writeit,
 421     BOOL                debugout,
 422     BOOL                dealloc,
 423     TYPEDESC            *tdesc,
 424     DWORD               *arg,
 425     marshal_state       *buf
 426 ) {
 427     HRESULT hres = S_OK;
 428
 429     TRACE("(tdesc.vt %d)\n",tdesc->vt);
 430
 431     switch (tdesc->vt) {
 432     case VT_EMPTY: /* nothing. empty variant for instance */
 433         return S_OK;
 434     case VT_BOOL:
 435     case VT_ERROR:
 436     case VT_UI4:
 437     case VT_UINT:
 438     case VT_I4:
 439     case VT_R4:
 440     case VT_UI2:
 441     case VT_UI1:
 442         hres = S_OK;
 443         if (debugout) TRACE_(olerelay)("%lx",*arg);
 444         if (writeit)
 445             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 446         return hres;
 447     case VT_VARIANT: {
 448         TYPEDESC        tdesc2;
 449         VARIANT         *vt = (VARIANT*)arg;
 450         DWORD           vttype = V_VT(vt);
 451
 452         if (debugout) TRACE_(olerelay)("Vt(%ld)(",vttype);
 453         tdesc2.vt = vttype;
 454         if (writeit) {
 455             hres = xbuf_add(buf,(LPBYTE)&vttype,sizeof(vttype));
 456             if (hres) return hres;
 457         }
 458         /* need to recurse since we need to free the stuff */
 459         hres = serialize_param(tinfo,writeit,debugout,dealloc,&tdesc2,&(V_I4(vt)),buf);
 460         if (debugout) TRACE_(olerelay)(")");
 461         return hres;
 462     }
 463     case VT_BSTR: {
 464         if (debugout) {
 465             if (arg)
 466                     TRACE_(olerelay)("%s",relaystr((BSTR)*arg));
 467             else
 468                     TRACE_(olerelay)("<bstr NULL>");
 469         }
 470         if (writeit) {
 471             if (!*arg) {
 472                 DWORD fakelen = -1;
 473                 hres = xbuf_add(buf,(LPBYTE)&fakelen,4);
 474                 if (hres)
 475                     return hres;
 476             } else {
 477                 DWORD *bstr = ((DWORD*)(*arg))-1;
 478
 479                 hres = xbuf_add(buf,(LPBYTE)bstr,bstr[0]+4);
 480                 if (hres)
 481                     return hres;
 482             }
 483         }
 484
 485         if (dealloc && arg)
 486             SysFreeString((BSTR)*arg);
 487         return S_OK;
 488     }
 489     case VT_PTR: {
 490         DWORD cookie;
 491
 492         if (debugout) TRACE_(olerelay)("*");
 493         if (writeit) {
 494             cookie = *arg ? 0x42424242 : 0;
 495             hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 496             if (hres)
 497                 return hres;
 498         }
 499         if (!*arg) {
 500             if (debugout) TRACE_(olerelay)("NULL");
 501             return S_OK;
 502         }
 503         hres = serialize_param(tinfo,writeit,debugout,dealloc,tdesc->u.lptdesc,(DWORD*)*arg,buf);
 504         if (dealloc) HeapFree(GetProcessHeap(),0,(LPVOID)arg);
 505         return hres;
 506     }
 507     case VT_UNKNOWN:
 508         if (debugout) TRACE_(olerelay)("unk(0x%lx)",*arg);
 509         if (writeit)
 510             hres = _marshal_interface(buf,&IID_IUnknown,(LPUNKNOWN)*arg);
 511         return hres;
 512     case VT_DISPATCH:
 513         if (debugout) TRACE_(olerelay)("idisp(0x%lx)",*arg);
 514         if (writeit)
 515             hres = _marshal_interface(buf,&IID_IDispatch,(LPUNKNOWN)*arg);
 516         return hres;
 517     case VT_VOID:
 518         if (debugout) TRACE_(olerelay)("<void>");
 519         return S_OK;
 520     case VT_USERDEFINED: {
 521         ITypeInfo       *tinfo2;
 522         TYPEATTR        *tattr;
 523
 524         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 525         if (hres) {
 526             FIXME("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
 527             return hres;
 528         }
 529         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 530         switch (tattr->typekind) {
 531         case TKIND_DISPATCH:
 532         case TKIND_INTERFACE:
 533             if (writeit)
 534                hres=_marshal_interface(buf,&(tattr->guid),(LPUNKNOWN)arg);
 535             break;
 536         case TKIND_RECORD: {
 537             int i;
 538             if (debugout) TRACE_(olerelay)("{");
 539             for (i=0;i<tattr->cVars;i++) {
 540                 VARDESC *vdesc;
 541                 ELEMDESC *elem2;
 542                 TYPEDESC *tdesc2;
 543
 544                 hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 545                 if (hres) {
 546                     FIXME("Could not get vardesc of %d\n",i);
 547                     return hres;
 548                 }
 549                 /* Need them for hack below */
 550                 /*
 551                 memset(names,0,sizeof(names));
 552                 hres = ITypeInfo_GetNames(tinfo2,vdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
 553                 if (nrofnames > sizeof(names)/sizeof(names[0])) {
 554                     ERR("Need more names!\n");
 555                 }
 556                 if (!hres && debugout)
 557                     TRACE_(olerelay)("%s=",relaystr(names[0]));
 558                 */
 559                 elem2 = &vdesc->elemdescVar;
 560                 tdesc2 = &elem2->tdesc;
 561                 hres = serialize_param(
 562                     tinfo2,
 563                     writeit,
 564                     debugout,
 565                     dealloc,
 566                     tdesc2,
 567                     (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
 568                     buf
 569                 );
 570                 if (hres!=S_OK)
 571                     return hres;
 572                 if (debugout && (i<(tattr->cVars-1)))
 573                     TRACE_(olerelay)(",");
 574             }
 575             if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
 576                 memcpy(&(buf->iid),arg,sizeof(buf->iid));
 577             if (debugout) TRACE_(olerelay)("}");
 578             break;
 579         }
 580         default:
 581             FIXME("Unhandled typekind %d\n",tattr->typekind);
 582             hres = E_FAIL;
 583             break;
 584         }
 585         ITypeInfo_Release(tinfo2);
 586         return hres;
 587     }
 588     case VT_CARRAY: {
 589         ARRAYDESC *adesc = tdesc->u.lpadesc;
 590         int i, arrsize = 1;
 591
 592         if (debugout) TRACE_(olerelay)("carr");
 593         for (i=0;i<adesc->cDims;i++) {
 594             if (debugout) TRACE_(olerelay)("[%ld]",adesc->rgbounds[i].cElements);
 595             arrsize *= adesc->rgbounds[i].cElements;
 596         }
 597         if (debugout) TRACE_(olerelay)("[");
 598         for (i=0;i<arrsize;i++) {
 599             hres = serialize_param(tinfo, writeit, debugout, dealloc, &adesc->tdescElem, (DWORD*)((LPBYTE)arg+i*_xsize(&adesc->tdescElem)), buf);
 600             if (hres)
 601                 return hres;
 602             if (debugout && (i<arrsize-1)) TRACE_(olerelay)(",");
 603         }
 604         if (debugout) TRACE_(olerelay)("]");
 605         return S_OK;
 606     }
 607     default:
 608         ERR("Unhandled marshal type %d.\n",tdesc->vt);
 609         return S_OK;
 610     }
 611 }
 612
 613 static HRESULT
 614 serialize_LPVOID_ptr(
 615     ITypeInfo           *tinfo,
 616     BOOL                writeit,
 617     BOOL                debugout,
 618     BOOL                dealloc,
 619     TYPEDESC            *tdesc,
 620     DWORD               *arg,
 621     marshal_state       *buf
 622 ) {
 623     HRESULT     hres;
 624     DWORD       cookie;
 625
 626     if ((tdesc->vt != VT_PTR)                   ||
 627         (tdesc->u.lptdesc->vt != VT_PTR)        ||
 628         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
 629     ) {
 630         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
 631         return E_FAIL;
 632     }
 633     cookie = (*arg) ? 0x42424242: 0x0;
 634     if (writeit) {
 635         hres = xbuf_add(buf, (LPVOID)&cookie, sizeof(cookie));
 636         if (hres)
 637             return hres;
 638     }
 639     if (!*arg) {
 640         if (debugout) TRACE_(olerelay)("<lpvoid NULL>");
 641         return S_OK;
 642     }
 643     if (debugout)
 644         TRACE_(olerelay)("ppv(%p)",*(LPUNKNOWN*)*arg);
 645     if (writeit) {
 646         hres = _marshal_interface(buf,&(buf->iid),*(LPUNKNOWN*)*arg);
 647         if (hres)
 648             return hres;
 649     }
 650     if (dealloc)
 651         HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 652     return S_OK;
 653 }
 654
 655 static HRESULT
 656 serialize_DISPPARAM_ptr(
 657     ITypeInfo           *tinfo,
 658     BOOL                writeit,
 659     BOOL                debugout,
 660     BOOL                dealloc,
 661     TYPEDESC            *tdesc,
 662     DWORD               *arg,
 663     marshal_state       *buf
 664 ) {
 665     DWORD       cookie;
 666     HRESULT     hres;
 667     DISPPARAMS  *disp;
 668     int         i;
 669
 670     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
 671         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
 672         return E_FAIL;
 673     }
 674
 675     cookie = *arg ? 0x42424242 : 0x0;
 676     if (writeit) {
 677         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 678         if (hres)
 679             return hres;
 680     }
 681     if (!*arg) {
 682         if (debugout) TRACE_(olerelay)("<DISPPARAMS NULL>");
 683         return S_OK;
 684     }
 685     disp = (DISPPARAMS*)*arg;
 686     if (writeit) {
 687         hres = xbuf_add(buf,(LPBYTE)&disp->cArgs,sizeof(disp->cArgs));
 688         if (hres)
 689             return hres;
 690     }
 691     if (debugout) TRACE_(olerelay)("D{");
 692     for (i=0;i<disp->cArgs;i++) {
 693         TYPEDESC        vtdesc;
 694
 695         vtdesc.vt = VT_VARIANT;
 696         serialize_param(
 697             tinfo,
 698             writeit,
 699             debugout,
 700             dealloc,
 701             &vtdesc,
 702             (DWORD*)(disp->rgvarg+i),
 703             buf
 704         );
 705         if (debugout && (i<disp->cArgs-1))
 706             TRACE_(olerelay)(",");
 707     }
 708     if (dealloc)
 709         HeapFree(GetProcessHeap(),0,disp->rgvarg);
 710     if (writeit) {
 711         hres = xbuf_add(buf,(LPBYTE)&disp->cNamedArgs,sizeof(disp->cNamedArgs));
 712         if (hres)
 713             return hres;
 714     }
 715     if (debugout) TRACE_(olerelay)("}{");
 716     for (i=0;i<disp->cNamedArgs;i++) {
 717         TYPEDESC        vtdesc;
 718
 719         vtdesc.vt = VT_UINT;
 720         serialize_param(
 721             tinfo,
 722             writeit,
 723             debugout,
 724             dealloc,
 725             &vtdesc,
 726             (DWORD*)(disp->rgdispidNamedArgs+i),
 727             buf
 728         );
 729         if (debugout && (i<disp->cNamedArgs-1))
 730             TRACE_(olerelay)(",");
 731     }
 732     if (debugout) TRACE_(olerelay)("}");
 733     if (dealloc) {
 734         HeapFree(GetProcessHeap(),0,disp->rgdispidNamedArgs);
 735         HeapFree(GetProcessHeap(),0,disp);
 736     }
 737     return S_OK;
 738 }
 739
 740 static HRESULT
 741 deserialize_param(
 742     ITypeInfo           *tinfo,
 743     BOOL                readit,
 744     BOOL                debugout,
 745     BOOL                alloc,
 746     TYPEDESC            *tdesc,
 747     DWORD               *arg,
 748     marshal_state       *buf
 749 ) {
 750     HRESULT hres = S_OK;
 751
 752     TRACE("vt %d at %p\n",tdesc->vt,arg);
 753
 754     while (1) {
 755         switch (tdesc->vt) {
 756         case VT_EMPTY:
 757             if (debugout) TRACE_(olerelay)("<empty>");
 758             return S_OK;
 759         case VT_NULL:
 760             if (debugout) TRACE_(olerelay)("<null>");
 761             return S_OK;
 762         case VT_VARIANT: {
 763             VARIANT     *vt = (VARIANT*)arg;
 764
 765             if (readit) {
 766                 DWORD   vttype;
 767                 TYPEDESC        tdesc2;
 768                 hres = xbuf_get(buf,(LPBYTE)&vttype,sizeof(vttype));
 769                 if (hres) {
 770                     FIXME("vt type not read?\n");
 771                     return hres;
 772                 }
 773                 memset(&tdesc2,0,sizeof(tdesc2));
 774                 tdesc2.vt = vttype;
 775                 V_VT(vt)  = vttype;
 776                 if (debugout) TRACE_(olerelay)("Vt(%ld)(",vttype);
 777                 hres = deserialize_param(tinfo, readit, debugout, alloc, &tdesc2, &(V_I4(vt)), buf);
 778                 TRACE_(olerelay)(")");
 779                 return hres;
 780             } else {
 781                 VariantInit(vt);
 782                 return S_OK;
 783             }
 784         }
 785         case VT_ERROR:
 786         case VT_BOOL: case VT_I4: case VT_UI4: case VT_UINT: case VT_R4:
 787         case VT_UI2:
 788         case VT_UI1:
 789             if (readit) {
 790                 hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
 791                 if (hres) FIXME("Failed to read integer 4 byte\n");
 792             }
 793             if (debugout) TRACE_(olerelay)("%lx",*arg);
 794             return hres;
 795         case VT_BSTR: {
 796             WCHAR       *str;
 797             DWORD       len;
 798
 799             if (readit) {
 800                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
 801                 if (hres) {
 802                     FIXME("failed to read bstr klen\n");
 803                     return hres;
 804                 }
 805                 if (len == -1) {
 806                     *arg = 0;
 807                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
 808                 } else {
 809                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+sizeof(WCHAR));
 810                     hres = xbuf_get(buf,(LPBYTE)str,len);
 811                     if (hres) {
 812                         FIXME("Failed to read BSTR.\n");
 813                         return hres;
 814                     }
 815                     *arg = (DWORD)SysAllocStringLen(str,len);
 816                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
 817                     HeapFree(GetProcessHeap(),0,str);
 818                 }
 819             } else {
 820                 *arg = 0;
 821             }
 822             return S_OK;
 823         }
 824         case VT_PTR: {
 825             DWORD       cookie;
 826             BOOL        derefhere = 0;
 827
 828             derefhere = (tdesc->u.lptdesc->vt != VT_USERDEFINED);
 829
 830             if (readit) {
 831                 hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
 832                 if (hres) {
 833                     FIXME("Failed to load pointer cookie.\n");
 834                     return hres;
 835                 }
 836                 if (cookie != 0x42424242) {
 837                     if (debugout) TRACE_(olerelay)("NULL");
 838                     *arg = 0;
 839                     return S_OK;
 840                 }
 841                 if (debugout) TRACE_(olerelay)("*");
 842             }
 843             if (alloc) {
 844                 if (derefhere)
 845                     *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc));
 846             }
 847             if (derefhere)
 848                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, (LPDWORD)*arg, buf);
 849             else
 850                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, arg, buf);
 851         }
 852         case VT_UNKNOWN:
 853             /* FIXME: UNKNOWN is unknown ..., but allocate 4 byte for it */
 854             if (alloc)
 855                 *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
 856             hres = S_OK;
 857             if (readit)
 858                 hres = _unmarshal_interface(buf,&IID_IUnknown,(LPUNKNOWN*)arg);
 859             if (debugout)
 860                 TRACE_(olerelay)("unk(%p)",arg);
 861             return hres;
 862         case VT_DISPATCH:
 863             hres = S_OK;
 864             if (readit)
 865                 hres = _unmarshal_interface(buf,&IID_IDispatch,(LPUNKNOWN*)arg);
 866             if (debugout)
 867                 TRACE_(olerelay)("idisp(%p)",arg);
 868             return hres;
 869         case VT_VOID:
 870             if (debugout) TRACE_(olerelay)("<void>");
 871             return S_OK;
 872         case VT_USERDEFINED: {
 873             ITypeInfo   *tinfo2;
 874             TYPEATTR    *tattr;
 875
 876             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 877             if (hres) {
 878                 FIXME("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
 879                 return hres;
 880             }
 881             hres = ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 882             if (hres) {
 883                 FIXME("Could not get typeattr in VT_USERDEFINED.\n");
 884             } else {
 885                 if (alloc)
 886                     *arg = (DWORD)HeapAlloc(GetProcessHeap(),0,tattr->cbSizeInstance);
 887                 switch (tattr->typekind) {
 888                 case TKIND_DISPATCH:
 889                 case TKIND_INTERFACE:
 890                     if (readit)
 891                         hres = _unmarshal_interface(buf,&(tattr->guid),(LPUNKNOWN*)arg);
 892                     break;
 893                 case TKIND_RECORD: {
 894                     int i;
 895
 896                     if (debugout) TRACE_(olerelay)("{");
 897                     for (i=0;i<tattr->cVars;i++) {
 898                         VARDESC *vdesc;
 899
 900                         hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 901                         if (hres) {
 902                             FIXME("Could not get vardesc of %d\n",i);
 903                             return hres;
 904                         }
 905                         hres = deserialize_param(
 906                             tinfo2,
 907                             readit,
 908                             debugout,
 909                             alloc,
 910                             &vdesc->elemdescVar.tdesc,
 911                             (DWORD*)(((LPBYTE)*arg)+vdesc->u.oInst),
 912                             buf
 913                         );
 914                         if (debugout && (i<tattr->cVars-1)) TRACE_(olerelay)(",");
 915                     }
 916                     if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
 917                         memcpy(&(buf->iid),(LPBYTE)*arg,sizeof(buf->iid));
 918                     if (debugout) TRACE_(olerelay)("}");
 919                     break;
 920                 }
 921                 default:
 922                     ERR("Unhandled typekind %d\n",tattr->typekind);
 923                     hres = E_FAIL;
 924                     break;
 925                 }
 926             }
 927             if (hres)
 928                 FIXME("failed to stuballoc in TKIND_RECORD.\n");
 929             ITypeInfo_Release(tinfo2);
 930             return hres;
 931         }
 932         case VT_CARRAY: {
 933             /* arg is pointing to the start of the array. */
 934             ARRAYDESC *adesc = tdesc->u.lpadesc;
 935             int         arrsize,i;
 936             arrsize = 1;
 937             if (adesc->cDims > 1) FIXME("cDims > 1 in VT_CARRAY. Does it work?\n");
 938             for (i=0;i<adesc->cDims;i++)
 939                 arrsize *= adesc->rgbounds[i].cElements;
 940             for (i=0;i<arrsize;i++)
 941                 deserialize_param(
 942                     tinfo,
 943                     readit,
 944                     debugout,
 945                     alloc,
 946                     &adesc->tdescElem,
 947                     (DWORD*)((LPBYTE)(arg)+i*_xsize(&adesc->tdescElem)),
 948                     buf
 949                 );
 950             return S_OK;
 951         }
 952         default:
 953             ERR("No handler for VT type %d!\n",tdesc->vt);
 954             return S_OK;
 955         }
 956     }
 957 }
 958
 959 static HRESULT
 960 deserialize_LPVOID_ptr(
 961     ITypeInfo           *tinfo,
 962     BOOL                readit,
 963     BOOL                debugout,
 964     BOOL                alloc,
 965     TYPEDESC            *tdesc,
 966     DWORD               *arg,
 967     marshal_state       *buf
 968 ) {
 969     HRESULT     hres;
 970     DWORD       cookie;
 971
 972     if ((tdesc->vt != VT_PTR)                   ||
 973         (tdesc->u.lptdesc->vt != VT_PTR)        ||
 974         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
 975     ) {
 976         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
 977         return E_FAIL;
 978     }
 979     if (alloc)
 980         *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(LPVOID));
 981     if (readit) {
 982         hres = xbuf_get(buf, (LPVOID)&cookie, sizeof(cookie));
 983         if (hres)
 984             return hres;
 985         if (cookie != 0x42424242) {
 986             *(DWORD*)*arg = 0;
 987             if (debugout) TRACE_(olerelay)("<lpvoid NULL>");
 988             return S_OK;
 989         }
 990     }
 991     if (readit) {
 992         hres = _unmarshal_interface(buf,&buf->iid,(LPUNKNOWN*)*arg);
 993         if (hres)
 994             return hres;
 995     }
 996     if (debugout) TRACE_(olerelay)("ppv(%p)",(LPVOID)*arg);
 997     return S_OK;
 998 }
 999
1000 static HRESULT
1001 deserialize_DISPPARAM_ptr(
1002     ITypeInfo           *tinfo,
1003     BOOL                readit,
1004     BOOL                debugout,
1005     BOOL                alloc,
1006     TYPEDESC            *tdesc,
1007     DWORD               *arg,
1008     marshal_state       *buf
1009 ) {
1010     DWORD       cookie;
1011     DISPPARAMS  *disps;
1012     HRESULT     hres;
1013     int         i;
1014
1015     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
1016         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
1017         return E_FAIL;
1018     }
1019     if (readit) {
1020         hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1021         if (hres)
1022             return hres;
1023         if (cookie == 0) {
1024             *arg = 0;
1025             if (debugout) TRACE_(olerelay)("<DISPPARAMS NULL>");
1026             return S_OK;
1027         }
1028     }
1029     if (alloc)
1030         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPPARAMS));
1031     disps = (DISPPARAMS*)*arg;
1032     if (!readit)
1033         return S_OK;
1034     hres = xbuf_get(buf, (LPBYTE)&disps->cArgs, sizeof(disps->cArgs));
1035     if (hres)
1036         return hres;
1037     if (alloc)
1038         disps->rgvarg = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(VARIANT)*disps->cArgs);
1039     if (debugout) TRACE_(olerelay)("D{");
1040     for (i=0; i< disps->cArgs; i++) {
1041         TYPEDESC vdesc;
1042
1043         vdesc.vt = VT_VARIANT;
1044         hres = deserialize_param(
1045             tinfo,
1046             readit,
1047             debugout,
1048             alloc,
1049             &vdesc,
1050             (DWORD*)(disps->rgvarg+i),
1051             buf
1052         );
1053     }
1054     if (debugout) TRACE_(olerelay)("}{");
1055     hres = xbuf_get(buf, (LPBYTE)&disps->cNamedArgs, sizeof(disps->cNamedArgs));
1056     if (hres)
1057         return hres;
1058     if (disps->cNamedArgs) {
1059         if (alloc)
1060             disps->rgdispidNamedArgs = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPID)*disps->cNamedArgs);
1061         for (i=0; i< disps->cNamedArgs; i++) {
1062             TYPEDESC vdesc;
1063
1064             vdesc.vt = VT_UINT;
1065             hres = deserialize_param(
1066                 tinfo,
1067                 readit,
1068                 debugout,
1069                 alloc,
1070                 &vdesc,
1071                 (DWORD*)(disps->rgdispidNamedArgs+i),
1072                 buf
1073             );
1074             if (debugout && i<(disps->cNamedArgs-1)) TRACE_(olerelay)(",");
1075         }
1076     }
1077     if (debugout) TRACE_(olerelay)("}");
1078     return S_OK;
1079 }
1080
1081 /* Searches function, also in inherited interfaces */
1082 static HRESULT
1083 _get_funcdesc(
1084     ITypeInfo *tinfo, int iMethod, FUNCDESC **fdesc, BSTR *iname, BSTR *fname
1085 ) {
1086     int i = 0, j = 0;
1087     HRESULT hres;
1088
1089     if (fname) *fname = NULL;
1090     if (iname) *iname = NULL;
1091
1092     while (1) {
1093         hres = ITypeInfo_GetFuncDesc(tinfo, i, fdesc);
1094         if (hres) {
1095             ITypeInfo   *tinfo2;
1096             HREFTYPE    href;
1097             TYPEATTR    *attr;
1098
1099             hres = ITypeInfo_GetTypeAttr(tinfo, &attr);
1100             if (hres) {
1101                 FIXME("GetTypeAttr failed with %lx\n",hres);
1102                 return hres;
1103             }
1104             /* Not found, so look in inherited ifaces. */
1105             for (j=0;j<attr->cImplTypes;j++) {
1106                 hres = ITypeInfo_GetRefTypeOfImplType(tinfo, j, &href);
1107                 if (hres) {
1108                     FIXME("Did not find a reftype for interface offset %d?\n",j);
1109                     break;
1110                 }
1111                 hres = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
1112                 if (hres) {
1113                     FIXME("Did not find a typeinfo for reftype %ld?\n",href);
1114                     continue;
1115                 }
1116                 hres = _get_funcdesc(tinfo2,iMethod,fdesc,iname,fname);
1117                 ITypeInfo_Release(tinfo2);
1118                 if (!hres) return S_OK;
1119             }
1120             return E_FAIL;
1121         }
1122         if (((*fdesc)->oVft/4) == iMethod) {
1123             if (fname)
1124                 ITypeInfo_GetDocumentation(tinfo,(*fdesc)->memid,fname,NULL,NULL,NULL);
1125             if (iname)
1126                 ITypeInfo_GetDocumentation(tinfo,-1,iname,NULL,NULL,NULL);
1127             return S_OK;
1128         }
1129         i++;
1130     }
1131     return E_FAIL;
1132 }
1133
1134 static DWORD
1135 xCall(LPVOID retptr, int method, TMProxyImpl *tpinfo /*, args */) {
1136     DWORD               *args = ((DWORD*)&tpinfo)+1, *xargs;
1137     FUNCDESC            *fdesc;
1138     HRESULT             hres;
1139     int                 i, relaydeb = TRACE_ON(olerelay);
1140     marshal_state       buf;
1141     RPCOLEMESSAGE       msg;
1142     ULONG               status;
1143     BSTR                fname,iname;
1144     BSTR                names[10];
1145     int                 nrofnames;
1146
1147     hres = _get_funcdesc(tpinfo->tinfo,method,&fdesc,&iname,&fname);
1148     if (hres) {
1149         ERR("Did not find typeinfo/funcdesc entry for method %d!\n",method);
1150         return 0;
1151     }
1152
1153     if (relaydeb) {
1154        TRACE_(olerelay)("->");
1155         if (iname)
1156             TRACE_(olerelay)("%s:",relaystr(iname));
1157         if (fname)
1158             TRACE_(olerelay)("%s(%d)",relaystr(fname),method);
1159         else
1160             TRACE_(olerelay)("%d",method);
1161         TRACE_(olerelay)("(");
1162         if (iname) SysFreeString(iname);
1163         if (fname) SysFreeString(fname);
1164     }
1165     /* Need them for hack below */
1166     memset(names,0,sizeof(names));
1167     if (ITypeInfo_GetNames(tpinfo->tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames))
1168         nrofnames = 0;
1169     if (nrofnames > sizeof(names)/sizeof(names[0]))
1170         ERR("Need more names!\n");
1171
1172     memset(&buf,0,sizeof(buf));
1173     buf.iid = IID_IUnknown;
1174     if (method == 0) {
1175         xbuf_add(&buf,(LPBYTE)args[0],sizeof(IID));
1176         if (relaydeb) TRACE_(olerelay)("riid=%s,[out]",debugstr_guid((REFIID)args[0]));
1177     } else {
1178         xargs = args;
1179         for (i=0;i<fdesc->cParams;i++) {
1180             ELEMDESC    *elem = fdesc->lprgelemdescParam+i;
1181             BOOL        isserialized = FALSE;
1182             if (relaydeb) {
1183                 if (i) TRACE_(olerelay)(",");
1184                 if (i+1<nrofnames && names[i+1])
1185                     TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1186             }
1187             /* No need to marshal other data than FIN */
1188             if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN)) {
1189                 xargs+=_argsize(elem->tdesc.vt);
1190                 if (relaydeb) TRACE_(olerelay)("[out]");
1191                 continue;
1192             }
1193             if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1194                 /* If the parameter is 'riid', we use it as interface IID
1195                  * for a later ppvObject serialization.
1196                  */
1197                 buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1198
1199                 /* DISPPARAMS* needs special serializer */
1200                 if (!lstrcmpW(names[i+1],pdispparamsW)) {
1201                     hres = serialize_DISPPARAM_ptr(
1202                         tpinfo->tinfo,
1203                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1204                         relaydeb,
1205                         FALSE,
1206                         &elem->tdesc,
1207                         xargs,
1208                         &buf
1209                     );
1210                     isserialized = TRUE;
1211                 }
1212                 if (!lstrcmpW(names[i+1],ppvObjectW)) {
1213                     hres = serialize_LPVOID_ptr(
1214                         tpinfo->tinfo,
1215                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1216                         relaydeb,
1217                         FALSE,
1218                         &elem->tdesc,
1219                         xargs,
1220                         &buf
1221                     );
1222                     if (hres == S_OK)
1223                         isserialized = TRUE;
1224                 }
1225             }
1226             if (!isserialized)
1227                 hres = serialize_param(
1228                     tpinfo->tinfo,
1229                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1230                     relaydeb,
1231                     FALSE,
1232                     &elem->tdesc,
1233                     xargs,
1234                     &buf
1235                 );
1236
1237             if (hres) {
1238                 FIXME("Failed to serialize param, hres %lx\n",hres);
1239                 break;
1240             }
1241             xargs+=_argsize(elem->tdesc.vt);
1242         }
1243     }
1244     if (relaydeb) TRACE_(olerelay)(")");
1245     memset(&msg,0,sizeof(msg));
1246     msg.cbBuffer = buf.curoff;
1247     msg.iMethod  = method;
1248     hres = IRpcChannelBuffer_GetBuffer(tpinfo->chanbuf,&msg,&(tpinfo->iid));
1249     if (hres) {
1250         FIXME("RpcChannelBuffer GetBuffer failed, %lx\n",hres);
1251         return hres;
1252     }
1253     memcpy(msg.Buffer,buf.base,buf.curoff);
1254     if (relaydeb) TRACE_(olerelay)("\n");
1255     hres = IRpcChannelBuffer_SendReceive(tpinfo->chanbuf,&msg,&status);
1256     if (hres) {
1257         FIXME("RpcChannelBuffer SendReceive failed, %lx\n",hres);
1258         return hres;
1259     }
1260
1261     if (relaydeb) TRACE_(olerelay)(" = %08lx (",status);
1262     if (buf.base)
1263         buf.base = HeapReAlloc(GetProcessHeap(),0,buf.base,msg.cbBuffer);
1264     else
1265         buf.base = HeapAlloc(GetProcessHeap(),0,msg.cbBuffer);
1266     buf.size = msg.cbBuffer;
1267     memcpy(buf.base,msg.Buffer,buf.size);
1268     buf.curoff = 0;
1269     if (method == 0) {
1270         _unmarshal_interface(&buf,(REFIID)args[0],(LPUNKNOWN*)args[1]);
1271         if (relaydeb) TRACE_(olerelay)("[in],%p",*((DWORD**)args[1]));
1272     } else {
1273         xargs = args;
1274         for (i=0;i<fdesc->cParams;i++) {
1275             ELEMDESC    *elem = fdesc->lprgelemdescParam+i;
1276             BOOL        isdeserialized = FALSE;
1277
1278             if (relaydeb) {
1279                 if (i) TRACE_(olerelay)(",");
1280                 if (i+1<nrofnames && names[i+1]) TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1281             }
1282             /* No need to marshal other data than FOUT I think */
1283             if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT)) {
1284                 xargs += _argsize(elem->tdesc.vt);
1285                 if (relaydeb) TRACE_(olerelay)("[in]");
1286                 continue;
1287             }
1288             if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1289                 /* If the parameter is 'riid', we use it as interface IID
1290                  * for a later ppvObject serialization.
1291                  */
1292                 buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1293
1294                 /* deserialize DISPPARAM */
1295                 if (!lstrcmpW(names[i+1],pdispparamsW)) {
1296                     hres = deserialize_DISPPARAM_ptr(
1297                         tpinfo->tinfo,
1298                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1299                         relaydeb,
1300                         FALSE,
1301                         &(elem->tdesc),
1302                         xargs,
1303                         &buf
1304                     );
1305                     if (hres) {
1306                         FIXME("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
1307                         break;
1308                     }
1309                     isdeserialized = TRUE;
1310                 }
1311                 if (!lstrcmpW(names[i+1],ppvObjectW)) {
1312                     hres = deserialize_LPVOID_ptr(
1313                         tpinfo->tinfo,
1314                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1315                         relaydeb,
1316                         FALSE,
1317                         &elem->tdesc,
1318                         xargs,
1319                         &buf
1320                     );
1321                     if (hres == S_OK)
1322                         isdeserialized = TRUE;
1323                 }
1324             }
1325             if (!isdeserialized)
1326                 hres = deserialize_param(
1327                     tpinfo->tinfo,
1328                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1329                     relaydeb,
1330                     FALSE,
1331                     &(elem->tdesc),
1332                     xargs,
1333                     &buf
1334                 );
1335             if (hres) {
1336                 FIXME("Failed to unmarshall param, hres %lx\n",hres);
1337                 break;
1338             }
1339             xargs += _argsize(elem->tdesc.vt);
1340         }
1341     }
1342     if (relaydeb) TRACE_(olerelay)(")\n");
1343     HeapFree(GetProcessHeap(),0,buf.base);
1344     return status;
1345 }
1346
1347 static HRESULT WINAPI
1348 PSFacBuf_CreateProxy(
1349     LPPSFACTORYBUFFER iface, IUnknown* pUnkOuter, REFIID riid,
1350     IRpcProxyBuffer **ppProxy, LPVOID *ppv
1351 ) {
1352     HRESULT     hres;
1353     ITypeInfo   *tinfo;
1354     int         i, nroffuncs;
1355     FUNCDESC    *fdesc;
1356     TMProxyImpl *proxy;
1357
1358     TRACE("(...%s...)\n",debugstr_guid(riid));
1359     hres = _get_typeinfo_for_iid(riid,&tinfo);
1360     if (hres) {
1361         FIXME("No typeinfo for %s?\n",debugstr_guid(riid));
1362         return hres;
1363     }
1364     nroffuncs = _nroffuncs(tinfo);
1365     proxy = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(TMProxyImpl));
1366     if (!proxy) return E_OUTOFMEMORY;
1367     proxy->asmstubs=HeapAlloc(GetProcessHeap(),0,sizeof(TMAsmProxy)*nroffuncs);
1368
1369     assert(sizeof(TMAsmProxy) == 12);
1370
1371     proxy->lpvtbl = HeapAlloc(GetProcessHeap(),0,sizeof(LPBYTE)*nroffuncs);
1372     for (i=0;i<nroffuncs;i++) {
1373         int             nrofargs;
1374         TMAsmProxy      *xasm = proxy->asmstubs+i;
1375
1376         /* nrofargs without This */
1377         switch (i) {
1378         case 0: nrofargs = 2;
1379                 break;
1380         case 1: case 2: nrofargs = 0;
1381                 break;
1382         default: {
1383                 int j;
1384                 hres = _get_funcdesc(tinfo,i,&fdesc,NULL,NULL);
1385                 if (hres) {
1386                     FIXME("GetFuncDesc %lx should not fail here.\n",hres);
1387                     return hres;
1388                 }
1389                 /* some args take more than 4 byte on the stack */
1390                 nrofargs = 0;
1391                 for (j=0;j<fdesc->cParams;j++)
1392                     nrofargs += _argsize(fdesc->lprgelemdescParam[j].tdesc.vt);
1393
1394                 if (fdesc->callconv != CC_STDCALL) {
1395                     ERR("calling convention is not stdcall????\n");
1396                     return E_FAIL;
1397                 }
1398                 break;
1399             }
1400         }
1401 /* popl %eax    -       return ptr
1402  * pushl <nr>
1403  * pushl %eax
1404  * call xCall
1405  * lret <nr> (+4)
1406  *
1407  *
1408  * arg3 arg2 arg1 <method> <returnptr>
1409  */
1410         xasm->popleax   = 0x58;
1411         xasm->pushlval  = 0x6a;
1412         xasm->nr        = i;
1413         xasm->pushleax  = 0x50;
1414         xasm->lcall     = 0xe8; /* relative jump */
1415         xasm->xcall     = (DWORD)xCall;
1416         xasm->xcall     -= (DWORD)&(xasm->lret);
1417         xasm->lret      = 0xc2;
1418         xasm->bytestopop= (nrofargs+2)*4; /* pop args, This, iMethod */
1419         proxy->lpvtbl[i] = (DWORD)xasm;
1420     }
1421     proxy->lpvtbl2      = &tmproxyvtable;
1422     /* 1 reference for the proxy and 1 for the object */
1423     proxy->ref          = 2;
1424     proxy->tinfo        = tinfo;
1425     memcpy(&proxy->iid,riid,sizeof(*riid));
1426     *ppv                = (LPVOID)proxy;
1427     *ppProxy            = (IRpcProxyBuffer *)&(proxy->lpvtbl2);
1428     return S_OK;
1429 }
1430
1431 typedef struct _TMStubImpl {
1432     ICOM_VTABLE(IRpcStubBuffer) *lpvtbl;
1433     DWORD                       ref;
1434
1435     LPUNKNOWN                   pUnk;
1436     ITypeInfo                   *tinfo;
1437     IID                         iid;
1438 } TMStubImpl;
1439
1440 static HRESULT WINAPI
1441 TMStubImpl_QueryInterface(LPRPCSTUBBUFFER iface, REFIID riid, LPVOID *ppv) {
1442     if (IsEqualIID(riid,&IID_IRpcStubBuffer)||IsEqualIID(riid,&IID_IUnknown)){
1443         *ppv = (LPVOID)iface;
1444         IRpcStubBuffer_AddRef(iface);
1445         return S_OK;
1446     }
1447     FIXME("%s, not supported IID.\n",debugstr_guid(riid));
1448     return E_NOINTERFACE;
1449 }
1450
1451 static ULONG WINAPI
1452 TMStubImpl_AddRef(LPRPCSTUBBUFFER iface) {
1453     ICOM_THIS(TMStubImpl,iface);
1454
1455     This->ref++;
1456     return This->ref;
1457 }
1458
1459 static ULONG WINAPI
1460 TMStubImpl_Release(LPRPCSTUBBUFFER iface) {
1461     ICOM_THIS(TMStubImpl,iface);
1462
1463     This->ref--;
1464     if (This->ref)
1465         return This->ref;
1466     HeapFree(GetProcessHeap(),0,This);
1467     return 0;
1468 }
1469
1470 static HRESULT WINAPI
1471 TMStubImpl_Connect(LPRPCSTUBBUFFER iface, LPUNKNOWN pUnkServer) {
1472     ICOM_THIS(TMStubImpl,iface);
1473
1474     IUnknown_AddRef(pUnkServer);
1475     This->pUnk = pUnkServer;
1476     return S_OK;
1477 }
1478
1479 static void WINAPI
1480 TMStubImpl_Disconnect(LPRPCSTUBBUFFER iface) {
1481     ICOM_THIS(TMStubImpl,iface);
1482
1483     IUnknown_Release(This->pUnk);
1484     This->pUnk = NULL;
1485     return;
1486 }
1487
1488 static HRESULT WINAPI
1489 TMStubImpl_Invoke(
1490     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf
1491 ) {
1492     int         i;
1493     FUNCDESC    *fdesc;
1494     ICOM_THIS(TMStubImpl,iface);
1495     HRESULT     hres;
1496     DWORD       *args, res, *xargs, nrofargs;
1497     marshal_state       buf;
1498     int         nrofnames;
1499     BSTR        names[10];
1500
1501     memset(&buf,0,sizeof(buf));
1502     buf.size    = xmsg->cbBuffer;
1503     buf.base    = xmsg->Buffer;
1504     buf.curoff  = 0;
1505     buf.iid     = IID_IUnknown;
1506
1507     TRACE("...\n");
1508     if (xmsg->iMethod == 0) { /* QI */
1509         IID             xiid;
1510         /* in: IID, out: <iface> */
1511
1512         xbuf_get(&buf,(LPBYTE)&xiid,sizeof(xiid));
1513         buf.curoff = 0;
1514         hres = _marshal_interface(&buf,&xiid,This->pUnk);
1515         xmsg->Buffer    = buf.base; /* Might have been reallocated */
1516         xmsg->cbBuffer  = buf.size;
1517         return hres;
1518     }
1519     hres = _get_funcdesc(This->tinfo,xmsg->iMethod,&fdesc,NULL,NULL);
1520     if (hres) {
1521         FIXME("GetFuncDesc on method %ld failed with %lx\n",xmsg->iMethod,hres);
1522         return hres;
1523     }
1524     /* Need them for hack below */
1525     memset(names,0,sizeof(names));
1526     ITypeInfo_GetNames(This->tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
1527     if (nrofnames > sizeof(names)/sizeof(names[0])) {
1528         ERR("Need more names!\n");
1529     }
1530
1531     /*dump_FUNCDESC(fdesc);*/
1532     nrofargs = 0;
1533     for (i=0;i<fdesc->cParams;i++)
1534         nrofargs += _argsize(fdesc->lprgelemdescParam[i].tdesc.vt);
1535     args = HeapAlloc(GetProcessHeap(),0,(nrofargs+1)*sizeof(DWORD));
1536     if (!args) return E_OUTOFMEMORY;
1537
1538     /* Allocate all stuff used by call. */
1539     xargs = args+1;
1540     for (i=0;i<fdesc->cParams;i++) {
1541         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1542         BOOL            isdeserialized = FALSE;
1543
1544         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1545             /* If the parameter is 'riid', we use it as interface IID
1546              * for a later ppvObject serialization.
1547              */
1548             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1549
1550             /* deserialize DISPPARAM */
1551             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1552                 hres = deserialize_DISPPARAM_ptr(
1553                     This->tinfo,
1554                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1555                     FALSE,
1556                     TRUE,
1557                     &(elem->tdesc),
1558                     xargs,
1559                     &buf
1560                 );
1561                 if (hres) {
1562                     FIXME("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
1563                     break;
1564                 }
1565                 isdeserialized = TRUE;
1566             }
1567             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1568                 hres = deserialize_LPVOID_ptr(
1569                     This->tinfo,
1570                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1571                     FALSE,
1572                     TRUE,
1573                     &elem->tdesc,
1574                     xargs,
1575                     &buf
1576                 );
1577                 if (hres == S_OK)
1578                     isdeserialized = TRUE;
1579             }
1580         }
1581         if (!isdeserialized)
1582             hres = deserialize_param(
1583                 This->tinfo,
1584                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1585                 FALSE,
1586                 TRUE,
1587                 &(elem->tdesc),
1588                 xargs,
1589                 &buf
1590             );
1591         xargs += _argsize(elem->tdesc.vt);
1592         if (hres) {
1593             FIXME("Failed to deserialize param %s, hres %lx\n",relaystr(names[i+1]),hres);
1594             break;
1595         }
1596     }
1597     hres = IUnknown_QueryInterface(This->pUnk,&(This->iid),(LPVOID*)&(args[0]));
1598     if (hres) {
1599         ERR("Does not support iface %s\n",debugstr_guid(&(This->iid)));
1600         return hres;
1601     }
1602     res = _invoke(
1603             (*((FARPROC**)args[0]))[fdesc->oVft/4],
1604             fdesc->callconv,
1605             (xargs-args),
1606             args
1607     );
1608     IUnknown_Release((LPUNKNOWN)args[0]);
1609     buf.curoff = 0;
1610     xargs = args+1;
1611     for (i=0;i<fdesc->cParams;i++) {
1612         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1613         BOOL            isserialized = FALSE;
1614
1615         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1616             /* If the parameter is 'riid', we use it as interface IID
1617              * for a later ppvObject serialization.
1618              */
1619             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1620
1621             /* DISPPARAMS* needs special serializer */
1622             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1623                 hres = serialize_DISPPARAM_ptr(
1624                     This->tinfo,
1625                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1626                     FALSE,
1627                     TRUE,
1628                     &elem->tdesc,
1629                     xargs,
1630                     &buf
1631                 );
1632                 isserialized = TRUE;
1633             }
1634             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1635                 hres = serialize_LPVOID_ptr(
1636                     This->tinfo,
1637                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1638                     FALSE,
1639                     TRUE,
1640                     &elem->tdesc,
1641                     xargs,
1642                     &buf
1643                 );
1644                 if (hres == S_OK)
1645                     isserialized = TRUE;
1646             }
1647         }
1648         if (!isserialized)
1649             hres = serialize_param(
1650                This->tinfo,
1651                elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1652                FALSE,
1653                TRUE,
1654                &elem->tdesc,
1655                xargs,
1656                &buf
1657             );
1658         xargs += _argsize(elem->tdesc.vt);
1659         if (hres) {
1660             FIXME("Failed to stuballoc param, hres %lx\n",hres);
1661             break;
1662         }
1663     }
1664     /* might need to use IRpcChannelBuffer_GetBuffer ? */
1665     xmsg->cbBuffer      = buf.curoff;
1666     xmsg->Buffer        = buf.base;
1667     HeapFree(GetProcessHeap(),0,args);
1668     return res;
1669 }
1670
1671 static LPRPCSTUBBUFFER WINAPI
1672 TMStubImpl_IsIIDSupported(LPRPCSTUBBUFFER iface, REFIID riid) {
1673     FIXME("Huh (%s)?\n",debugstr_guid(riid));
1674     return NULL;
1675 }
1676
1677 static ULONG WINAPI
1678 TMStubImpl_CountRefs(LPRPCSTUBBUFFER iface) {
1679     ICOM_THIS(TMStubImpl,iface);
1680
1681     return This->ref; /*FIXME? */
1682 }
1683
1684 static HRESULT WINAPI
1685 TMStubImpl_DebugServerQueryInterface(LPRPCSTUBBUFFER iface, LPVOID *ppv) {
1686     return E_NOTIMPL;
1687 }
1688
1689 static void WINAPI
1690 TMStubImpl_DebugServerRelease(LPRPCSTUBBUFFER iface, LPVOID ppv) {
1691     return;
1692 }
1693
1694 ICOM_VTABLE(IRpcStubBuffer) tmstubvtbl = {
1695     ICOM_MSVTABLE_COMPAT_DummyRTTIVALUE
1696     TMStubImpl_QueryInterface,
1697     TMStubImpl_AddRef,
1698     TMStubImpl_Release,
1699     TMStubImpl_Connect,
1700     TMStubImpl_Disconnect,
1701     TMStubImpl_Invoke,
1702     TMStubImpl_IsIIDSupported,
1703     TMStubImpl_CountRefs,
1704     TMStubImpl_DebugServerQueryInterface,
1705     TMStubImpl_DebugServerRelease
1706 };
1707
1708 static HRESULT WINAPI
1709 PSFacBuf_CreateStub(
1710     LPPSFACTORYBUFFER iface, REFIID riid,IUnknown *pUnkServer,
1711     IRpcStubBuffer** ppStub
1712 ) {
1713     HRESULT hres;
1714     ITypeInfo   *tinfo;
1715     TMStubImpl  *stub;
1716
1717     TRACE("(%s,%p,%p)\n",debugstr_guid(riid),pUnkServer,ppStub);
1718     hres = _get_typeinfo_for_iid(riid,&tinfo);
1719     if (hres) {
1720         FIXME("No typeinfo for %s?\n",debugstr_guid(riid));
1721         return hres;
1722     }
1723     stub = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(TMStubImpl));
1724     if (!stub)
1725         return E_OUTOFMEMORY;
1726     stub->lpvtbl        = &tmstubvtbl;
1727     stub->ref           = 1;
1728     stub->tinfo         = tinfo;
1729     memcpy(&(stub->iid),riid,sizeof(*riid));
1730     hres = IRpcStubBuffer_Connect((LPRPCSTUBBUFFER)stub,pUnkServer);
1731     *ppStub             = (LPRPCSTUBBUFFER)stub;
1732     if (hres)
1733         FIXME("Connect to pUnkServer failed?\n");
1734     return hres;
1735 }
1736
1737 static ICOM_VTABLE(IPSFactoryBuffer) psfacbufvtbl = {
1738     ICOM_MSVTABLE_COMPAT_DummyRTTIVALUE
1739     PSFacBuf_QueryInterface,
1740     PSFacBuf_AddRef,
1741     PSFacBuf_Release,
1742     PSFacBuf_CreateProxy,
1743     PSFacBuf_CreateStub
1744 };
1745
1746 /* This is the whole PSFactoryBuffer object, just the vtableptr */
1747 static ICOM_VTABLE(IPSFactoryBuffer) *lppsfac = &psfacbufvtbl;
1748
1749 /***********************************************************************
1750  *           DllGetClassObject [OLE32.63]
1751  */
1752 HRESULT WINAPI
1753 TypeLibFac_DllGetClassObject(REFCLSID rclsid, REFIID iid,LPVOID *ppv)
1754 {
1755     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)) {
1756         *ppv = &lppsfac;
1757         return S_OK;
1758     }
1759     return E_NOINTERFACE;
1760 }