dlls/oleaut32/tmarshal.c

   1 /*
   2  *      TYPELIB Marshaler
   3  *
   4  *      Copyright 2002,2005     Marcus Meissner
   5  *
   6  * The olerelay debug channel allows you to see calls marshalled by
   7  * the typelib marshaller. It is not a generic COM relaying system.
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  22  */
  23
  24 #include "config.h"
  25
  26 #include <assert.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <stdarg.h>
  30 #include <stdio.h>
  31 #include <ctype.h>
  32
  33 #define COBJMACROS
  34 #define NONAMELESSUNION
  35 #define NONAMELESSSTRUCT
  36
  37 #include "winerror.h"
  38 #include "windef.h"
  39 #include "winbase.h"
  40 #include "winnls.h"
  41 #include "winreg.h"
  42 #include "winuser.h"
  43
  44 #include "ole2.h"
  45 #include "typelib.h"
  46 #include "wine/debug.h"
  47
  48 static const WCHAR riidW[5] = {'r','i','i','d',0};
  49 static const WCHAR pdispparamsW[] = {'p','d','i','s','p','p','a','r','a','m','s',0};
  50 static const WCHAR ppvObjectW[] = {'p','p','v','O','b','j','e','c','t',0};
  51 static const WCHAR IDispatchW[] = { 'I','D','i','s','p','a','t','c','h',0};
  52 static const WCHAR GetIDsOfNamesW[] = { 'G','e','t','I','D','s','O','f','N','a','m','e','s',0};
  53
  54 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  55 WINE_DECLARE_DEBUG_CHANNEL(olerelay);
  56
  57 #define ICOM_THIS_MULTI(impl,field,iface) impl* const This=(impl*)((char*)(iface) - offsetof(impl,field))
  58
  59 typedef struct _marshal_state {
  60     LPBYTE      base;
  61     int         size;
  62     int         curoff;
  63
  64     BOOL        thisisiid;
  65     IID         iid;    /* HACK: for VT_VOID */
  66 } marshal_state;
  67
  68 /* used in the olerelay code to avoid having the L"" stuff added by debugstr_w */
  69 static char *relaystr(WCHAR *in) {
  70     char *tmp = (char *)debugstr_w(in);
  71     tmp += 2;
  72     tmp[strlen(tmp)-1] = '\0';
  73     return tmp;
  74 }
  75
  76 static HRESULT
  77 xbuf_add(marshal_state *buf, LPBYTE stuff, DWORD size) {
  78     while (buf->size - buf->curoff < size) {
  79         if (buf->base) {
  80             buf->size += 100;
  81             buf->base = HeapReAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,buf->base,buf->size);
  82             if (!buf->base)
  83                 return E_OUTOFMEMORY;
  84         } else {
  85             buf->base = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,32);
  86             buf->size = 32;
  87             if (!buf->base)
  88                 return E_OUTOFMEMORY;
  89         }
  90     }
  91     memcpy(buf->base+buf->curoff,stuff,size);
  92     buf->curoff += size;
  93     return S_OK;
  94 }
  95
  96 static HRESULT
  97 xbuf_get(marshal_state *buf, LPBYTE stuff, DWORD size) {
  98     if (buf->size < buf->curoff+size) return E_FAIL;
  99     memcpy(stuff,buf->base+buf->curoff,size);
 100     buf->curoff += size;
 101     return S_OK;
 102 }
 103
 104 static HRESULT
 105 xbuf_skip(marshal_state *buf, DWORD size) {
 106     if (buf->size < buf->curoff+size) return E_FAIL;
 107     buf->curoff += size;
 108     return S_OK;
 109 }
 110
 111 static HRESULT
 112 _unmarshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN *pUnk) {
 113     IStream             *pStm;
 114     ULARGE_INTEGER      newpos;
 115     LARGE_INTEGER       seekto;
 116     ULONG               res;
 117     HRESULT             hres;
 118     DWORD               xsize;
 119
 120     TRACE("...%s...\n",debugstr_guid(riid));
 121
 122     *pUnk = NULL;
 123     hres = xbuf_get(buf,(LPBYTE)&xsize,sizeof(xsize));
 124     if (hres) {
 125         ERR("xbuf_get failed\n");
 126         return hres;
 127     }
 128
 129     if (xsize == 0) return S_OK;
 130
 131     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 132     if (hres) {
 133         ERR("Stream create failed %lx\n",hres);
 134         return hres;
 135     }
 136
 137     hres = IStream_Write(pStm,buf->base+buf->curoff,xsize,&res);
 138     if (hres) {
 139         ERR("stream write %lx\n",hres);
 140         return hres;
 141     }
 142
 143     memset(&seekto,0,sizeof(seekto));
 144     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 145     if (hres) {
 146         ERR("Failed Seek %lx\n",hres);
 147         return hres;
 148     }
 149
 150     hres = CoUnmarshalInterface(pStm,riid,(LPVOID*)pUnk);
 151     if (hres) {
 152         ERR("Unmarshalling interface %s failed with %lx\n",debugstr_guid(riid),hres);
 153         return hres;
 154     }
 155
 156     IStream_Release(pStm);
 157     return xbuf_skip(buf,xsize);
 158 }
 159
 160 static HRESULT
 161 _marshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN pUnk) {
 162     LPUNKNOWN           newiface = NULL;
 163     LPBYTE              tempbuf = NULL;
 164     IStream             *pStm = NULL;
 165     STATSTG             ststg;
 166     ULARGE_INTEGER      newpos;
 167     LARGE_INTEGER       seekto;
 168     ULONG               res;
 169     DWORD               xsize;
 170     HRESULT             hres;
 171
 172     if (!pUnk) {
 173         /* this is valid, if for instance we serialize
 174          * a VT_DISPATCH with NULL ptr which apparently
 175          * can happen. S_OK to make sure we continue
 176          * serializing.
 177          */
 178         ERR("pUnk is NULL?\n");
 179         xsize = 0;
 180         return xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 181     }
 182
 183     hres = E_FAIL;
 184
 185     TRACE("...%s...\n",debugstr_guid(riid));
 186     hres = IUnknown_QueryInterface(pUnk,riid,(LPVOID*)&newiface);
 187     if (hres) {
 188         WARN("%p does not support iface %s\n",pUnk,debugstr_guid(riid));
 189         goto fail;
 190     }
 191
 192     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 193     if (hres) {
 194         ERR("Stream create failed %lx\n",hres);
 195         goto fail;
 196     }
 197
 198     hres = CoMarshalInterface(pStm,riid,newiface,0,NULL,0);
 199     if (hres) {
 200         ERR("Marshalling interface %s failed with %lx\n", debugstr_guid(riid), hres);
 201         goto fail;
 202     }
 203
 204     hres = IStream_Stat(pStm,&ststg,0);
 205     if (hres) {
 206         ERR("Stream stat failed\n");
 207         goto fail;
 208     }
 209
 210     tempbuf = HeapAlloc(GetProcessHeap(), 0, ststg.cbSize.u.LowPart);
 211     memset(&seekto,0,sizeof(seekto));
 212     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 213     if (hres) {
 214         ERR("Failed Seek %lx\n",hres);
 215         goto fail;
 216     }
 217
 218     hres = IStream_Read(pStm,tempbuf,ststg.cbSize.u.LowPart,&res);
 219     if (hres) {
 220         ERR("Failed Read %lx\n",hres);
 221         goto fail;
 222     }
 223
 224     xsize = ststg.cbSize.u.LowPart;
 225     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 226     hres = xbuf_add(buf,tempbuf,ststg.cbSize.u.LowPart);
 227
 228     HeapFree(GetProcessHeap(),0,tempbuf);
 229     IUnknown_Release(newiface);
 230     IStream_Release(pStm);
 231
 232     return hres;
 233
 234 fail:
 235     xsize = 0;
 236     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 237     if (pStm) IUnknown_Release(pStm);
 238     if (newiface) IUnknown_Release(newiface);
 239     HeapFree(GetProcessHeap(), 0, tempbuf);
 240     return hres;
 241 }
 242
 243 /********************* OLE Proxy/Stub Factory ********************************/
 244 static HRESULT WINAPI
 245 PSFacBuf_QueryInterface(LPPSFACTORYBUFFER iface, REFIID iid, LPVOID *ppv) {
 246     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)||IsEqualIID(iid,&IID_IUnknown)) {
 247         *ppv = (LPVOID)iface;
 248         /* No ref counting, static class */
 249         return S_OK;
 250     }
 251     FIXME("(%s) unknown IID?\n",debugstr_guid(iid));
 252     return E_NOINTERFACE;
 253 }
 254
 255 static ULONG WINAPI PSFacBuf_AddRef(LPPSFACTORYBUFFER iface) { return 2; }
 256 static ULONG WINAPI PSFacBuf_Release(LPPSFACTORYBUFFER iface) { return 1; }
 257
 258 static HRESULT
 259 _get_typeinfo_for_iid(REFIID riid, ITypeInfo**ti) {
 260     HRESULT     hres;
 261     HKEY        ikey;
 262     char        tlguid[200],typelibkey[300],interfacekey[300],ver[100];
 263     char        tlfn[260];
 264     OLECHAR     tlfnW[260];
 265     DWORD       tlguidlen, verlen, type;
 266     LONG        tlfnlen;
 267     ITypeLib    *tl;
 268
 269     sprintf( interfacekey, "Interface\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\Typelib",
 270         riid->Data1, riid->Data2, riid->Data3,
 271         riid->Data4[0], riid->Data4[1], riid->Data4[2], riid->Data4[3],
 272         riid->Data4[4], riid->Data4[5], riid->Data4[6], riid->Data4[7]
 273     );
 274
 275     if (RegOpenKeyA(HKEY_CLASSES_ROOT,interfacekey,&ikey)) {
 276         ERR("No %s key found.\n",interfacekey);
 277         return E_FAIL;
 278     }
 279     type = (1<<REG_SZ);
 280     tlguidlen = sizeof(tlguid);
 281     if (RegQueryValueExA(ikey,NULL,NULL,&type,(LPBYTE)tlguid,&tlguidlen)) {
 282         ERR("Getting typelib guid failed.\n");
 283         RegCloseKey(ikey);
 284         return E_FAIL;
 285     }
 286     type = (1<<REG_SZ);
 287     verlen = sizeof(ver);
 288     if (RegQueryValueExA(ikey,"Version",NULL,&type,(LPBYTE)ver,&verlen)) {
 289         ERR("Could not get version value?\n");
 290         RegCloseKey(ikey);
 291         return E_FAIL;
 292     }
 293     RegCloseKey(ikey);
 294     sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win32",tlguid,ver);
 295     tlfnlen = sizeof(tlfn);
 296     if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 297         ERR("Could not get typelib fn?\n");
 298         return E_FAIL;
 299     }
 300     MultiByteToWideChar(CP_ACP, 0, tlfn, -1, tlfnW, -1);
 301     hres = LoadTypeLib(tlfnW,&tl);
 302     if (hres) {
 303         ERR("Failed to load typelib for %s, but it should be there.\n",debugstr_guid(riid));
 304         return hres;
 305     }
 306     hres = ITypeLib_GetTypeInfoOfGuid(tl,riid,ti);
 307     if (hres) {
 308         ERR("typelib does not contain info for %s?\n",debugstr_guid(riid));
 309         ITypeLib_Release(tl);
 310         return hres;
 311     }
 312     /* FIXME: do this?  ITypeLib_Release(tl); */
 313     return hres;
 314 }
 315
 316 /* Determine nr of functions. Since we use the toplevel interface and all
 317  * inherited ones have lower numbers, we are ok to not to descent into
 318  * the inheritance tree I think.
 319  */
 320 static int _nroffuncs(ITypeInfo *tinfo) {
 321     int         n, max = 0;
 322     FUNCDESC    *fdesc;
 323     HRESULT     hres;
 324
 325     n=0;
 326     while (1) {
 327         hres = ITypeInfo_GetFuncDesc(tinfo,n,&fdesc);
 328         if (hres)
 329             return max+1;
 330         if (fdesc->oVft/4 > max)
 331             max = fdesc->oVft/4;
 332         n++;
 333     }
 334     /*NOTREACHED*/
 335 }
 336
 337 #ifdef __i386__
 338
 339 #include "pshpack1.h"
 340
 341 typedef struct _TMAsmProxy {
 342     BYTE        popleax;
 343     BYTE        pushlval;
 344     BYTE        nr;
 345     BYTE        pushleax;
 346     BYTE        lcall;
 347     DWORD       xcall;
 348     BYTE        lret;
 349     WORD        bytestopop;
 350 } TMAsmProxy;
 351
 352 #include "poppack.h"
 353
 354 #else /* __i386__ */
 355 # error You need to implement stubless proxies for your architecture
 356 #endif
 357
 358 typedef struct _TMProxyImpl {
 359     LPVOID                             *lpvtbl;
 360     const IRpcProxyBufferVtbl          *lpvtbl2;
 361     LONG                                ref;
 362
 363     TMAsmProxy                          *asmstubs;
 364     ITypeInfo*                          tinfo;
 365     IRpcChannelBuffer*                  chanbuf;
 366     IID                                 iid;
 367     CRITICAL_SECTION    crit;
 368     IUnknown                            *outerunknown;
 369 } TMProxyImpl;
 370
 371 static HRESULT WINAPI
 372 TMProxyImpl_QueryInterface(LPRPCPROXYBUFFER iface, REFIID riid, LPVOID *ppv)
 373 {
 374     TRACE("()\n");
 375     if (IsEqualIID(riid,&IID_IUnknown)||IsEqualIID(riid,&IID_IRpcProxyBuffer)) {
 376         *ppv = (LPVOID)iface;
 377         IRpcProxyBuffer_AddRef(iface);
 378         return S_OK;
 379     }
 380     FIXME("no interface for %s\n",debugstr_guid(riid));
 381     return E_NOINTERFACE;
 382 }
 383
 384 static ULONG WINAPI
 385 TMProxyImpl_AddRef(LPRPCPROXYBUFFER iface)
 386 {
 387     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 388     ULONG refCount = InterlockedIncrement(&This->ref);
 389
 390     TRACE("(%p)->(ref before=%lu)\n",This, refCount - 1);
 391
 392     return refCount;
 393 }
 394
 395 static ULONG WINAPI
 396 TMProxyImpl_Release(LPRPCPROXYBUFFER iface)
 397 {
 398     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 399     ULONG refCount = InterlockedDecrement(&This->ref);
 400
 401     TRACE("(%p)->(ref before=%lu)\n",This, refCount + 1);
 402
 403     if (!refCount)
 404     {
 405         DeleteCriticalSection(&This->crit);
 406         if (This->chanbuf) IRpcChannelBuffer_Release(This->chanbuf);
 407         VirtualFree(This->asmstubs, 0, MEM_RELEASE);
 408         CoTaskMemFree(This);
 409     }
 410     return refCount;
 411 }
 412
 413 static HRESULT WINAPI
 414 TMProxyImpl_Connect(
 415     LPRPCPROXYBUFFER iface,IRpcChannelBuffer* pRpcChannelBuffer)
 416 {
 417     ICOM_THIS_MULTI(TMProxyImpl, lpvtbl2, iface);
 418
 419     TRACE("(%p)\n", pRpcChannelBuffer);
 420
 421     EnterCriticalSection(&This->crit);
 422
 423     IRpcChannelBuffer_AddRef(pRpcChannelBuffer);
 424     This->chanbuf = pRpcChannelBuffer;
 425
 426     LeaveCriticalSection(&This->crit);
 427
 428     return S_OK;
 429 }
 430
 431 static void WINAPI
 432 TMProxyImpl_Disconnect(LPRPCPROXYBUFFER iface)
 433 {
 434     ICOM_THIS_MULTI(TMProxyImpl, lpvtbl2, iface);
 435
 436     TRACE("()\n");
 437
 438     EnterCriticalSection(&This->crit);
 439
 440     IRpcChannelBuffer_Release(This->chanbuf);
 441     This->chanbuf = NULL;
 442
 443     LeaveCriticalSection(&This->crit);
 444 }
 445
 446
 447 static const IRpcProxyBufferVtbl tmproxyvtable = {
 448     TMProxyImpl_QueryInterface,
 449     TMProxyImpl_AddRef,
 450     TMProxyImpl_Release,
 451     TMProxyImpl_Connect,
 452     TMProxyImpl_Disconnect
 453 };
 454
 455 /* how much space do we use on stack in DWORD steps. */
 456 int
 457 _argsize(DWORD vt) {
 458     switch (vt) {
 459     case VT_R8:
 460         return sizeof(double)/sizeof(DWORD);
 461     case VT_CY:
 462         return sizeof(CY)/sizeof(DWORD);
 463     case VT_DATE:
 464         return sizeof(DATE)/sizeof(DWORD);
 465     case VT_VARIANT:
 466         return (sizeof(VARIANT)+3)/sizeof(DWORD);
 467     default:
 468         return 1;
 469     }
 470 }
 471
 472 static int
 473 _xsize(TYPEDESC *td) {
 474     switch (td->vt) {
 475     case VT_DATE:
 476         return sizeof(DATE);
 477     case VT_VARIANT:
 478         return sizeof(VARIANT)+3;
 479     case VT_CARRAY: {
 480         int i, arrsize = 1;
 481         ARRAYDESC *adesc = td->u.lpadesc;
 482
 483         for (i=0;i<adesc->cDims;i++)
 484             arrsize *= adesc->rgbounds[i].cElements;
 485         return arrsize*_xsize(&adesc->tdescElem);
 486     }
 487     case VT_UI2:
 488     case VT_I2:
 489         return 2;
 490     case VT_UI1:
 491     case VT_I1:
 492         return 1;
 493     default:
 494         return 4;
 495     }
 496 }
 497
 498 static HRESULT
 499 serialize_param(
 500     ITypeInfo           *tinfo,
 501     BOOL                writeit,
 502     BOOL                debugout,
 503     BOOL                dealloc,
 504     TYPEDESC            *tdesc,
 505     DWORD               *arg,
 506     marshal_state       *buf)
 507 {
 508     HRESULT hres = S_OK;
 509
 510     TRACE("(tdesc.vt %d)\n",tdesc->vt);
 511
 512     switch (tdesc->vt) {
 513     case VT_EMPTY: /* nothing. empty variant for instance */
 514         return S_OK;
 515     case VT_BOOL:
 516     case VT_ERROR:
 517     case VT_UINT:
 518     case VT_I4:
 519     case VT_R4:
 520     case VT_UI4:
 521         hres = S_OK;
 522         if (debugout) TRACE_(olerelay)("%lx",*arg);
 523         if (writeit)
 524             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 525         return hres;
 526     case VT_I2:
 527     case VT_UI2:
 528         hres = S_OK;
 529         if (debugout) TRACE_(olerelay)("%04lx",*arg & 0xffff);
 530         if (writeit)
 531             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 532         return hres;
 533     case VT_I1:
 534     case VT_UI1:
 535         hres = S_OK;
 536         if (debugout) TRACE_(olerelay)("%02lx",*arg & 0xff);
 537         if (writeit)
 538             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 539         return hres;
 540     case VT_I4|VT_BYREF:
 541         hres = S_OK;
 542         if (debugout) TRACE_(olerelay)("&0x%lx",*arg);
 543         if (writeit)
 544             hres = xbuf_add(buf,(LPBYTE)(DWORD*)*arg,sizeof(DWORD));
 545         /* do not dealloc at this time */
 546         return hres;
 547     case VT_VARIANT: {
 548         TYPEDESC        tdesc2;
 549         VARIANT         *vt = (VARIANT*)arg;
 550         DWORD           vttype = V_VT(vt);
 551
 552         if (debugout) TRACE_(olerelay)("Vt(%ld)(",vttype);
 553         tdesc2.vt = vttype;
 554         if (writeit) {
 555             hres = xbuf_add(buf,(LPBYTE)&vttype,sizeof(vttype));
 556             if (hres) return hres;
 557         }
 558         /* need to recurse since we need to free the stuff */
 559         hres = serialize_param(tinfo,writeit,debugout,dealloc,&tdesc2,&(V_I4(vt)),buf);
 560         if (debugout) TRACE_(olerelay)(")");
 561         return hres;
 562     }
 563     case VT_BSTR|VT_BYREF: {
 564         if (debugout) TRACE_(olerelay)("[byref]'%s'", *(BSTR*)*arg ? relaystr(*((BSTR*)*arg)) : "<bstr NULL>");
 565         if (writeit) {
 566             /* ptr to ptr to magic widestring, basically */
 567             BSTR *bstr = (BSTR *) *arg;
 568             if (!*bstr) {
 569                 /* -1 means "null string" which is equivalent to empty string */
 570                 DWORD fakelen = -1;
 571                 xbuf_add(buf, (LPBYTE)&fakelen,4);
 572             } else {
 573                 /* BSTRs store the length behind the first character */
 574                 DWORD *len = ((DWORD *)(*bstr))-1;
 575                 hres = xbuf_add(buf, (LPBYTE) len, *len + 4);
 576                 if (hres) return hres;
 577             }
 578         }
 579
 580         if (dealloc && arg) {
 581             BSTR *str = *((BSTR **)arg);
 582             SysFreeString(*str);
 583         }
 584         return S_OK;
 585     }
 586
 587     case VT_BSTR: {
 588         if (debugout) {
 589             if (*arg)
 590                    TRACE_(olerelay)("%s",relaystr((WCHAR*)*arg));
 591             else
 592                     TRACE_(olerelay)("<bstr NULL>");
 593         }
 594         if (writeit) {
 595             if (!*arg) {
 596                 DWORD fakelen = -1;
 597                 hres = xbuf_add(buf,(LPBYTE)&fakelen,4);
 598                 if (hres)
 599                     return hres;
 600             } else {
 601                 DWORD *bstr = ((DWORD*)(*arg))-1;
 602
 603                 hres = xbuf_add(buf,(LPBYTE)bstr,bstr[0]+4);
 604                 if (hres)
 605                     return hres;
 606             }
 607         }
 608
 609         if (dealloc && arg)
 610             SysFreeString((BSTR)*arg);
 611         return S_OK;
 612     }
 613     case VT_PTR: {
 614         DWORD cookie;
 615         BOOL        derefhere;
 616
 617         derefhere = (tdesc->u.lptdesc->vt != VT_USERDEFINED);
 618
 619         if (debugout) TRACE_(olerelay)("*");
 620         /* Write always, so the other side knows when it gets a NULL pointer.
 621          */
 622         cookie = *arg ? 0x42424242 : 0;
 623         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 624         if (hres)
 625             return hres;
 626         if (!*arg) {
 627             if (debugout) TRACE_(olerelay)("NULL");
 628             return S_OK;
 629         }
 630         hres = serialize_param(tinfo,writeit,debugout,dealloc,tdesc->u.lptdesc,(DWORD*)*arg,buf);
 631         if (derefhere && dealloc) HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 632         return hres;
 633     }
 634     case VT_UNKNOWN:
 635         if (debugout) TRACE_(olerelay)("unk(0x%lx)",*arg);
 636         if (writeit)
 637             hres = _marshal_interface(buf,&IID_IUnknown,(LPUNKNOWN)*arg);
 638         return hres;
 639     case VT_DISPATCH:
 640         if (debugout) TRACE_(olerelay)("idisp(0x%lx)",*arg);
 641         if (writeit)
 642             hres = _marshal_interface(buf,&IID_IDispatch,(LPUNKNOWN)*arg);
 643         return hres;
 644     case VT_VOID:
 645         if (debugout) TRACE_(olerelay)("<void>");
 646         return S_OK;
 647     case VT_USERDEFINED: {
 648         ITypeInfo       *tinfo2;
 649         TYPEATTR        *tattr;
 650
 651         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 652         if (hres) {
 653             ERR("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
 654             return hres;
 655         }
 656         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 657         switch (tattr->typekind) {
 658         case TKIND_DISPATCH:
 659         case TKIND_INTERFACE:
 660             if (writeit)
 661                hres=_marshal_interface(buf,&(tattr->guid),(LPUNKNOWN)arg);
 662             break;
 663         case TKIND_RECORD: {
 664             int i;
 665             if (debugout) TRACE_(olerelay)("{");
 666             for (i=0;i<tattr->cVars;i++) {
 667                 VARDESC *vdesc;
 668                 ELEMDESC *elem2;
 669                 TYPEDESC *tdesc2;
 670
 671                 hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 672                 if (hres) {
 673                     ERR("Could not get vardesc of %d\n",i);
 674                     return hres;
 675                 }
 676                 /* Need them for hack below */
 677                 /*
 678                 memset(names,0,sizeof(names));
 679                 hres = ITypeInfo_GetNames(tinfo2,vdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
 680                 if (nrofnames > sizeof(names)/sizeof(names[0])) {
 681                     ERR("Need more names!\n");
 682                 }
 683                 if (!hres && debugout)
 684                     TRACE_(olerelay)("%s=",relaystr(names[0]));
 685                 */
 686                 elem2 = &vdesc->elemdescVar;
 687                 tdesc2 = &elem2->tdesc;
 688                 hres = serialize_param(
 689                     tinfo2,
 690                     writeit,
 691                     debugout,
 692                     dealloc,
 693                     tdesc2,
 694                     (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
 695                     buf
 696                 );
 697                 ITypeInfo_ReleaseVarDesc(tinfo2, vdesc);
 698                 if (hres!=S_OK)
 699                     return hres;
 700                 if (debugout && (i<(tattr->cVars-1)))
 701                     TRACE_(olerelay)(",");
 702             }
 703             if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
 704                 memcpy(&(buf->iid),arg,sizeof(buf->iid));
 705             if (debugout) TRACE_(olerelay)("}");
 706             break;
 707         }
 708         case TKIND_ALIAS:
 709             return serialize_param(tinfo2,writeit,debugout,dealloc,&tattr->tdescAlias,arg,buf);
 710         case TKIND_ENUM:
 711             hres = S_OK;
 712             if (debugout) TRACE_(olerelay)("%lx",*arg);
 713             if (writeit)
 714                 hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 715             return hres;
 716         default:
 717             FIXME("Unhandled typekind %d\n",tattr->typekind);
 718             hres = E_FAIL;
 719             break;
 720         }
 721         ITypeInfo_Release(tinfo2);
 722         return hres;
 723     }
 724     case VT_CARRAY: {
 725         ARRAYDESC *adesc = tdesc->u.lpadesc;
 726         int i, arrsize = 1;
 727
 728         if (debugout) TRACE_(olerelay)("carr");
 729         for (i=0;i<adesc->cDims;i++) {
 730             if (debugout) TRACE_(olerelay)("[%ld]",adesc->rgbounds[i].cElements);
 731             arrsize *= adesc->rgbounds[i].cElements;
 732         }
 733         if (debugout) TRACE_(olerelay)("(vt %d)",adesc->tdescElem.vt);
 734         if (debugout) TRACE_(olerelay)("[");
 735         for (i=0;i<arrsize;i++) {
 736             hres = serialize_param(tinfo, writeit, debugout, dealloc, &adesc->tdescElem, (DWORD*)((LPBYTE)arg+i*_xsize(&adesc->tdescElem)), buf);
 737             if (hres)
 738                 return hres;
 739             if (debugout && (i<arrsize-1)) TRACE_(olerelay)(",");
 740         }
 741         if (debugout) TRACE_(olerelay)("]");
 742         return S_OK;
 743     }
 744     default:
 745         ERR("Unhandled marshal type %d.\n",tdesc->vt);
 746         return S_OK;
 747     }
 748 }
 749
 750 /* IDL desc:
 751  * HRESULT GetIDsOfNames(
 752  *   [in] REFIID riid,                                  args[1]
 753  *   [in, size_is(cNames)] LPOLESTR *rgszNames,         args[2]
 754  *   [in] UINT cNames,                                  args[3]
 755  *   [in] LCID lcid,                                    args[4]
 756  *   [out, size_is(cNames)] DISPID *rgDispId);          args[5]
 757  *
 758  * line format:
 759  *      IID     iid;
 760  *      DWORD   cNames;
 761  *      LPOLESTR rgszNames[cNames];
 762  *              DWORD bytestrlen        (incl 0)
 763  *              BYTE data[bytestrlen]   (incl 0)
 764  *      LCID
 765  */
 766 static HRESULT
 767 serialize_IDispatch_GetIDsOfNames(
 768     BOOL                inputparams,
 769     BOOL                debugout,
 770     DWORD               *args,
 771     marshal_state       *buf)
 772 {
 773     HRESULT     hres;
 774     DWORD       cNames = args[2];
 775     LPOLESTR    *rgszNames = (LPOLESTR*)args[1];
 776     int         i;
 777
 778     if (inputparams) {
 779         if (debugout) TRACE_(olerelay)("riid=%s,",debugstr_guid((REFIID)args[0]));
 780         hres = xbuf_add(buf, (LPBYTE)args[0], sizeof(IID));
 781         if (hres) {
 782             FIXME("serialize of IID failed.\n");
 783             return hres;
 784         }
 785         if (debugout) TRACE_(olerelay)("cNames=%ld,",cNames);
 786         hres = xbuf_add(buf, (LPBYTE)&cNames, sizeof(DWORD));
 787         if (hres) {
 788             FIXME("serialize of cNames failed.\n");
 789             return hres;
 790         }
 791         if (debugout) TRACE_(olerelay)("rgszNames=[");
 792         for (i=0;i<cNames;i++) {
 793             DWORD len = 2*(lstrlenW(rgszNames[i])+1);
 794
 795             if (debugout) TRACE_(olerelay)("%s,",relaystr(rgszNames[i]));
 796             hres = xbuf_add(buf, (LPBYTE)&len, sizeof(DWORD));
 797             if (hres) {
 798                 FIXME("serialize of len failed.\n");
 799                 return hres;
 800             }
 801             hres = xbuf_add(buf, (LPBYTE)rgszNames[i], len);
 802             if (hres) {
 803                 FIXME("serialize of rgszNames[i] failed.\n");
 804                 return hres;
 805             }
 806         }
 807         if (debugout) TRACE_(olerelay)("],lcid=%04lx)",args[3]);
 808         hres = xbuf_add(buf, (LPBYTE)&args[3], sizeof(DWORD));
 809         if (hres) {
 810             FIXME("serialize of lcid failed.\n");
 811             return hres;
 812         }
 813     } else {
 814         DISPID *rgDispId = (DISPID*)args[4];
 815
 816         hres = xbuf_add(buf, (LPBYTE)rgDispId, sizeof(DISPID) * cNames);
 817         if (hres) {
 818             FIXME("serialize of rgDispId failed.\n");
 819             return hres;
 820         }
 821         if (debugout) {
 822             TRACE_(olerelay)("riid=[in],rgszNames=[in],cNames=[in],rgDispId=[");
 823             for (i=0;i<cNames;i++)
 824                 TRACE_(olerelay)("%08lx,",rgDispId[i]);
 825             TRACE_(olerelay)("])");
 826         }
 827         HeapFree(GetProcessHeap(),0,(IID*)args[0]);
 828         rgszNames = (LPOLESTR*)args[1];
 829         for (i=0;i<cNames;i++) HeapFree(GetProcessHeap(),0,rgszNames[i]);
 830         HeapFree(GetProcessHeap(),0,rgszNames);
 831         HeapFree(GetProcessHeap(),0,rgDispId);
 832     }
 833     return S_OK;
 834 }
 835
 836 static HRESULT
 837 deserialize_IDispatch_GetIDsOfNames(
 838     BOOL                inputparams,
 839     BOOL                debugout,
 840     DWORD               *args,
 841     marshal_state       *buf)
 842 {
 843     HRESULT     hres;
 844     DWORD       cNames;
 845     LPOLESTR    *rgszNames;
 846     int         i;
 847
 848     if (inputparams) {
 849         args[0] = (DWORD)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(IID));
 850         if (!args[0]) return E_FAIL;
 851         hres = xbuf_get(buf, (LPBYTE)args[0], sizeof(IID));
 852         if (hres) {
 853             FIXME("deserialize of IID failed.\n");
 854             return hres;
 855         }
 856         if (debugout) TRACE_(olerelay)("riid=%s,",debugstr_guid((REFIID)args[0]));
 857
 858         hres = xbuf_get(buf, (LPBYTE)&cNames, sizeof(DWORD));
 859         if (hres) {
 860             FIXME("deserialize of cNames failed.\n");
 861             return hres;
 862         }
 863         args[2] = cNames;
 864         if (debugout) TRACE_(olerelay)("cNames=%ld,",cNames);
 865         if (debugout) TRACE_(olerelay)("rgszNames=[");
 866         rgszNames = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(LPOLESTR) * cNames);
 867         if (!rgszNames) return E_FAIL;
 868         args[1] = (DWORD)rgszNames;
 869         for (i=0;i<cNames;i++) {
 870             DWORD len;
 871
 872             hres = xbuf_get(buf, (LPBYTE)&len, sizeof(DWORD));
 873             if (hres) {
 874                 FIXME("serialize of len failed.\n");
 875                 return hres;
 876             }
 877             rgszNames[i] = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, len);
 878             if (!rgszNames[i]) {
 879                 FIXME("heapalloc of %ld bytes failed\n", len);
 880                 return E_FAIL;
 881             }
 882             hres = xbuf_get(buf, (LPBYTE)rgszNames[i], len);
 883             if (hres) {
 884                 FIXME("serialize of rgszNames[i] failed.\n");
 885                 return hres;
 886             }
 887             if (debugout) TRACE_(olerelay)("%s,",relaystr(rgszNames[i]));
 888         }
 889         hres = xbuf_get(buf, (LPBYTE)&args[3], sizeof(DWORD));
 890         if (hres) {
 891             FIXME("deserialize of lcid failed.\n");
 892             return hres;
 893         }
 894         if (debugout) TRACE_(olerelay)("],lcid=%04lx,rgDispId=[out])",args[3]);
 895         args[4] = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPID) * cNames);
 896     } else {
 897         hres = xbuf_get(buf, (LPBYTE)args[4], sizeof(DISPID) * args[2]);
 898         if (hres) {
 899             FIXME("serialize of rgDispId failed.\n");
 900             return hres;
 901         }
 902         if (debugout) {
 903             TRACE_(olerelay)("dispid=[");
 904             for (i=0;i<args[2];i++)
 905                 TRACE_(olerelay)("%08lx,",((DISPID*)args[4])[i]);
 906             TRACE_(olerelay)("])");
 907         }
 908     }
 909     return S_OK;
 910 }
 911
 912 static HRESULT
 913 serialize_LPVOID_ptr(
 914     ITypeInfo           *tinfo,
 915     BOOL                writeit,
 916     BOOL                debugout,
 917     BOOL                dealloc,
 918     TYPEDESC            *tdesc,
 919     DWORD               *arg,
 920     marshal_state       *buf)
 921 {
 922     HRESULT     hres;
 923     DWORD       cookie;
 924
 925     if ((tdesc->vt != VT_PTR)                   ||
 926         (tdesc->u.lptdesc->vt != VT_PTR)        ||
 927         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
 928     ) {
 929         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
 930         return E_FAIL;
 931     }
 932     cookie = (*(DWORD*)*arg) ? 0x42424242: 0x0;
 933     if (writeit) {
 934         hres = xbuf_add(buf, (LPVOID)&cookie, sizeof(cookie));
 935         if (hres)
 936             return hres;
 937     }
 938     if (!*(DWORD*)*arg) {
 939         if (debugout) TRACE_(olerelay)("<lpvoid NULL>");
 940         return S_OK;
 941     }
 942     if (debugout)
 943         TRACE_(olerelay)("ppv(%p)",*(LPUNKNOWN*)*arg);
 944     if (writeit) {
 945         hres = _marshal_interface(buf,&(buf->iid),*(LPUNKNOWN*)*arg);
 946         if (hres)
 947             return hres;
 948     }
 949     if (dealloc)
 950         HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 951     return S_OK;
 952 }
 953
 954 static HRESULT
 955 serialize_DISPPARAM_ptr(
 956     ITypeInfo           *tinfo,
 957     BOOL                writeit,
 958     BOOL                debugout,
 959     BOOL                dealloc,
 960     TYPEDESC            *tdesc,
 961     DWORD               *arg,
 962     marshal_state       *buf)
 963 {
 964     DWORD       cookie;
 965     HRESULT     hres;
 966     DISPPARAMS  *disp;
 967     int         i;
 968
 969     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
 970         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
 971         return E_FAIL;
 972     }
 973
 974     cookie = *arg ? 0x42424242 : 0x0;
 975     if (writeit) {
 976         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 977         if (hres)
 978             return hres;
 979     }
 980     if (!*arg) {
 981         if (debugout) TRACE_(olerelay)("<DISPPARAMS NULL>");
 982         return S_OK;
 983     }
 984     disp = (DISPPARAMS*)*arg;
 985     if (writeit) {
 986         hres = xbuf_add(buf,(LPBYTE)&disp->cArgs,sizeof(disp->cArgs));
 987         if (hres)
 988             return hres;
 989     }
 990     if (debugout) TRACE_(olerelay)("D{");
 991     for (i=0;i<disp->cArgs;i++) {
 992         TYPEDESC        vtdesc;
 993
 994         vtdesc.vt = VT_VARIANT;
 995         serialize_param(
 996             tinfo,
 997             writeit,
 998             debugout,
 999             dealloc,
1000             &vtdesc,
1001             (DWORD*)(disp->rgvarg+i),
1002             buf
1003         );
1004         if (debugout && (i<disp->cArgs-1))
1005             TRACE_(olerelay)(",");
1006     }
1007     if (dealloc)
1008         HeapFree(GetProcessHeap(),0,disp->rgvarg);
1009     if (writeit) {
1010         hres = xbuf_add(buf,(LPBYTE)&disp->cNamedArgs,sizeof(disp->cNamedArgs));
1011         if (hres)
1012             return hres;
1013     }
1014     if (debugout) TRACE_(olerelay)("}{");
1015     for (i=0;i<disp->cNamedArgs;i++) {
1016         TYPEDESC        vtdesc;
1017
1018         vtdesc.vt = VT_UINT;
1019         serialize_param(
1020             tinfo,
1021             writeit,
1022             debugout,
1023             dealloc,
1024             &vtdesc,
1025             (DWORD*)(disp->rgdispidNamedArgs+i),
1026             buf
1027         );
1028         if (debugout && (i<disp->cNamedArgs-1))
1029             TRACE_(olerelay)(",");
1030     }
1031     if (debugout) TRACE_(olerelay)("}");
1032     if (dealloc) {
1033         HeapFree(GetProcessHeap(),0,disp->rgdispidNamedArgs);
1034         HeapFree(GetProcessHeap(),0,disp);
1035     }
1036     return S_OK;
1037 }
1038
1039 static HRESULT
1040 deserialize_param(
1041     ITypeInfo           *tinfo,
1042     BOOL                readit,
1043     BOOL                debugout,
1044     BOOL                alloc,
1045     TYPEDESC            *tdesc,
1046     DWORD               *arg,
1047     marshal_state       *buf)
1048 {
1049     HRESULT hres = S_OK;
1050
1051     TRACE("vt %d at %p\n",tdesc->vt,arg);
1052
1053     while (1) {
1054         switch (tdesc->vt) {
1055         case VT_EMPTY:
1056             if (debugout) TRACE_(olerelay)("<empty>");
1057             return S_OK;
1058         case VT_NULL:
1059             if (debugout) TRACE_(olerelay)("<null>");
1060             return S_OK;
1061         case VT_VARIANT: {
1062             VARIANT     *vt = (VARIANT*)arg;
1063
1064             if (readit) {
1065                 DWORD   vttype;
1066                 TYPEDESC        tdesc2;
1067                 hres = xbuf_get(buf,(LPBYTE)&vttype,sizeof(vttype));
1068                 if (hres) {
1069                     FIXME("vt type not read?\n");
1070                     return hres;
1071                 }
1072                 memset(&tdesc2,0,sizeof(tdesc2));
1073                 tdesc2.vt = vttype;
1074                 V_VT(vt)  = vttype;
1075                 if (debugout) TRACE_(olerelay)("Vt(%ld)(",vttype);
1076                 hres = deserialize_param(tinfo, readit, debugout, alloc, &tdesc2, &(V_I4(vt)), buf);
1077                 TRACE_(olerelay)(")");
1078                 return hres;
1079             } else {
1080                 VariantInit(vt);
1081                 return S_OK;
1082             }
1083         }
1084         case VT_ERROR:
1085         case VT_BOOL:
1086         case VT_I4:
1087         case VT_UINT:
1088         case VT_R4:
1089         case VT_UI4:
1090             if (readit) {
1091                 hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
1092                 if (hres) ERR("Failed to read integer 4 byte\n");
1093             }
1094             if (debugout) TRACE_(olerelay)("%lx",*arg);
1095             return hres;
1096         case VT_I2:
1097         case VT_UI2:
1098             if (readit) {
1099                 DWORD x;
1100                 hres = xbuf_get(buf,(LPBYTE)&x,sizeof(DWORD));
1101                 if (hres) ERR("Failed to read integer 4 byte\n");
1102                 memcpy(arg,&x,2);
1103             }
1104             if (debugout) TRACE_(olerelay)("%04lx",*arg & 0xffff);
1105             return hres;
1106         case VT_I1:
1107         case VT_UI1:
1108             if (readit) {
1109                 DWORD x;
1110                 hres = xbuf_get(buf,(LPBYTE)&x,sizeof(DWORD));
1111                 if (hres) ERR("Failed to read integer 4 byte\n");
1112                 memcpy(arg,&x,1);
1113             }
1114             if (debugout) TRACE_(olerelay)("%02lx",*arg & 0xff);
1115             return hres;
1116         case VT_I4|VT_BYREF:
1117             hres = S_OK;
1118             if (alloc)
1119                 *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
1120             if (readit) {
1121                 hres = xbuf_get(buf,(LPBYTE)*arg,sizeof(DWORD));
1122                 if (hres) ERR("Failed to read integer 4 byte\n");
1123             }
1124             if (debugout) TRACE_(olerelay)("&0x%lx",*(DWORD*)*arg);
1125             return hres;
1126         case VT_BSTR|VT_BYREF: {
1127             BSTR **bstr = (BSTR **)arg;
1128             WCHAR       *str;
1129             DWORD       len;
1130
1131             if (readit) {
1132                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
1133                 if (hres) {
1134                     ERR("failed to read bstr klen\n");
1135                     return hres;
1136                 }
1137                 if (len == -1) {
1138                     *bstr = CoTaskMemAlloc(sizeof(BSTR *));
1139                     **bstr = NULL;
1140                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
1141                 } else {
1142                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+sizeof(WCHAR));
1143                     hres = xbuf_get(buf,(LPBYTE)str,len);
1144                     if (hres) {
1145                         ERR("Failed to read BSTR.\n");
1146                         return hres;
1147                     }
1148                     *bstr = CoTaskMemAlloc(sizeof(BSTR *));
1149                     **bstr = SysAllocStringLen(str,len);
1150                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
1151                     HeapFree(GetProcessHeap(),0,str);
1152                 }
1153             } else {
1154                 *bstr = NULL;
1155             }
1156             return S_OK;
1157         }
1158         case VT_BSTR: {
1159             WCHAR       *str;
1160             DWORD       len;
1161
1162             if (readit) {
1163                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
1164                 if (hres) {
1165                     ERR("failed to read bstr klen\n");
1166                     return hres;
1167                 }
1168                 if (len == -1) {
1169                     *arg = 0;
1170                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
1171                 } else {
1172                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+sizeof(WCHAR));
1173                     hres = xbuf_get(buf,(LPBYTE)str,len);
1174                     if (hres) {
1175                         ERR("Failed to read BSTR.\n");
1176                         return hres;
1177                     }
1178                     *arg = (DWORD)SysAllocStringLen(str,len);
1179                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
1180                     HeapFree(GetProcessHeap(),0,str);
1181                 }
1182             } else {
1183                 *arg = 0;
1184             }
1185             return S_OK;
1186         }
1187         case VT_PTR: {
1188             DWORD       cookie;
1189             BOOL        derefhere = 0;
1190
1191             derefhere = (tdesc->u.lptdesc->vt != VT_USERDEFINED);
1192             /* read it in all cases, we need to know if we have
1193              * NULL pointer or not.
1194              */
1195             hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1196             if (hres) {
1197                 ERR("Failed to load pointer cookie.\n");
1198                 return hres;
1199             }
1200             if (cookie != 0x42424242) {
1201                 /* we read a NULL ptr from the remote side */
1202                 if (debugout) TRACE_(olerelay)("NULL");
1203                 *arg = 0;
1204                 return S_OK;
1205             }
1206             if (debugout) TRACE_(olerelay)("*");
1207             if (alloc) {
1208                 /* Allocate space for the referenced struct */
1209                 if (derefhere)
1210                     *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc));
1211             }
1212             if (derefhere)
1213                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, (LPDWORD)*arg, buf);
1214             else
1215                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, arg, buf);
1216         }
1217         case VT_UNKNOWN:
1218             /* FIXME: UNKNOWN is unknown ..., but allocate 4 byte for it */
1219             if (alloc)
1220                 *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
1221             hres = S_OK;
1222             if (readit)
1223                 hres = _unmarshal_interface(buf,&IID_IUnknown,(LPUNKNOWN*)arg);
1224             if (debugout)
1225                 TRACE_(olerelay)("unk(%p)",arg);
1226             return hres;
1227         case VT_DISPATCH:
1228             hres = S_OK;
1229             if (readit)
1230                 hres = _unmarshal_interface(buf,&IID_IDispatch,(LPUNKNOWN*)arg);
1231             if (debugout)
1232                 TRACE_(olerelay)("idisp(%p)",arg);
1233             return hres;
1234         case VT_VOID:
1235             if (debugout) TRACE_(olerelay)("<void>");
1236             return S_OK;
1237         case VT_USERDEFINED: {
1238             ITypeInfo   *tinfo2;
1239             TYPEATTR    *tattr;
1240
1241             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
1242             if (hres) {
1243                 ERR("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
1244                 return hres;
1245             }
1246             hres = ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1247             if (hres) {
1248                 ERR("Could not get typeattr in VT_USERDEFINED.\n");
1249             } else {
1250                 switch (tattr->typekind) {
1251                 case TKIND_DISPATCH:
1252                 case TKIND_INTERFACE:
1253                     if (readit)
1254                         hres = _unmarshal_interface(buf,&(tattr->guid),(LPUNKNOWN*)arg);
1255                     break;
1256                 case TKIND_RECORD: {
1257                     int i;
1258
1259                     if (alloc)
1260                         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,tattr->cbSizeInstance);
1261
1262                     if (debugout) TRACE_(olerelay)("{");
1263                     for (i=0;i<tattr->cVars;i++) {
1264                         VARDESC *vdesc;
1265
1266                         hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
1267                         if (hres) {
1268                             ERR("Could not get vardesc of %d\n",i);
1269                             return hres;
1270                         }
1271                         hres = deserialize_param(
1272                             tinfo2,
1273                             readit,
1274                             debugout,
1275                             alloc,
1276                             &vdesc->elemdescVar.tdesc,
1277                             (DWORD*)(((LPBYTE)*arg)+vdesc->u.oInst),
1278                             buf
1279                         );
1280                         if (debugout && (i<tattr->cVars-1)) TRACE_(olerelay)(",");
1281                     }
1282                     if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
1283                         memcpy(&(buf->iid),(LPBYTE)*arg,sizeof(buf->iid));
1284                     if (debugout) TRACE_(olerelay)("}");
1285                     break;
1286                 }
1287                 case TKIND_ALIAS:
1288                     return deserialize_param(tinfo2,readit,debugout,alloc,&tattr->tdescAlias,arg,buf);
1289                 case TKIND_ENUM:
1290                     if (readit) {
1291                         hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
1292                         if (hres) ERR("Failed to read enum (4 byte)\n");
1293                     }
1294                     if (debugout) TRACE_(olerelay)("%lx",*arg);
1295                     return hres;
1296                 default:
1297                     ERR("Unhandled typekind %d\n",tattr->typekind);
1298                     hres = E_FAIL;
1299                     break;
1300                 }
1301             }
1302             if (hres)
1303                 ERR("failed to stuballoc in TKIND_RECORD.\n");
1304             ITypeInfo_Release(tinfo2);
1305             return hres;
1306         }
1307         case VT_CARRAY: {
1308             /* arg is pointing to the start of the array. */
1309             ARRAYDESC *adesc = tdesc->u.lpadesc;
1310             int         arrsize,i;
1311             arrsize = 1;
1312             if (adesc->cDims > 1) FIXME("cDims > 1 in VT_CARRAY. Does it work?\n");
1313             for (i=0;i<adesc->cDims;i++)
1314                 arrsize *= adesc->rgbounds[i].cElements;
1315             for (i=0;i<arrsize;i++)
1316                 deserialize_param(
1317                     tinfo,
1318                     readit,
1319                     debugout,
1320                     alloc,
1321                     &adesc->tdescElem,
1322                     (DWORD*)((LPBYTE)(arg)+i*_xsize(&adesc->tdescElem)),
1323                     buf
1324                 );
1325             return S_OK;
1326         }
1327         default:
1328             ERR("No handler for VT type %d!\n",tdesc->vt);
1329             return S_OK;
1330         }
1331     }
1332 }
1333
1334 static HRESULT
1335 deserialize_LPVOID_ptr(
1336     ITypeInfo           *tinfo,
1337     BOOL                readit,
1338     BOOL                debugout,
1339     BOOL                alloc,
1340     TYPEDESC            *tdesc,
1341     DWORD               *arg,
1342     marshal_state       *buf
1343 ) {
1344     HRESULT     hres;
1345     DWORD       cookie;
1346
1347     if ((tdesc->vt != VT_PTR)                   ||
1348         (tdesc->u.lptdesc->vt != VT_PTR)        ||
1349         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
1350     ) {
1351         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
1352         return E_FAIL;
1353     }
1354     if (alloc)
1355         *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(LPVOID));
1356     if (readit) {
1357         hres = xbuf_get(buf, (LPVOID)&cookie, sizeof(cookie));
1358         if (hres)
1359             return hres;
1360         if (cookie != 0x42424242) {
1361             *(DWORD*)*arg = 0;
1362             if (debugout) TRACE_(olerelay)("<lpvoid NULL>");
1363             return S_OK;
1364         }
1365     }
1366     if (readit) {
1367         hres = _unmarshal_interface(buf,&buf->iid,(LPUNKNOWN*)*arg);
1368         if (hres) {
1369             FIXME("_unmarshal_interface of %s , %p failed with %lx\n", debugstr_guid(&buf->iid), (LPUNKNOWN*)*arg, hres);
1370             return hres;
1371         }
1372     }
1373     if (debugout) TRACE_(olerelay)("ppv(%p)",(LPVOID)*arg);
1374     return S_OK;
1375 }
1376
1377 static HRESULT
1378 deserialize_DISPPARAM_ptr(
1379     ITypeInfo           *tinfo,
1380     BOOL                readit,
1381     BOOL                debugout,
1382     BOOL                alloc,
1383     TYPEDESC            *tdesc,
1384     DWORD               *arg,
1385     marshal_state       *buf)
1386 {
1387     DWORD       cookie;
1388     DISPPARAMS  *disps;
1389     HRESULT     hres;
1390     int         i;
1391
1392     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
1393         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
1394         return E_FAIL;
1395     }
1396     if (readit) {
1397         hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1398         if (hres)
1399             return hres;
1400         if (cookie == 0) {
1401             *arg = 0;
1402             if (debugout) TRACE_(olerelay)("<DISPPARAMS NULL>");
1403             return S_OK;
1404         }
1405     }
1406     if (alloc)
1407         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPPARAMS));
1408     disps = (DISPPARAMS*)*arg;
1409     if (!readit)
1410         return S_OK;
1411     hres = xbuf_get(buf, (LPBYTE)&disps->cArgs, sizeof(disps->cArgs));
1412     if (hres)
1413         return hres;
1414     if (alloc)
1415         disps->rgvarg = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(VARIANT)*disps->cArgs);
1416     if (debugout) TRACE_(olerelay)("D{");
1417     for (i=0; i< disps->cArgs; i++) {
1418         TYPEDESC vdesc;
1419
1420         vdesc.vt = VT_VARIANT;
1421         hres = deserialize_param(
1422             tinfo,
1423             readit,
1424             debugout,
1425             alloc,
1426             &vdesc,
1427             (DWORD*)(disps->rgvarg+i),
1428             buf
1429         );
1430     }
1431     if (debugout) TRACE_(olerelay)("}{");
1432     hres = xbuf_get(buf, (LPBYTE)&disps->cNamedArgs, sizeof(disps->cNamedArgs));
1433     if (hres)
1434         return hres;
1435     if (disps->cNamedArgs) {
1436         if (alloc)
1437             disps->rgdispidNamedArgs = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPID)*disps->cNamedArgs);
1438         for (i=0; i< disps->cNamedArgs; i++) {
1439             TYPEDESC vdesc;
1440
1441             vdesc.vt = VT_UINT;
1442             hres = deserialize_param(
1443                 tinfo,
1444                 readit,
1445                 debugout,
1446                 alloc,
1447                 &vdesc,
1448                 (DWORD*)(disps->rgdispidNamedArgs+i),
1449                 buf
1450             );
1451             if (debugout && i<(disps->cNamedArgs-1)) TRACE_(olerelay)(",");
1452         }
1453     }
1454     if (debugout) TRACE_(olerelay)("}");
1455     return S_OK;
1456 }
1457
1458 /* Searches function, also in inherited interfaces */
1459 static HRESULT
1460 _get_funcdesc(
1461     ITypeInfo *tinfo, int iMethod, ITypeInfo **tactual, FUNCDESC **fdesc, BSTR *iname, BSTR *fname)
1462 {
1463     int i = 0, j = 0;
1464     HRESULT hres;
1465
1466     if (fname) *fname = NULL;
1467     if (iname) *iname = NULL;
1468
1469     *tactual = tinfo;
1470     ITypeInfo_AddRef(*tactual);
1471
1472     while (1) {
1473         hres = ITypeInfo_GetFuncDesc(tinfo, i, fdesc);
1474         if (hres) {
1475             ITypeInfo   *tinfo2;
1476             HREFTYPE    href;
1477             TYPEATTR    *attr;
1478
1479             hres = ITypeInfo_GetTypeAttr(tinfo, &attr);
1480             if (hres) {
1481                 ERR("GetTypeAttr failed with %lx\n",hres);
1482                 return hres;
1483             }
1484             /* Not found, so look in inherited ifaces. */
1485             for (j=0;j<attr->cImplTypes;j++) {
1486                 hres = ITypeInfo_GetRefTypeOfImplType(tinfo, j, &href);
1487                 if (hres) {
1488                     ERR("Did not find a reftype for interface offset %d?\n",j);
1489                     break;
1490                 }
1491                 hres = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
1492                 if (hres) {
1493                     ERR("Did not find a typeinfo for reftype %ld?\n",href);
1494                     continue;
1495                 }
1496                 hres = _get_funcdesc(tinfo2,iMethod,tactual,fdesc,iname,fname);
1497                 ITypeInfo_Release(tinfo2);
1498                 if (!hres) return S_OK;
1499             }
1500             return hres;
1501         }
1502         if (((*fdesc)->oVft/4) == iMethod) {
1503             if (fname)
1504                 ITypeInfo_GetDocumentation(tinfo,(*fdesc)->memid,fname,NULL,NULL,NULL);
1505             if (iname)
1506                 ITypeInfo_GetDocumentation(tinfo,-1,iname,NULL,NULL,NULL);
1507             return S_OK;
1508         }
1509         i++;
1510     }
1511 }
1512
1513 static DWORD
1514 xCall(LPVOID retptr, int method, TMProxyImpl *tpinfo /*, args */)
1515 {
1516     DWORD               *args = ((DWORD*)&tpinfo)+1, *xargs;
1517     FUNCDESC            *fdesc;
1518     HRESULT             hres;
1519     int                 i, relaydeb = TRACE_ON(olerelay);
1520     marshal_state       buf;
1521     RPCOLEMESSAGE       msg;
1522     ULONG               status;
1523     BSTR                fname,iname;
1524     BSTR                names[10];
1525     int                 nrofnames;
1526     int                 is_idispatch_getidsofnames = 0;
1527     DWORD               remoteresult = 0;
1528     ITypeInfo           *tinfo;
1529
1530     EnterCriticalSection(&tpinfo->crit);
1531
1532     hres = _get_funcdesc(tpinfo->tinfo,method,&tinfo,&fdesc,&iname,&fname);
1533     if (hres) {
1534         ERR("Did not find typeinfo/funcdesc entry for method %d!\n",method);
1535         ITypeInfo_Release(tinfo);
1536         LeaveCriticalSection(&tpinfo->crit);
1537         return E_FAIL;
1538     }
1539
1540     if (!tpinfo->chanbuf)
1541     {
1542         WARN("Tried to use disconnected proxy\n");
1543         ITypeInfo_Release(tinfo);
1544         LeaveCriticalSection(&tpinfo->crit);
1545         return RPC_E_DISCONNECTED;
1546     }
1547
1548     if (relaydeb) {
1549        TRACE_(olerelay)("->");
1550         if (iname)
1551             TRACE_(olerelay)("%s:",relaystr(iname));
1552         if (fname)
1553             TRACE_(olerelay)("%s(%d)",relaystr(fname),method);
1554         else
1555             TRACE_(olerelay)("%d",method);
1556         TRACE_(olerelay)("(");
1557     }
1558     if (iname && fname && !lstrcmpW(iname,IDispatchW) && !lstrcmpW(fname,GetIDsOfNamesW))
1559         is_idispatch_getidsofnames = 1;
1560
1561     if (iname) SysFreeString(iname);
1562     if (fname) SysFreeString(fname);
1563
1564     memset(&buf,0,sizeof(buf));
1565     buf.iid = IID_IUnknown;
1566
1567     /* Special IDispatch::GetIDsOfNames() serializer */
1568     if (is_idispatch_getidsofnames) {
1569         hres = serialize_IDispatch_GetIDsOfNames(TRUE,relaydeb,args,&buf);
1570         if (hres != S_OK) {
1571             FIXME("serialize of IDispatch::GetIDsOfNames failed!\n");
1572             ITypeInfo_Release(tinfo);
1573             LeaveCriticalSection(&tpinfo->crit);
1574             return hres;
1575         }
1576         goto afterserialize;
1577     }
1578
1579     /* special QueryInterface serialize */
1580     if (method == 0) {
1581         xbuf_add(&buf,(LPBYTE)args[0],sizeof(IID));
1582         if (relaydeb) TRACE_(olerelay)("riid=%s,[out])",debugstr_guid((REFIID)args[0]));
1583         goto afterserialize;
1584     }
1585
1586     /* normal typelib driven serializing */
1587
1588     /* Need them for hack below */
1589     memset(names,0,sizeof(names));
1590     if (ITypeInfo_GetNames(tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames))
1591         nrofnames = 0;
1592     if (nrofnames > sizeof(names)/sizeof(names[0]))
1593         ERR("Need more names!\n");
1594
1595     xargs = args;
1596     for (i=0;i<fdesc->cParams;i++) {
1597         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1598         BOOL    isserialized = FALSE;
1599         if (relaydeb) {
1600             if (i) TRACE_(olerelay)(",");
1601             if (i+1<nrofnames && names[i+1])
1602                 TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1603         }
1604         /* No need to marshal other data than FIN and any VT_PTR. */
1605         if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN) && (elem->tdesc.vt != VT_PTR)) {
1606             xargs+=_argsize(elem->tdesc.vt);
1607             if (relaydeb) TRACE_(olerelay)("[out]");
1608             continue;
1609         }
1610         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1611             /* If the parameter is 'riid', we use it as interface IID
1612              * for a later ppvObject serialization.
1613              */
1614             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1615
1616             /* DISPPARAMS* needs special serializer */
1617             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1618                 hres = serialize_DISPPARAM_ptr(
1619                     tinfo,
1620                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1621                     relaydeb,
1622                     FALSE,
1623                     &elem->tdesc,
1624                     xargs,
1625                     &buf
1626                 );
1627                 isserialized = TRUE;
1628             }
1629             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1630                 hres = serialize_LPVOID_ptr(
1631                     tinfo,
1632                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1633                     relaydeb,
1634                     FALSE,
1635                     &elem->tdesc,
1636                     xargs,
1637                     &buf
1638                 );
1639                 if (hres == S_OK)
1640                     isserialized = TRUE;
1641             }
1642         }
1643         if (!isserialized)
1644             hres = serialize_param(
1645                 tinfo,
1646                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1647                 relaydeb,
1648                 FALSE,
1649                 &elem->tdesc,
1650                 xargs,
1651                 &buf
1652             );
1653
1654         if (hres) {
1655             ERR("Failed to serialize param, hres %lx\n",hres);
1656             break;
1657         }
1658         xargs+=_argsize(elem->tdesc.vt);
1659     }
1660     if (relaydeb) TRACE_(olerelay)(")");
1661
1662 afterserialize:
1663     memset(&msg,0,sizeof(msg));
1664     msg.cbBuffer = buf.curoff;
1665     msg.iMethod  = method;
1666     hres = IRpcChannelBuffer_GetBuffer(tpinfo->chanbuf,&msg,&(tpinfo->iid));
1667     if (hres) {
1668         ERR("RpcChannelBuffer GetBuffer failed, %lx\n",hres);
1669         LeaveCriticalSection(&tpinfo->crit);
1670         return hres;
1671     }
1672     memcpy(msg.Buffer,buf.base,buf.curoff);
1673     if (relaydeb) TRACE_(olerelay)("\n");
1674     hres = IRpcChannelBuffer_SendReceive(tpinfo->chanbuf,&msg,&status);
1675     if (hres) {
1676         ERR("RpcChannelBuffer SendReceive failed, %lx\n",hres);
1677         LeaveCriticalSection(&tpinfo->crit);
1678         return hres;
1679     }
1680
1681     if (relaydeb) TRACE_(olerelay)(" status = %08lx (",status);
1682     if (buf.base)
1683         buf.base = HeapReAlloc(GetProcessHeap(),0,buf.base,msg.cbBuffer);
1684     else
1685         buf.base = HeapAlloc(GetProcessHeap(),0,msg.cbBuffer);
1686     buf.size = msg.cbBuffer;
1687     memcpy(buf.base,msg.Buffer,buf.size);
1688     buf.curoff = 0;
1689
1690     /* Special IDispatch::GetIDsOfNames() deserializer */
1691     if (is_idispatch_getidsofnames) {
1692         hres = deserialize_IDispatch_GetIDsOfNames(FALSE,relaydeb,args,&buf);
1693         if (hres != S_OK) {
1694             FIXME("deserialize of IDispatch::GetIDsOfNames failed!\n");
1695             return hres;
1696         }
1697         goto after_deserialize;
1698     }
1699     /* Special QueryInterface deserializer */
1700     if (method == 0) {
1701         _unmarshal_interface(&buf,(REFIID)args[0],(LPUNKNOWN*)args[1]);
1702         if (relaydeb) TRACE_(olerelay)("[in],%p",*((DWORD**)args[1]));
1703         goto after_deserialize;
1704     }
1705
1706     /* generic deserializer using typelib description */
1707     xargs = args;
1708     status = S_OK;
1709     for (i=0;i<fdesc->cParams;i++) {
1710         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1711         BOOL    isdeserialized = FALSE;
1712
1713         if (relaydeb) {
1714             if (i) TRACE_(olerelay)(",");
1715             if (i+1<nrofnames && names[i+1]) TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1716         }
1717         /* No need to marshal other data than FOUT and any VT_PTR */
1718         if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT) && (elem->tdesc.vt != VT_PTR)) {
1719             xargs += _argsize(elem->tdesc.vt);
1720             if (relaydeb) TRACE_(olerelay)("[in]");
1721             continue;
1722         }
1723         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1724             /* If the parameter is 'riid', we use it as interface IID
1725              * for a later ppvObject serialization.
1726              */
1727             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1728
1729             /* deserialize DISPPARAM */
1730             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1731                 hres = deserialize_DISPPARAM_ptr(
1732                     tinfo,
1733                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1734                     relaydeb,
1735                     FALSE,
1736                     &(elem->tdesc),
1737                     xargs,
1738                     &buf
1739                 );
1740                 if (hres) {
1741                     ERR("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
1742                     break;
1743                 }
1744                 isdeserialized = TRUE;
1745             }
1746             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1747                 hres = deserialize_LPVOID_ptr(
1748                     tinfo,
1749                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1750                     relaydeb,
1751                     FALSE,
1752                     &elem->tdesc,
1753                     xargs,
1754                     &buf
1755                 );
1756                 if (hres == S_OK)
1757                     isdeserialized = TRUE;
1758             }
1759         }
1760         if (!isdeserialized)
1761             hres = deserialize_param(
1762                 tinfo,
1763                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1764                 relaydeb,
1765                 FALSE,
1766                 &(elem->tdesc),
1767                 xargs,
1768                 &buf
1769             );
1770         if (hres) {
1771             ERR("Failed to unmarshall param, hres %lx\n",hres);
1772             status = hres;
1773             break;
1774         }
1775         xargs += _argsize(elem->tdesc.vt);
1776     }
1777 after_deserialize:
1778     hres = xbuf_get(&buf, (LPBYTE)&remoteresult, sizeof(DWORD));
1779     if (hres != S_OK)
1780         return hres;
1781     if (relaydeb) TRACE_(olerelay)(") = %08lx\n", remoteresult);
1782
1783     if (status != S_OK) /* OLE/COM internal error */
1784         return status;
1785
1786     HeapFree(GetProcessHeap(),0,buf.base);
1787     ITypeInfo_Release(tinfo);
1788     LeaveCriticalSection(&tpinfo->crit);
1789     return remoteresult;
1790 }
1791
1792 HRESULT WINAPI ProxyIUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
1793 {
1794     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1795
1796     TRACE("(%s, %p)\n", debugstr_guid(riid), ppv);
1797
1798     if (proxy->outerunknown)
1799         return IUnknown_QueryInterface(proxy->outerunknown, riid, ppv);
1800
1801     FIXME("No interface\n");
1802     return E_NOINTERFACE;
1803 }
1804
1805 ULONG WINAPI ProxyIUnknown_AddRef(IUnknown *iface)
1806 {
1807     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1808
1809     TRACE("\n");
1810
1811     if (proxy->outerunknown)
1812         return IUnknown_AddRef(proxy->outerunknown);
1813
1814     return 2; /* FIXME */
1815 }
1816
1817 ULONG WINAPI ProxyIUnknown_Release(IUnknown *iface)
1818 {
1819     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1820
1821     TRACE("\n");
1822
1823     if (proxy->outerunknown)
1824         return IUnknown_Release(proxy->outerunknown);
1825
1826     return 1; /* FIXME */
1827 }
1828
1829 static HRESULT WINAPI
1830 PSFacBuf_CreateProxy(
1831     LPPSFACTORYBUFFER iface, IUnknown* pUnkOuter, REFIID riid,
1832     IRpcProxyBuffer **ppProxy, LPVOID *ppv)
1833 {
1834     HRESULT     hres;
1835     ITypeInfo   *tinfo;
1836     int         i, nroffuncs;
1837     FUNCDESC    *fdesc;
1838     TMProxyImpl *proxy;
1839
1840     TRACE("(...%s...)\n",debugstr_guid(riid));
1841     hres = _get_typeinfo_for_iid(riid,&tinfo);
1842     if (hres) {
1843         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
1844         return hres;
1845     }
1846     nroffuncs = _nroffuncs(tinfo);
1847     proxy = CoTaskMemAlloc(sizeof(TMProxyImpl));
1848     if (!proxy) return E_OUTOFMEMORY;
1849
1850     assert(sizeof(TMAsmProxy) == 12);
1851
1852     proxy->outerunknown = pUnkOuter;
1853     proxy->asmstubs = VirtualAlloc(NULL, sizeof(TMAsmProxy) * nroffuncs, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
1854     if (!proxy->asmstubs) {
1855         ERR("Could not commit pages for proxy thunks\n");
1856         CoTaskMemFree(proxy);
1857         return E_OUTOFMEMORY;
1858     }
1859
1860     InitializeCriticalSection(&proxy->crit);
1861
1862     proxy->lpvtbl = HeapAlloc(GetProcessHeap(),0,sizeof(LPBYTE)*nroffuncs);
1863     for (i=0;i<nroffuncs;i++) {
1864         TMAsmProxy      *xasm = proxy->asmstubs+i;
1865
1866         switch (i) {
1867         case 0:
1868                 proxy->lpvtbl[i] = ProxyIUnknown_QueryInterface;
1869                 break;
1870         case 1:
1871                 proxy->lpvtbl[i] = ProxyIUnknown_AddRef;
1872                 break;
1873         case 2:
1874                 proxy->lpvtbl[i] = ProxyIUnknown_Release;
1875                 break;
1876         default: {
1877                 int j;
1878                 /* nrofargs without This */
1879                 int nrofargs;
1880                 ITypeInfo *tinfo2;
1881                 hres = _get_funcdesc(tinfo,i,&tinfo2,&fdesc,NULL,NULL);
1882                 ITypeInfo_Release(tinfo2);
1883                 if (hres) {
1884                     ERR("GetFuncDesc %lx should not fail here.\n",hres);
1885                     return hres;
1886                 }
1887                 /* some args take more than 4 byte on the stack */
1888                 nrofargs = 0;
1889                 for (j=0;j<fdesc->cParams;j++)
1890                     nrofargs += _argsize(fdesc->lprgelemdescParam[j].tdesc.vt);
1891
1892                 if (fdesc->callconv != CC_STDCALL) {
1893                     ERR("calling convention is not stdcall????\n");
1894                     return E_FAIL;
1895                 }
1896 /* popl %eax    -       return ptr
1897  * pushl <nr>
1898  * pushl %eax
1899  * call xCall
1900  * lret <nr> (+4)
1901  *
1902  *
1903  * arg3 arg2 arg1 <method> <returnptr>
1904  */
1905                 xasm->popleax   = 0x58;
1906                 xasm->pushlval  = 0x6a;
1907                 xasm->nr        = i;
1908                 xasm->pushleax  = 0x50;
1909                 xasm->lcall     = 0xe8; /* relative jump */
1910                 xasm->xcall     = (DWORD)xCall;
1911                 xasm->xcall     -= (DWORD)&(xasm->lret);
1912                 xasm->lret      = 0xc2;
1913                 xasm->bytestopop= (nrofargs+2)*4; /* pop args, This, iMethod */
1914                 proxy->lpvtbl[i] = xasm;
1915                 break;
1916             }
1917         }
1918     }
1919     proxy->lpvtbl2      = &tmproxyvtable;
1920     /* 1 reference for the proxy and 1 for the object */
1921     proxy->ref          = 2;
1922     proxy->tinfo        = tinfo;
1923     memcpy(&proxy->iid,riid,sizeof(*riid));
1924     proxy->chanbuf      = 0;
1925     *ppv                = (LPVOID)proxy;
1926     *ppProxy            = (IRpcProxyBuffer *)&(proxy->lpvtbl2);
1927     return S_OK;
1928 }
1929
1930 typedef struct _TMStubImpl {
1931     const IRpcStubBufferVtbl   *lpvtbl;
1932     LONG                        ref;
1933
1934     LPUNKNOWN                   pUnk;
1935     ITypeInfo                   *tinfo;
1936     IID                         iid;
1937 } TMStubImpl;
1938
1939 static HRESULT WINAPI
1940 TMStubImpl_QueryInterface(LPRPCSTUBBUFFER iface, REFIID riid, LPVOID *ppv)
1941 {
1942     if (IsEqualIID(riid,&IID_IRpcStubBuffer)||IsEqualIID(riid,&IID_IUnknown)){
1943         *ppv = (LPVOID)iface;
1944         IRpcStubBuffer_AddRef(iface);
1945         return S_OK;
1946     }
1947     FIXME("%s, not supported IID.\n",debugstr_guid(riid));
1948     return E_NOINTERFACE;
1949 }
1950
1951 static ULONG WINAPI
1952 TMStubImpl_AddRef(LPRPCSTUBBUFFER iface)
1953 {
1954     TMStubImpl *This = (TMStubImpl *)iface;
1955     ULONG refCount = InterlockedIncrement(&This->ref);
1956
1957     TRACE("(%p)->(ref before=%lu)\n", This, refCount - 1);
1958
1959     return refCount;
1960 }
1961
1962 static ULONG WINAPI
1963 TMStubImpl_Release(LPRPCSTUBBUFFER iface)
1964 {
1965     TMStubImpl *This = (TMStubImpl *)iface;
1966     ULONG refCount = InterlockedDecrement(&This->ref);
1967
1968     TRACE("(%p)->(ref before=%lu)\n", This, refCount + 1);
1969
1970     if (!refCount)
1971     {
1972         IRpcStubBuffer_Disconnect(iface);
1973         CoTaskMemFree(This);
1974     }
1975     return refCount;
1976 }
1977
1978 static HRESULT WINAPI
1979 TMStubImpl_Connect(LPRPCSTUBBUFFER iface, LPUNKNOWN pUnkServer)
1980 {
1981     TMStubImpl *This = (TMStubImpl *)iface;
1982
1983     TRACE("(%p)->(%p)\n", This, pUnkServer);
1984
1985     IUnknown_AddRef(pUnkServer);
1986     This->pUnk = pUnkServer;
1987     return S_OK;
1988 }
1989
1990 static void WINAPI
1991 TMStubImpl_Disconnect(LPRPCSTUBBUFFER iface)
1992 {
1993     TMStubImpl *This = (TMStubImpl *)iface;
1994
1995     TRACE("(%p)->()\n", This);
1996
1997     IUnknown_Release(This->pUnk);
1998     This->pUnk = NULL;
1999     return;
2000 }
2001
2002 static HRESULT WINAPI
2003 TMStubImpl_Invoke(
2004     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf)
2005 {
2006     int         i;
2007     FUNCDESC    *fdesc;
2008     TMStubImpl *This = (TMStubImpl *)iface;
2009     HRESULT     hres;
2010     DWORD       *args, res, *xargs, nrofargs;
2011     marshal_state       buf;
2012     int         nrofnames;
2013     BSTR        names[10];
2014     BSTR        fname = NULL,iname = NULL;
2015     BOOL        is_idispatch_getidsofnames = 0;
2016     ITypeInfo   *tinfo;
2017
2018     memset(&buf,0,sizeof(buf));
2019     buf.size    = xmsg->cbBuffer;
2020     buf.base    = HeapAlloc(GetProcessHeap(), 0, xmsg->cbBuffer);
2021     memcpy(buf.base, xmsg->Buffer, xmsg->cbBuffer);
2022     buf.curoff  = 0;
2023     buf.iid     = IID_IUnknown;
2024
2025     TRACE("...\n");
2026     if (xmsg->iMethod == 0) { /* QI */
2027         IID             xiid;
2028         /* in: IID, out: <iface> */
2029
2030         xbuf_get(&buf,(LPBYTE)&xiid,sizeof(xiid));
2031         buf.curoff = 0;
2032         hres = _marshal_interface(&buf,&xiid,This->pUnk);
2033         xmsg->Buffer    = buf.base; /* Might have been reallocated */
2034         xmsg->cbBuffer  = buf.size;
2035         return hres;
2036     }
2037     hres = _get_funcdesc(This->tinfo,xmsg->iMethod,&tinfo,&fdesc,&iname,&fname);
2038     if (hres) {
2039         ERR("GetFuncDesc on method %ld failed with %lx\n",xmsg->iMethod,hres);
2040         return hres;
2041     }
2042
2043     if (iname && fname && !lstrcmpW(iname, IDispatchW) && !lstrcmpW(fname, GetIDsOfNamesW))
2044         is_idispatch_getidsofnames = 1;
2045
2046     if (iname) SysFreeString (iname);
2047     if (fname) SysFreeString (fname);
2048
2049     /* Need them for hack below */
2050     memset(names,0,sizeof(names));
2051     ITypeInfo_GetNames(tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
2052     if (nrofnames > sizeof(names)/sizeof(names[0])) {
2053         ERR("Need more names!\n");
2054     }
2055
2056     /*dump_FUNCDESC(fdesc);*/
2057     nrofargs = 0;
2058     for (i=0;i<fdesc->cParams;i++)
2059         nrofargs += _argsize(fdesc->lprgelemdescParam[i].tdesc.vt);
2060     args = HeapAlloc(GetProcessHeap(),0,(nrofargs+1)*sizeof(DWORD));
2061     if (!args) return E_OUTOFMEMORY;
2062
2063     if (is_idispatch_getidsofnames) {
2064         hres = deserialize_IDispatch_GetIDsOfNames(TRUE,FALSE,args+1,&buf);
2065         if (hres != S_OK) {
2066             FIXME("deserialize_IDispatch_GetIDsOfNames failed!\n");
2067             return hres;
2068         }
2069         xargs = args+1+5;
2070         goto afterdeserialize;
2071     }
2072
2073     /* Allocate all stuff used by call. */
2074     xargs = args+1;
2075     for (i=0;i<fdesc->cParams;i++) {
2076         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
2077         BOOL            isdeserialized = FALSE;
2078
2079         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
2080             /* If the parameter is 'riid', we use it as interface IID
2081              * for a later ppvObject serialization.
2082              */
2083             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
2084
2085             /* deserialize DISPPARAM */
2086             if (!lstrcmpW(names[i+1],pdispparamsW)) {
2087                 hres = deserialize_DISPPARAM_ptr(
2088                     tinfo,
2089                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
2090                     FALSE,
2091                     TRUE,
2092                     &(elem->tdesc),
2093                     xargs,
2094                     &buf
2095                 );
2096                 if (hres) {
2097                     ERR("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
2098                     break;
2099                 }
2100                 isdeserialized = TRUE;
2101             }
2102             if (!lstrcmpW(names[i+1],ppvObjectW)) {
2103                 hres = deserialize_LPVOID_ptr(
2104                     tinfo,
2105                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
2106                     FALSE,
2107                     TRUE,
2108                     &elem->tdesc,
2109                     xargs,
2110                     &buf
2111                 );
2112                 if (hres == S_OK)
2113                     isdeserialized = TRUE;
2114             }
2115         }
2116         if (!isdeserialized)
2117             hres = deserialize_param(
2118                 tinfo,
2119                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
2120                 FALSE,
2121                 TRUE,
2122                 &(elem->tdesc),
2123                 xargs,
2124                 &buf
2125             );
2126         xargs += _argsize(elem->tdesc.vt);
2127         if (hres) {
2128             ERR("Failed to deserialize param %s, hres %lx\n",relaystr(names[i+1]),hres);
2129             break;
2130         }
2131     }
2132 afterdeserialize:
2133     hres = IUnknown_QueryInterface(This->pUnk,&(This->iid),(LPVOID*)&(args[0]));
2134     if (hres) {
2135         ERR("Does not support iface %s, returning %lx\n",debugstr_guid(&(This->iid)), hres);
2136         return hres;
2137     }
2138     res = _invoke(
2139         (*((FARPROC**)args[0]))[fdesc->oVft/4],
2140         fdesc->callconv,
2141         (xargs-args),
2142         args
2143     );
2144     IUnknown_Release((LPUNKNOWN)args[0]);
2145     buf.curoff = 0;
2146
2147     /* special IDispatch::GetIDsOfNames serializer */
2148     if (is_idispatch_getidsofnames) {
2149         hres = serialize_IDispatch_GetIDsOfNames(FALSE,FALSE,args+1,&buf);
2150         if (hres != S_OK) {
2151             FIXME("serialize of IDispatch::GetIDsOfNames failed!\n");
2152             return hres;
2153         }
2154         goto afterserialize;
2155     }
2156     xargs = args+1;
2157     for (i=0;i<fdesc->cParams;i++) {
2158         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
2159         BOOL            isserialized = FALSE;
2160
2161         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
2162             /* If the parameter is 'riid', we use it as interface IID
2163              * for a later ppvObject serialization.
2164              */
2165             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
2166
2167             /* DISPPARAMS* needs special serializer */
2168             if (!lstrcmpW(names[i+1],pdispparamsW)) {
2169                 hres = serialize_DISPPARAM_ptr(
2170                     tinfo,
2171                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
2172                     FALSE,
2173                     TRUE,
2174                     &elem->tdesc,
2175                     xargs,
2176                     &buf
2177                 );
2178                 isserialized = TRUE;
2179             }
2180             if (!lstrcmpW(names[i+1],ppvObjectW)) {
2181                 hres = serialize_LPVOID_ptr(
2182                     tinfo,
2183                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
2184                     FALSE,
2185                     TRUE,
2186                     &elem->tdesc,
2187                     xargs,
2188                     &buf
2189                 );
2190                 if (hres == S_OK)
2191                     isserialized = TRUE;
2192             }
2193         }
2194         if (!isserialized)
2195             hres = serialize_param(
2196                tinfo,
2197                elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
2198                FALSE,
2199                TRUE,
2200                &elem->tdesc,
2201                xargs,
2202                &buf
2203             );
2204         xargs += _argsize(elem->tdesc.vt);
2205         if (hres) {
2206             ERR("Failed to stuballoc param, hres %lx\n",hres);
2207             break;
2208         }
2209     }
2210 afterserialize:
2211     hres = xbuf_add (&buf, (LPBYTE)&res, sizeof(DWORD));
2212     if (hres != S_OK)
2213         return hres;
2214
2215     ITypeInfo_Release(tinfo);
2216     xmsg->cbBuffer      = buf.curoff;
2217     I_RpcGetBuffer((RPC_MESSAGE *)xmsg);
2218     memcpy(xmsg->Buffer, buf.base, buf.curoff);
2219     HeapFree(GetProcessHeap(),0,args);
2220     return S_OK;
2221 }
2222
2223 static LPRPCSTUBBUFFER WINAPI
2224 TMStubImpl_IsIIDSupported(LPRPCSTUBBUFFER iface, REFIID riid) {
2225     FIXME("Huh (%s)?\n",debugstr_guid(riid));
2226     return NULL;
2227 }
2228
2229 static ULONG WINAPI
2230 TMStubImpl_CountRefs(LPRPCSTUBBUFFER iface) {
2231     TMStubImpl *This = (TMStubImpl *)iface;
2232
2233     return This->ref; /*FIXME? */
2234 }
2235
2236 static HRESULT WINAPI
2237 TMStubImpl_DebugServerQueryInterface(LPRPCSTUBBUFFER iface, LPVOID *ppv) {
2238     return E_NOTIMPL;
2239 }
2240
2241 static void WINAPI
2242 TMStubImpl_DebugServerRelease(LPRPCSTUBBUFFER iface, LPVOID ppv) {
2243     return;
2244 }
2245
2246 static const IRpcStubBufferVtbl tmstubvtbl = {
2247     TMStubImpl_QueryInterface,
2248     TMStubImpl_AddRef,
2249     TMStubImpl_Release,
2250     TMStubImpl_Connect,
2251     TMStubImpl_Disconnect,
2252     TMStubImpl_Invoke,
2253     TMStubImpl_IsIIDSupported,
2254     TMStubImpl_CountRefs,
2255     TMStubImpl_DebugServerQueryInterface,
2256     TMStubImpl_DebugServerRelease
2257 };
2258
2259 static HRESULT WINAPI
2260 PSFacBuf_CreateStub(
2261     LPPSFACTORYBUFFER iface, REFIID riid,IUnknown *pUnkServer,
2262     IRpcStubBuffer** ppStub
2263 ) {
2264     HRESULT hres;
2265     ITypeInfo   *tinfo;
2266     TMStubImpl  *stub;
2267
2268     TRACE("(%s,%p,%p)\n",debugstr_guid(riid),pUnkServer,ppStub);
2269     hres = _get_typeinfo_for_iid(riid,&tinfo);
2270     if (hres) {
2271         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
2272         return hres;
2273     }
2274     stub = CoTaskMemAlloc(sizeof(TMStubImpl));
2275     if (!stub)
2276         return E_OUTOFMEMORY;
2277     stub->lpvtbl        = &tmstubvtbl;
2278     stub->ref           = 1;
2279     stub->tinfo         = tinfo;
2280     memcpy(&(stub->iid),riid,sizeof(*riid));
2281     hres = IRpcStubBuffer_Connect((LPRPCSTUBBUFFER)stub,pUnkServer);
2282     *ppStub             = (LPRPCSTUBBUFFER)stub;
2283     TRACE("IRpcStubBuffer: %p\n", stub);
2284     if (hres)
2285         ERR("Connect to pUnkServer failed?\n");
2286     return hres;
2287 }
2288
2289 static const IPSFactoryBufferVtbl psfacbufvtbl = {
2290     PSFacBuf_QueryInterface,
2291     PSFacBuf_AddRef,
2292     PSFacBuf_Release,
2293     PSFacBuf_CreateProxy,
2294     PSFacBuf_CreateStub
2295 };
2296
2297 /* This is the whole PSFactoryBuffer object, just the vtableptr */
2298 static const IPSFactoryBufferVtbl *lppsfac = &psfacbufvtbl;
2299
2300 /***********************************************************************
2301  *           DllGetClassObject [OLE32.63]
2302  */
2303 HRESULT WINAPI
2304 TypeLibFac_DllGetClassObject(REFCLSID rclsid, REFIID iid,LPVOID *ppv)
2305 {
2306     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)) {
2307         *ppv = &lppsfac;
2308         return S_OK;
2309     }
2310     return E_NOINTERFACE;
2311 }