dlls/oleaut32/tmarshal.c

   1 /*
   2  *      TYPELIB Marshaler
   3  *
   4  *      Copyright 2002  Marcus Meissner
   5  *
   6  * The olerelay debug channel allows you to see calls marshalled by
   7  * the typelib marshaller. It is not a generic COM relaying system.
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  22  */
  23
  24 #include "config.h"
  25
  26 #include <assert.h>
  27 #include <stdlib.h>
  28 #include <string.h>
  29 #include <stdarg.h>
  30 #include <stdio.h>
  31 #include <ctype.h>
  32
  33 #define COBJMACROS
  34 #define NONAMELESSUNION
  35 #define NONAMELESSSTRUCT
  36
  37 #include "winerror.h"
  38 #include "windef.h"
  39 #include "winbase.h"
  40 #include "winnls.h"
  41 #include "winreg.h"
  42 #include "winuser.h"
  43
  44 #include "ole2.h"
  45 #include "typelib.h"
  46 #include "wine/debug.h"
  47
  48 static const WCHAR riidW[5] = {'r','i','i','d',0};
  49 static const WCHAR pdispparamsW[] = {'p','d','i','s','p','p','a','r','a','m','s',0};
  50 static const WCHAR ppvObjectW[] = {'p','p','v','O','b','j','e','c','t',0};
  51 static const WCHAR IDispatchW[] = { 'I','D','i','s','p','a','t','c','h',0};
  52 static const WCHAR GetIDsOfNamesW[] = { 'G','e','t','I','D','s','O','f','N','a','m','e','s',0};
  53
  54 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  55 WINE_DECLARE_DEBUG_CHANNEL(olerelay);
  56
  57 #define ICOM_THIS_MULTI(impl,field,iface) impl* const This=(impl*)((char*)(iface) - offsetof(impl,field))
  58
  59 typedef struct _marshal_state {
  60     LPBYTE      base;
  61     int         size;
  62     int         curoff;
  63
  64     BOOL        thisisiid;
  65     IID         iid;    /* HACK: for VT_VOID */
  66 } marshal_state;
  67
  68 /* used in the olerelay code to avoid having the L"" stuff added by debugstr_w */
  69 static char *relaystr(WCHAR *in) {
  70     char *tmp = (char *)debugstr_w(in);
  71     tmp += 2;
  72     tmp[strlen(tmp)-1] = '\0';
  73     return tmp;
  74 }
  75
  76 static HRESULT
  77 xbuf_add(marshal_state *buf, LPBYTE stuff, DWORD size) {
  78     while (buf->size - buf->curoff < size) {
  79         if (buf->base) {
  80             buf->size += 100;
  81             buf->base = HeapReAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,buf->base,buf->size);
  82             if (!buf->base)
  83                 return E_OUTOFMEMORY;
  84         } else {
  85             buf->base = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,32);
  86             buf->size = 32;
  87             if (!buf->base)
  88                 return E_OUTOFMEMORY;
  89         }
  90     }
  91     memcpy(buf->base+buf->curoff,stuff,size);
  92     buf->curoff += size;
  93     return S_OK;
  94 }
  95
  96 static HRESULT
  97 xbuf_get(marshal_state *buf, LPBYTE stuff, DWORD size) {
  98     if (buf->size < buf->curoff+size) return E_FAIL;
  99     memcpy(stuff,buf->base+buf->curoff,size);
 100     buf->curoff += size;
 101     return S_OK;
 102 }
 103
 104 static HRESULT
 105 xbuf_skip(marshal_state *buf, DWORD size) {
 106     if (buf->size < buf->curoff+size) return E_FAIL;
 107     buf->curoff += size;
 108     return S_OK;
 109 }
 110
 111 static HRESULT
 112 _unmarshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN *pUnk) {
 113     IStream             *pStm;
 114     ULARGE_INTEGER      newpos;
 115     LARGE_INTEGER       seekto;
 116     ULONG               res;
 117     HRESULT             hres;
 118     DWORD               xsize;
 119
 120     TRACE("...%s...\n",debugstr_guid(riid));
 121
 122     *pUnk = NULL;
 123     hres = xbuf_get(buf,(LPBYTE)&xsize,sizeof(xsize));
 124     if (hres) {
 125         ERR("xbuf_get failed\n");
 126         return hres;
 127     }
 128
 129     if (xsize == 0) return S_OK;
 130
 131     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 132     if (hres) {
 133         ERR("Stream create failed %lx\n",hres);
 134         return hres;
 135     }
 136
 137     hres = IStream_Write(pStm,buf->base+buf->curoff,xsize,&res);
 138     if (hres) {
 139         ERR("stream write %lx\n",hres);
 140         return hres;
 141     }
 142
 143     memset(&seekto,0,sizeof(seekto));
 144     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 145     if (hres) {
 146         ERR("Failed Seek %lx\n",hres);
 147         return hres;
 148     }
 149
 150     hres = CoUnmarshalInterface(pStm,riid,(LPVOID*)pUnk);
 151     if (hres) {
 152         ERR("Unmarshalling interface %s failed with %lx\n",debugstr_guid(riid),hres);
 153         return hres;
 154     }
 155
 156     IStream_Release(pStm);
 157     return xbuf_skip(buf,xsize);
 158 }
 159
 160 static HRESULT
 161 _marshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN pUnk) {
 162     LPUNKNOWN           newiface = NULL;
 163     LPBYTE              tempbuf = NULL;
 164     IStream             *pStm = NULL;
 165     STATSTG             ststg;
 166     ULARGE_INTEGER      newpos;
 167     LARGE_INTEGER       seekto;
 168     ULONG               res;
 169     DWORD               xsize;
 170     HRESULT             hres;
 171
 172     hres = E_FAIL;
 173     if (!pUnk) {
 174         ERR("pUnk is NULL?\n");
 175         goto fail;
 176     }
 177
 178     TRACE("...%s...\n",debugstr_guid(riid));
 179     hres = IUnknown_QueryInterface(pUnk,riid,(LPVOID*)&newiface);
 180     if (hres) {
 181         WARN("%p does not support iface %s\n",pUnk,debugstr_guid(riid));
 182         goto fail;
 183     }
 184
 185     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 186     if (hres) {
 187         ERR("Stream create failed %lx\n",hres);
 188         goto fail;
 189     }
 190
 191     hres = CoMarshalInterface(pStm,riid,newiface,0,NULL,0);
 192     if (hres) {
 193         ERR("Marshalling interface %s failed with %lx\n", debugstr_guid(riid), hres);
 194         goto fail;
 195     }
 196
 197     hres = IStream_Stat(pStm,&ststg,0);
 198     if (hres) {
 199         ERR("Stream stat failed\n");
 200         goto fail;
 201     }
 202
 203     tempbuf = HeapAlloc(GetProcessHeap(), 0, ststg.cbSize.u.LowPart);
 204     memset(&seekto,0,sizeof(seekto));
 205     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 206     if (hres) {
 207         ERR("Failed Seek %lx\n",hres);
 208         goto fail;
 209     }
 210
 211     hres = IStream_Read(pStm,tempbuf,ststg.cbSize.u.LowPart,&res);
 212     if (hres) {
 213         ERR("Failed Read %lx\n",hres);
 214         goto fail;
 215     }
 216
 217     xsize = ststg.cbSize.u.LowPart;
 218     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 219     hres = xbuf_add(buf,tempbuf,ststg.cbSize.u.LowPart);
 220
 221     HeapFree(GetProcessHeap(),0,tempbuf);
 222     IUnknown_Release(newiface);
 223     IStream_Release(pStm);
 224
 225     return hres;
 226
 227 fail:
 228     xsize = 0;
 229     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 230     if (pStm) IUnknown_Release(pStm);
 231     if (newiface) IUnknown_Release(newiface);
 232     HeapFree(GetProcessHeap(), 0, tempbuf);
 233     return hres;
 234 }
 235
 236 /********************* OLE Proxy/Stub Factory ********************************/
 237 static HRESULT WINAPI
 238 PSFacBuf_QueryInterface(LPPSFACTORYBUFFER iface, REFIID iid, LPVOID *ppv) {
 239     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)||IsEqualIID(iid,&IID_IUnknown)) {
 240         *ppv = (LPVOID)iface;
 241         /* No ref counting, static class */
 242         return S_OK;
 243     }
 244     FIXME("(%s) unknown IID?\n",debugstr_guid(iid));
 245     return E_NOINTERFACE;
 246 }
 247
 248 static ULONG WINAPI PSFacBuf_AddRef(LPPSFACTORYBUFFER iface) { return 2; }
 249 static ULONG WINAPI PSFacBuf_Release(LPPSFACTORYBUFFER iface) { return 1; }
 250
 251 static HRESULT
 252 _get_typeinfo_for_iid(REFIID riid, ITypeInfo**ti) {
 253     HRESULT     hres;
 254     HKEY        ikey;
 255     char        tlguid[200],typelibkey[300],interfacekey[300],ver[100];
 256     char        tlfn[260];
 257     OLECHAR     tlfnW[260];
 258     DWORD       tlguidlen, verlen, type, tlfnlen;
 259     ITypeLib    *tl;
 260
 261     sprintf( interfacekey, "Interface\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\Typelib",
 262         riid->Data1, riid->Data2, riid->Data3,
 263         riid->Data4[0], riid->Data4[1], riid->Data4[2], riid->Data4[3],
 264         riid->Data4[4], riid->Data4[5], riid->Data4[6], riid->Data4[7]
 265     );
 266
 267     if (RegOpenKeyA(HKEY_CLASSES_ROOT,interfacekey,&ikey)) {
 268         ERR("No %s key found.\n",interfacekey);
 269         return E_FAIL;
 270     }
 271     type = (1<<REG_SZ);
 272     tlguidlen = sizeof(tlguid);
 273     if (RegQueryValueExA(ikey,NULL,NULL,&type,tlguid,&tlguidlen)) {
 274         ERR("Getting typelib guid failed.\n");
 275         RegCloseKey(ikey);
 276         return E_FAIL;
 277     }
 278     type = (1<<REG_SZ);
 279     verlen = sizeof(ver);
 280     if (RegQueryValueExA(ikey,"Version",NULL,&type,ver,&verlen)) {
 281         ERR("Could not get version value?\n");
 282         RegCloseKey(ikey);
 283         return E_FAIL;
 284     }
 285     RegCloseKey(ikey);
 286     sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win32",tlguid,ver);
 287     tlfnlen = sizeof(tlfn);
 288     if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 289         ERR("Could not get typelib fn?\n");
 290         return E_FAIL;
 291     }
 292     MultiByteToWideChar(CP_ACP, 0, tlfn, -1, tlfnW, -1);
 293     hres = LoadTypeLib(tlfnW,&tl);
 294     if (hres) {
 295         ERR("Failed to load typelib for %s, but it should be there.\n",debugstr_guid(riid));
 296         return hres;
 297     }
 298     hres = ITypeLib_GetTypeInfoOfGuid(tl,riid,ti);
 299     if (hres) {
 300         ERR("typelib does not contain info for %s?\n",debugstr_guid(riid));
 301         ITypeLib_Release(tl);
 302         return hres;
 303     }
 304     /* FIXME: do this?  ITypeLib_Release(tl); */
 305     return hres;
 306 }
 307
 308 /* Determine nr of functions. Since we use the toplevel interface and all
 309  * inherited ones have lower numbers, we are ok to not to descent into
 310  * the inheritance tree I think.
 311  */
 312 static int _nroffuncs(ITypeInfo *tinfo) {
 313     int         n, max = 0;
 314     FUNCDESC    *fdesc;
 315     HRESULT     hres;
 316
 317     n=0;
 318     while (1) {
 319         hres = ITypeInfo_GetFuncDesc(tinfo,n,&fdesc);
 320         if (hres)
 321             return max+1;
 322         if (fdesc->oVft/4 > max)
 323             max = fdesc->oVft/4;
 324         n++;
 325     }
 326     /*NOTREACHED*/
 327 }
 328
 329 #ifdef __i386__
 330
 331 #include "pshpack1.h"
 332
 333 typedef struct _TMAsmProxy {
 334     BYTE        popleax;
 335     BYTE        pushlval;
 336     BYTE        nr;
 337     BYTE        pushleax;
 338     BYTE        lcall;
 339     DWORD       xcall;
 340     BYTE        lret;
 341     WORD        bytestopop;
 342 } TMAsmProxy;
 343
 344 #include "poppack.h"
 345
 346 #else /* __i386__ */
 347 # error You need to implement stubless proxies for your architecture
 348 #endif
 349
 350 typedef struct _TMProxyImpl {
 351     LPVOID                              *lpvtbl;
 352     IRpcProxyBufferVtbl *lpvtbl2;
 353     ULONG                               ref;
 354
 355     TMAsmProxy                          *asmstubs;
 356     ITypeInfo*                          tinfo;
 357     IRpcChannelBuffer*                  chanbuf;
 358     IID                                 iid;
 359     CRITICAL_SECTION    crit;
 360     IUnknown                            *outerunknown;
 361 } TMProxyImpl;
 362
 363 static HRESULT WINAPI
 364 TMProxyImpl_QueryInterface(LPRPCPROXYBUFFER iface, REFIID riid, LPVOID *ppv)
 365 {
 366     TRACE("()\n");
 367     if (IsEqualIID(riid,&IID_IUnknown)||IsEqualIID(riid,&IID_IRpcProxyBuffer)) {
 368         *ppv = (LPVOID)iface;
 369         IRpcProxyBuffer_AddRef(iface);
 370         return S_OK;
 371     }
 372     FIXME("no interface for %s\n",debugstr_guid(riid));
 373     return E_NOINTERFACE;
 374 }
 375
 376 static ULONG WINAPI
 377 TMProxyImpl_AddRef(LPRPCPROXYBUFFER iface)
 378 {
 379     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 380     ULONG refCount = InterlockedIncrement(&This->ref);
 381
 382     TRACE("(%p)->(ref before=%lu)\n",This, refCount - 1);
 383
 384     return refCount;
 385 }
 386
 387 static ULONG WINAPI
 388 TMProxyImpl_Release(LPRPCPROXYBUFFER iface)
 389 {
 390     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 391     ULONG refCount = InterlockedDecrement(&This->ref);
 392
 393     TRACE("(%p)->(ref before=%lu)\n",This, refCount + 1);
 394
 395     if (!refCount)
 396     {
 397         DeleteCriticalSection(&This->crit);
 398         if (This->chanbuf) IRpcChannelBuffer_Release(This->chanbuf);
 399         VirtualFree(This->asmstubs, 0, MEM_RELEASE);
 400         CoTaskMemFree(This);
 401     }
 402     return refCount;
 403 }
 404
 405 static HRESULT WINAPI
 406 TMProxyImpl_Connect(
 407     LPRPCPROXYBUFFER iface,IRpcChannelBuffer* pRpcChannelBuffer)
 408 {
 409     ICOM_THIS_MULTI(TMProxyImpl, lpvtbl2, iface);
 410
 411     TRACE("(%p)\n", pRpcChannelBuffer);
 412
 413     EnterCriticalSection(&This->crit);
 414
 415     IRpcChannelBuffer_AddRef(pRpcChannelBuffer);
 416     This->chanbuf = pRpcChannelBuffer;
 417
 418     LeaveCriticalSection(&This->crit);
 419
 420     return S_OK;
 421 }
 422
 423 static void WINAPI
 424 TMProxyImpl_Disconnect(LPRPCPROXYBUFFER iface)
 425 {
 426     ICOM_THIS_MULTI(TMProxyImpl, lpvtbl2, iface);
 427
 428     TRACE("()\n");
 429
 430     EnterCriticalSection(&This->crit);
 431
 432     IRpcChannelBuffer_Release(This->chanbuf);
 433     This->chanbuf = NULL;
 434
 435     LeaveCriticalSection(&This->crit);
 436 }
 437
 438
 439 static IRpcProxyBufferVtbl tmproxyvtable = {
 440     TMProxyImpl_QueryInterface,
 441     TMProxyImpl_AddRef,
 442     TMProxyImpl_Release,
 443     TMProxyImpl_Connect,
 444     TMProxyImpl_Disconnect
 445 };
 446
 447 /* how much space do we use on stack in DWORD steps. */
 448 int
 449 _argsize(DWORD vt) {
 450     switch (vt) {
 451     case VT_DATE:
 452         return sizeof(DATE)/sizeof(DWORD);
 453     case VT_VARIANT:
 454         return (sizeof(VARIANT)+3)/sizeof(DWORD);
 455     default:
 456         return 1;
 457     }
 458 }
 459
 460 static int
 461 _xsize(TYPEDESC *td) {
 462     switch (td->vt) {
 463     case VT_DATE:
 464         return sizeof(DATE);
 465     case VT_VARIANT:
 466         return sizeof(VARIANT)+3;
 467     case VT_CARRAY: {
 468         int i, arrsize = 1;
 469         ARRAYDESC *adesc = td->u.lpadesc;
 470
 471         for (i=0;i<adesc->cDims;i++)
 472             arrsize *= adesc->rgbounds[i].cElements;
 473         return arrsize*_xsize(&adesc->tdescElem);
 474     }
 475     case VT_UI2:
 476     case VT_I2:
 477         return 2;
 478     case VT_UI1:
 479     case VT_I1:
 480         return 1;
 481     default:
 482         return 4;
 483     }
 484 }
 485
 486 static HRESULT
 487 serialize_param(
 488     ITypeInfo           *tinfo,
 489     BOOL                writeit,
 490     BOOL                debugout,
 491     BOOL                dealloc,
 492     TYPEDESC            *tdesc,
 493     DWORD               *arg,
 494     marshal_state       *buf)
 495 {
 496     HRESULT hres = S_OK;
 497
 498     TRACE("(tdesc.vt %d)\n",tdesc->vt);
 499
 500     switch (tdesc->vt) {
 501     case VT_EMPTY: /* nothing. empty variant for instance */
 502         return S_OK;
 503     case VT_BOOL:
 504     case VT_ERROR:
 505     case VT_UINT:
 506     case VT_I4:
 507     case VT_I2:
 508     case VT_I1:
 509     case VT_R4:
 510     case VT_UI4:
 511     case VT_UI2:
 512     case VT_UI1:
 513         hres = S_OK;
 514         if (debugout) TRACE_(olerelay)("%lx",*arg);
 515         if (writeit)
 516             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 517         return hres;
 518     case VT_VARIANT: {
 519         TYPEDESC        tdesc2;
 520         VARIANT         *vt = (VARIANT*)arg;
 521         DWORD           vttype = V_VT(vt);
 522
 523         if (debugout) TRACE_(olerelay)("Vt(%ld)(",vttype);
 524         tdesc2.vt = vttype;
 525         if (writeit) {
 526             hres = xbuf_add(buf,(LPBYTE)&vttype,sizeof(vttype));
 527             if (hres) return hres;
 528         }
 529         /* need to recurse since we need to free the stuff */
 530         hres = serialize_param(tinfo,writeit,debugout,dealloc,&tdesc2,&(V_I4(vt)),buf);
 531         if (debugout) TRACE_(olerelay)(")");
 532         return hres;
 533     }
 534     case VT_BSTR|VT_BYREF: {
 535         if (debugout) TRACE_(olerelay)("[byref]'%s'", *arg ? relaystr(*((BSTR*)*arg)) : "<bstr NULL>");
 536         if (writeit) {
 537             /* ptr to ptr to magic widestring, basically */
 538             BSTR *bstr = (BSTR *) *arg;
 539             if (!bstr) {
 540                 /* -1 means "null string" which is equivalent to empty string */
 541                 DWORD fakelen = -1;
 542                 xbuf_add(buf, (LPBYTE)&fakelen,4);
 543             } else {
 544                 /* BSTRs store the length behind the first character */
 545                 DWORD *len = ((DWORD *)(*bstr))-1;
 546                 hres = xbuf_add(buf, (LPBYTE) len, *len + 4);
 547                 if (hres) return hres;
 548             }
 549         }
 550
 551         if (dealloc && arg) {
 552             BSTR *str = *((BSTR **)arg);
 553             SysFreeString(*str);
 554         }
 555         return S_OK;
 556     }
 557
 558     case VT_BSTR: {
 559         if (debugout) {
 560             if (arg)
 561                     TRACE_(olerelay)("%s",relaystr((BSTR)*arg));
 562             else
 563                     TRACE_(olerelay)("<bstr NULL>");
 564         }
 565         if (writeit) {
 566             if (!*arg) {
 567                 DWORD fakelen = -1;
 568                 hres = xbuf_add(buf,(LPBYTE)&fakelen,4);
 569                 if (hres)
 570                     return hres;
 571             } else {
 572                 DWORD *bstr = ((DWORD*)(*arg))-1;
 573
 574                 hres = xbuf_add(buf,(LPBYTE)bstr,bstr[0]+4);
 575                 if (hres)
 576                     return hres;
 577             }
 578         }
 579
 580         if (dealloc && arg)
 581             SysFreeString((BSTR)*arg);
 582         return S_OK;
 583     }
 584     case VT_PTR: {
 585         DWORD cookie;
 586
 587         if (debugout) TRACE_(olerelay)("*");
 588         /* Write always, so the other side knows when it gets a NULL pointer.
 589          */
 590         cookie = *arg ? 0x42424242 : 0;
 591         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 592         if (hres)
 593             return hres;
 594         if (!*arg) {
 595             if (debugout) TRACE_(olerelay)("NULL");
 596             return S_OK;
 597         }
 598         hres = serialize_param(tinfo,writeit,debugout,dealloc,tdesc->u.lptdesc,(DWORD*)*arg,buf);
 599         if (dealloc) HeapFree(GetProcessHeap(),0,(LPVOID)arg);
 600         return hres;
 601     }
 602     case VT_UNKNOWN:
 603         if (debugout) TRACE_(olerelay)("unk(0x%lx)",*arg);
 604         if (writeit)
 605             hres = _marshal_interface(buf,&IID_IUnknown,(LPUNKNOWN)*arg);
 606         return hres;
 607     case VT_DISPATCH:
 608         if (debugout) TRACE_(olerelay)("idisp(0x%lx)",*arg);
 609         if (writeit)
 610             hres = _marshal_interface(buf,&IID_IDispatch,(LPUNKNOWN)*arg);
 611         return hres;
 612     case VT_VOID:
 613         if (debugout) TRACE_(olerelay)("<void>");
 614         return S_OK;
 615     case VT_USERDEFINED: {
 616         ITypeInfo       *tinfo2;
 617         TYPEATTR        *tattr;
 618
 619         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 620         if (hres) {
 621             ERR("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
 622             return hres;
 623         }
 624         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 625         switch (tattr->typekind) {
 626         case TKIND_DISPATCH:
 627         case TKIND_INTERFACE:
 628             if (writeit)
 629                hres=_marshal_interface(buf,&(tattr->guid),(LPUNKNOWN)arg);
 630             break;
 631         case TKIND_RECORD: {
 632             int i;
 633             if (debugout) TRACE_(olerelay)("{");
 634             for (i=0;i<tattr->cVars;i++) {
 635                 VARDESC *vdesc;
 636                 ELEMDESC *elem2;
 637                 TYPEDESC *tdesc2;
 638
 639                 hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 640                 if (hres) {
 641                     ERR("Could not get vardesc of %d\n",i);
 642                     return hres;
 643                 }
 644                 /* Need them for hack below */
 645                 /*
 646                 memset(names,0,sizeof(names));
 647                 hres = ITypeInfo_GetNames(tinfo2,vdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
 648                 if (nrofnames > sizeof(names)/sizeof(names[0])) {
 649                     ERR("Need more names!\n");
 650                 }
 651                 if (!hres && debugout)
 652                     TRACE_(olerelay)("%s=",relaystr(names[0]));
 653                 */
 654                 elem2 = &vdesc->elemdescVar;
 655                 tdesc2 = &elem2->tdesc;
 656                 hres = serialize_param(
 657                     tinfo2,
 658                     writeit,
 659                     debugout,
 660                     dealloc,
 661                     tdesc2,
 662                     (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
 663                     buf
 664                 );
 665                 if (hres!=S_OK)
 666                     return hres;
 667                 if (debugout && (i<(tattr->cVars-1)))
 668                     TRACE_(olerelay)(",");
 669             }
 670             if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
 671                 memcpy(&(buf->iid),arg,sizeof(buf->iid));
 672             if (debugout) TRACE_(olerelay)("}");
 673             break;
 674         }
 675         default:
 676             FIXME("Unhandled typekind %d\n",tattr->typekind);
 677             hres = E_FAIL;
 678             break;
 679         }
 680         ITypeInfo_Release(tinfo2);
 681         return hres;
 682     }
 683     case VT_CARRAY: {
 684         ARRAYDESC *adesc = tdesc->u.lpadesc;
 685         int i, arrsize = 1;
 686
 687         if (debugout) TRACE_(olerelay)("carr");
 688         for (i=0;i<adesc->cDims;i++) {
 689             if (debugout) TRACE_(olerelay)("[%ld]",adesc->rgbounds[i].cElements);
 690             arrsize *= adesc->rgbounds[i].cElements;
 691         }
 692         if (debugout) TRACE_(olerelay)("(vt %d)",adesc->tdescElem.vt);
 693         if (debugout) TRACE_(olerelay)("[");
 694         for (i=0;i<arrsize;i++) {
 695             hres = serialize_param(tinfo, writeit, debugout, dealloc, &adesc->tdescElem, (DWORD*)((LPBYTE)arg+i*_xsize(&adesc->tdescElem)), buf);
 696             if (hres)
 697                 return hres;
 698             if (debugout && (i<arrsize-1)) TRACE_(olerelay)(",");
 699         }
 700         if (debugout) TRACE_(olerelay)("]");
 701         return S_OK;
 702     }
 703     default:
 704         ERR("Unhandled marshal type %d.\n",tdesc->vt);
 705         return S_OK;
 706     }
 707 }
 708
 709 /* IDL desc:
 710  * HRESULT GetIDsOfNames(
 711  *   [in] REFIID riid,                                  args[1]
 712  *   [in, size_is(cNames)] LPOLESTR *rgszNames,         args[2]
 713  *   [in] UINT cNames,                                  args[3]
 714  *   [in] LCID lcid,                                    args[4]
 715  *   [out, size_is(cNames)] DISPID *rgDispId);          args[5]
 716  *
 717  * line format:
 718  *      IID     iid;
 719  *      DWORD   cNames;
 720  *      LPOLESTR rgszNames[cNames];
 721  *              DWORD bytestrlen        (incl 0)
 722  *              BYTE data[bytestrlen]   (incl 0)
 723  *      LCID
 724  */
 725 static HRESULT
 726 serialize_IDispatch_GetIDsOfNames(
 727     BOOL                inputparams,
 728     BOOL                debugout,
 729     DWORD               *args,
 730     marshal_state       *buf)
 731 {
 732     HRESULT     hres;
 733     DWORD       cNames = args[2];
 734     LPOLESTR    *rgszNames = (LPOLESTR*)args[1];
 735     int         i;
 736
 737     if (inputparams) {
 738         if (debugout) TRACE_(olerelay)("riid=%s,",debugstr_guid((REFIID)args[0]));
 739         hres = xbuf_add(buf, (LPBYTE)args[0], sizeof(IID));
 740         if (hres) {
 741             FIXME("serialize of IID failed.\n");
 742             return hres;
 743         }
 744         if (debugout) TRACE_(olerelay)("cNames=%ld,",cNames);
 745         hres = xbuf_add(buf, (LPBYTE)&cNames, sizeof(DWORD));
 746         if (hres) {
 747             FIXME("serialize of cNames failed.\n");
 748             return hres;
 749         }
 750         if (debugout) TRACE_(olerelay)("rgszNames=[");
 751         for (i=0;i<cNames;i++) {
 752             DWORD len = 2*(lstrlenW(rgszNames[i])+1);
 753
 754             if (debugout) TRACE_(olerelay)("%s,",relaystr(rgszNames[i]));
 755             hres = xbuf_add(buf, (LPBYTE)&len, sizeof(DWORD));
 756             if (hres) {
 757                 FIXME("serialize of len failed.\n");
 758                 return hres;
 759             }
 760             hres = xbuf_add(buf, (LPBYTE)rgszNames[i], len);
 761             if (hres) {
 762                 FIXME("serialize of rgszNames[i] failed.\n");
 763                 return hres;
 764             }
 765         }
 766         if (debugout) TRACE_(olerelay)("],lcid=%04lx)",args[3]);
 767         hres = xbuf_add(buf, (LPBYTE)&args[3], sizeof(DWORD));
 768         if (hres) {
 769             FIXME("serialize of lcid failed.\n");
 770             return hres;
 771         }
 772     } else {
 773         DISPID *rgDispId = (DISPID*)args[4];
 774
 775         hres = xbuf_add(buf, (LPBYTE)rgDispId, sizeof(DISPID) * cNames);
 776         if (hres) {
 777             FIXME("serialize of rgDispId failed.\n");
 778             return hres;
 779         }
 780         if (debugout) {
 781             TRACE_(olerelay)("riid=[in],rgszNames=[in],cNames=[in],rgDispId=[");
 782             for (i=0;i<cNames;i++)
 783                 TRACE_(olerelay)("%08lx,",rgDispId[i]);
 784             TRACE_(olerelay)("])");
 785         }
 786         HeapFree(GetProcessHeap(),0,(IID*)args[0]);
 787         rgszNames = (LPOLESTR*)args[1];
 788         for (i=0;i<cNames;i++) HeapFree(GetProcessHeap(),0,rgszNames[i]);
 789         HeapFree(GetProcessHeap(),0,rgszNames);
 790         HeapFree(GetProcessHeap(),0,rgDispId);
 791     }
 792     return S_OK;
 793 }
 794
 795 static HRESULT
 796 deserialize_IDispatch_GetIDsOfNames(
 797     BOOL                inputparams,
 798     BOOL                debugout,
 799     DWORD               *args,
 800     marshal_state       *buf)
 801 {
 802     HRESULT     hres;
 803     DWORD       cNames;
 804     LPOLESTR    *rgszNames;
 805     int         i;
 806
 807     if (inputparams) {
 808         args[0] = (DWORD)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, sizeof(IID));
 809         if (!args[0]) return E_FAIL;
 810         hres = xbuf_get(buf, (LPBYTE)args[0], sizeof(IID));
 811         if (hres) {
 812             FIXME("deserialize of IID failed.\n");
 813             return hres;
 814         }
 815         if (debugout) TRACE_(olerelay)("riid=%s,",debugstr_guid((REFIID)args[0]));
 816
 817         hres = xbuf_get(buf, (LPBYTE)&cNames, sizeof(DWORD));
 818         if (hres) {
 819             FIXME("deserialize of cNames failed.\n");
 820             return hres;
 821         }
 822         args[2] = cNames;
 823         if (debugout) TRACE_(olerelay)("cNames=%ld,",cNames);
 824         if (debugout) TRACE_(olerelay)("rgszNames=[");
 825         rgszNames = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(LPOLESTR) * cNames);
 826         if (!rgszNames) return E_FAIL;
 827         args[1] = (DWORD)rgszNames;
 828         for (i=0;i<cNames;i++) {
 829             DWORD len;
 830
 831             hres = xbuf_get(buf, (LPBYTE)&len, sizeof(DWORD));
 832             if (hres) {
 833                 FIXME("serialize of len failed.\n");
 834                 return hres;
 835             }
 836             rgszNames[i] = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, len);
 837             if (!rgszNames[i]) {
 838                 FIXME("heapalloc of %ld bytes failed\n", len);
 839                 return E_FAIL;
 840             }
 841             hres = xbuf_get(buf, (LPBYTE)rgszNames[i], len);
 842             if (hres) {
 843                 FIXME("serialize of rgszNames[i] failed.\n");
 844                 return hres;
 845             }
 846             if (debugout) TRACE_(olerelay)("%s,",relaystr(rgszNames[i]));
 847         }
 848         hres = xbuf_get(buf, (LPBYTE)&args[3], sizeof(DWORD));
 849         if (hres) {
 850             FIXME("deserialize of lcid failed.\n");
 851             return hres;
 852         }
 853         if (debugout) TRACE_(olerelay)("],lcid=%04lx,rgDispId=[out])",args[3]);
 854         args[4] = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPID) * cNames);
 855     } else {
 856         hres = xbuf_get(buf, (LPBYTE)args[4], sizeof(DISPID) * args[2]);
 857         if (hres) {
 858             FIXME("serialize of rgDispId failed.\n");
 859             return hres;
 860         }
 861         if (debugout) {
 862             TRACE_(olerelay)("dispid=[");
 863             for (i=0;i<args[2];i++)
 864                 TRACE_(olerelay)("%08lx,",((DISPID*)args[4])[i]);
 865             TRACE_(olerelay)("])");
 866         }
 867     }
 868     return S_OK;
 869 }
 870
 871 static HRESULT
 872 serialize_LPVOID_ptr(
 873     ITypeInfo           *tinfo,
 874     BOOL                writeit,
 875     BOOL                debugout,
 876     BOOL                dealloc,
 877     TYPEDESC            *tdesc,
 878     DWORD               *arg,
 879     marshal_state       *buf)
 880 {
 881     HRESULT     hres;
 882     DWORD       cookie;
 883
 884     if ((tdesc->vt != VT_PTR)                   ||
 885         (tdesc->u.lptdesc->vt != VT_PTR)        ||
 886         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
 887     ) {
 888         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
 889         return E_FAIL;
 890     }
 891     cookie = (*arg) ? 0x42424242: 0x0;
 892     if (writeit) {
 893         hres = xbuf_add(buf, (LPVOID)&cookie, sizeof(cookie));
 894         if (hres)
 895             return hres;
 896     }
 897     if (!*arg) {
 898         if (debugout) TRACE_(olerelay)("<lpvoid NULL>");
 899         return S_OK;
 900     }
 901     if (debugout)
 902         TRACE_(olerelay)("ppv(%p)",*(LPUNKNOWN*)*arg);
 903     if (writeit) {
 904         hres = _marshal_interface(buf,&(buf->iid),*(LPUNKNOWN*)*arg);
 905         if (hres)
 906             return hres;
 907     }
 908     if (dealloc)
 909         HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 910     return S_OK;
 911 }
 912
 913 static HRESULT
 914 serialize_DISPPARAM_ptr(
 915     ITypeInfo           *tinfo,
 916     BOOL                writeit,
 917     BOOL                debugout,
 918     BOOL                dealloc,
 919     TYPEDESC            *tdesc,
 920     DWORD               *arg,
 921     marshal_state       *buf)
 922 {
 923     DWORD       cookie;
 924     HRESULT     hres;
 925     DISPPARAMS  *disp;
 926     int         i;
 927
 928     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
 929         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
 930         return E_FAIL;
 931     }
 932
 933     cookie = *arg ? 0x42424242 : 0x0;
 934     if (writeit) {
 935         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 936         if (hres)
 937             return hres;
 938     }
 939     if (!*arg) {
 940         if (debugout) TRACE_(olerelay)("<DISPPARAMS NULL>");
 941         return S_OK;
 942     }
 943     disp = (DISPPARAMS*)*arg;
 944     if (writeit) {
 945         hres = xbuf_add(buf,(LPBYTE)&disp->cArgs,sizeof(disp->cArgs));
 946         if (hres)
 947             return hres;
 948     }
 949     if (debugout) TRACE_(olerelay)("D{");
 950     for (i=0;i<disp->cArgs;i++) {
 951         TYPEDESC        vtdesc;
 952
 953         vtdesc.vt = VT_VARIANT;
 954         serialize_param(
 955             tinfo,
 956             writeit,
 957             debugout,
 958             dealloc,
 959             &vtdesc,
 960             (DWORD*)(disp->rgvarg+i),
 961             buf
 962         );
 963         if (debugout && (i<disp->cArgs-1))
 964             TRACE_(olerelay)(",");
 965     }
 966     if (dealloc)
 967         HeapFree(GetProcessHeap(),0,disp->rgvarg);
 968     if (writeit) {
 969         hres = xbuf_add(buf,(LPBYTE)&disp->cNamedArgs,sizeof(disp->cNamedArgs));
 970         if (hres)
 971             return hres;
 972     }
 973     if (debugout) TRACE_(olerelay)("}{");
 974     for (i=0;i<disp->cNamedArgs;i++) {
 975         TYPEDESC        vtdesc;
 976
 977         vtdesc.vt = VT_UINT;
 978         serialize_param(
 979             tinfo,
 980             writeit,
 981             debugout,
 982             dealloc,
 983             &vtdesc,
 984             (DWORD*)(disp->rgdispidNamedArgs+i),
 985             buf
 986         );
 987         if (debugout && (i<disp->cNamedArgs-1))
 988             TRACE_(olerelay)(",");
 989     }
 990     if (debugout) TRACE_(olerelay)("}");
 991     if (dealloc) {
 992         HeapFree(GetProcessHeap(),0,disp->rgdispidNamedArgs);
 993         HeapFree(GetProcessHeap(),0,disp);
 994     }
 995     return S_OK;
 996 }
 997
 998 static HRESULT
 999 deserialize_param(
1000     ITypeInfo           *tinfo,
1001     BOOL                readit,
1002     BOOL                debugout,
1003     BOOL                alloc,
1004     TYPEDESC            *tdesc,
1005     DWORD               *arg,
1006     marshal_state       *buf)
1007 {
1008     HRESULT hres = S_OK;
1009
1010     TRACE("vt %d at %p\n",tdesc->vt,arg);
1011
1012     while (1) {
1013         switch (tdesc->vt) {
1014         case VT_EMPTY:
1015             if (debugout) TRACE_(olerelay)("<empty>");
1016             return S_OK;
1017         case VT_NULL:
1018             if (debugout) TRACE_(olerelay)("<null>");
1019             return S_OK;
1020         case VT_VARIANT: {
1021             VARIANT     *vt = (VARIANT*)arg;
1022
1023             if (readit) {
1024                 DWORD   vttype;
1025                 TYPEDESC        tdesc2;
1026                 hres = xbuf_get(buf,(LPBYTE)&vttype,sizeof(vttype));
1027                 if (hres) {
1028                     FIXME("vt type not read?\n");
1029                     return hres;
1030                 }
1031                 memset(&tdesc2,0,sizeof(tdesc2));
1032                 tdesc2.vt = vttype;
1033                 V_VT(vt)  = vttype;
1034                 if (debugout) TRACE_(olerelay)("Vt(%ld)(",vttype);
1035                 hres = deserialize_param(tinfo, readit, debugout, alloc, &tdesc2, &(V_I4(vt)), buf);
1036                 TRACE_(olerelay)(")");
1037                 return hres;
1038             } else {
1039                 VariantInit(vt);
1040                 return S_OK;
1041             }
1042         }
1043         case VT_ERROR:
1044         case VT_BOOL:
1045         case VT_I4:
1046         case VT_I2:
1047         case VT_I1:
1048         case VT_UINT:
1049         case VT_R4:
1050         case VT_UI4:
1051         case VT_UI2:
1052         case VT_UI1:
1053             if (readit) {
1054                 hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
1055                 if (hres) ERR("Failed to read integer 4 byte\n");
1056             }
1057             if (debugout) TRACE_(olerelay)("%lx",*arg);
1058             return hres;
1059         case VT_BSTR|VT_BYREF: {
1060             BSTR **bstr = (BSTR **)arg;
1061             WCHAR       *str;
1062             DWORD       len;
1063
1064             if (readit) {
1065                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
1066                 if (hres) {
1067                     ERR("failed to read bstr klen\n");
1068                     return hres;
1069                 }
1070                 if (len == -1) {
1071                     *bstr = NULL;
1072                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
1073                 } else {
1074                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+sizeof(WCHAR));
1075                     hres = xbuf_get(buf,(LPBYTE)str,len);
1076                     if (hres) {
1077                         ERR("Failed to read BSTR.\n");
1078                         return hres;
1079                     }
1080                     *bstr = CoTaskMemAlloc(sizeof(BSTR *));
1081                     **bstr = SysAllocStringLen(str,len);
1082                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
1083                     HeapFree(GetProcessHeap(),0,str);
1084                 }
1085             } else {
1086                 *bstr = NULL;
1087             }
1088             return S_OK;
1089         }
1090         case VT_BSTR: {
1091             WCHAR       *str;
1092             DWORD       len;
1093
1094             if (readit) {
1095                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
1096                 if (hres) {
1097                     ERR("failed to read bstr klen\n");
1098                     return hres;
1099                 }
1100                 if (len == -1) {
1101                     *arg = 0;
1102                     if (debugout) TRACE_(olerelay)("<bstr NULL>");
1103                 } else {
1104                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+sizeof(WCHAR));
1105                     hres = xbuf_get(buf,(LPBYTE)str,len);
1106                     if (hres) {
1107                         ERR("Failed to read BSTR.\n");
1108                         return hres;
1109                     }
1110                     *arg = (DWORD)SysAllocStringLen(str,len);
1111                     if (debugout) TRACE_(olerelay)("%s",relaystr(str));
1112                     HeapFree(GetProcessHeap(),0,str);
1113                 }
1114             } else {
1115                 *arg = 0;
1116             }
1117             return S_OK;
1118         }
1119         case VT_PTR: {
1120             DWORD       cookie;
1121             BOOL        derefhere = 0;
1122
1123             derefhere = (tdesc->u.lptdesc->vt != VT_USERDEFINED);
1124             /* read it in all cases, we need to know if we have
1125              * NULL pointer or not.
1126              */
1127             hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1128             if (hres) {
1129                 ERR("Failed to load pointer cookie.\n");
1130                 return hres;
1131             }
1132             if (cookie != 0x42424242) {
1133                 /* we read a NULL ptr from the remote side */
1134                 if (debugout) TRACE_(olerelay)("NULL");
1135                 *arg = 0;
1136                 return S_OK;
1137             }
1138             if (debugout) TRACE_(olerelay)("*");
1139             if (alloc) {
1140                 /* Allocate space for the referenced struct */
1141                 if (derefhere)
1142                     *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc));
1143             }
1144             if (derefhere)
1145                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, (LPDWORD)*arg, buf);
1146             else
1147                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, arg, buf);
1148         }
1149         case VT_UNKNOWN:
1150             /* FIXME: UNKNOWN is unknown ..., but allocate 4 byte for it */
1151             if (alloc)
1152                 *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
1153             hres = S_OK;
1154             if (readit)
1155                 hres = _unmarshal_interface(buf,&IID_IUnknown,(LPUNKNOWN*)arg);
1156             if (debugout)
1157                 TRACE_(olerelay)("unk(%p)",arg);
1158             return hres;
1159         case VT_DISPATCH:
1160             hres = S_OK;
1161             if (readit)
1162                 hres = _unmarshal_interface(buf,&IID_IDispatch,(LPUNKNOWN*)arg);
1163             if (debugout)
1164                 TRACE_(olerelay)("idisp(%p)",arg);
1165             return hres;
1166         case VT_VOID:
1167             if (debugout) TRACE_(olerelay)("<void>");
1168             return S_OK;
1169         case VT_USERDEFINED: {
1170             ITypeInfo   *tinfo2;
1171             TYPEATTR    *tattr;
1172
1173             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
1174             if (hres) {
1175                 ERR("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
1176                 return hres;
1177             }
1178             hres = ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1179             if (hres) {
1180                 ERR("Could not get typeattr in VT_USERDEFINED.\n");
1181             } else {
1182                 switch (tattr->typekind) {
1183                 case TKIND_DISPATCH:
1184                 case TKIND_INTERFACE:
1185                     if (readit)
1186                         hres = _unmarshal_interface(buf,&(tattr->guid),(LPUNKNOWN*)arg);
1187                     break;
1188                 case TKIND_RECORD: {
1189                     int i;
1190
1191                     if (alloc)
1192                         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,tattr->cbSizeInstance);
1193
1194                     if (debugout) TRACE_(olerelay)("{");
1195                     for (i=0;i<tattr->cVars;i++) {
1196                         VARDESC *vdesc;
1197
1198                         hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
1199                         if (hres) {
1200                             ERR("Could not get vardesc of %d\n",i);
1201                             return hres;
1202                         }
1203                         hres = deserialize_param(
1204                             tinfo2,
1205                             readit,
1206                             debugout,
1207                             alloc,
1208                             &vdesc->elemdescVar.tdesc,
1209                             (DWORD*)(((LPBYTE)*arg)+vdesc->u.oInst),
1210                             buf
1211                         );
1212                         if (debugout && (i<tattr->cVars-1)) TRACE_(olerelay)(",");
1213                     }
1214                     if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
1215                         memcpy(&(buf->iid),(LPBYTE)*arg,sizeof(buf->iid));
1216                     if (debugout) TRACE_(olerelay)("}");
1217                     break;
1218                 }
1219                 default:
1220                     ERR("Unhandled typekind %d\n",tattr->typekind);
1221                     hres = E_FAIL;
1222                     break;
1223                 }
1224             }
1225             if (hres)
1226                 ERR("failed to stuballoc in TKIND_RECORD.\n");
1227             ITypeInfo_Release(tinfo2);
1228             return hres;
1229         }
1230         case VT_CARRAY: {
1231             /* arg is pointing to the start of the array. */
1232             ARRAYDESC *adesc = tdesc->u.lpadesc;
1233             int         arrsize,i;
1234             arrsize = 1;
1235             if (adesc->cDims > 1) FIXME("cDims > 1 in VT_CARRAY. Does it work?\n");
1236             for (i=0;i<adesc->cDims;i++)
1237                 arrsize *= adesc->rgbounds[i].cElements;
1238             for (i=0;i<arrsize;i++)
1239                 deserialize_param(
1240                     tinfo,
1241                     readit,
1242                     debugout,
1243                     alloc,
1244                     &adesc->tdescElem,
1245                     (DWORD*)((LPBYTE)(arg)+i*_xsize(&adesc->tdescElem)),
1246                     buf
1247                 );
1248             return S_OK;
1249         }
1250         default:
1251             ERR("No handler for VT type %d!\n",tdesc->vt);
1252             return S_OK;
1253         }
1254     }
1255 }
1256
1257 static HRESULT
1258 deserialize_LPVOID_ptr(
1259     ITypeInfo           *tinfo,
1260     BOOL                readit,
1261     BOOL                debugout,
1262     BOOL                alloc,
1263     TYPEDESC            *tdesc,
1264     DWORD               *arg,
1265     marshal_state       *buf
1266 ) {
1267     HRESULT     hres;
1268     DWORD       cookie;
1269
1270     if ((tdesc->vt != VT_PTR)                   ||
1271         (tdesc->u.lptdesc->vt != VT_PTR)        ||
1272         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
1273     ) {
1274         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
1275         return E_FAIL;
1276     }
1277     if (alloc)
1278         *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(LPVOID));
1279     if (readit) {
1280         hres = xbuf_get(buf, (LPVOID)&cookie, sizeof(cookie));
1281         if (hres)
1282             return hres;
1283         if (cookie != 0x42424242) {
1284             *(DWORD*)*arg = 0;
1285             if (debugout) TRACE_(olerelay)("<lpvoid NULL>");
1286             return S_OK;
1287         }
1288     }
1289     if (readit) {
1290         hres = _unmarshal_interface(buf,&buf->iid,(LPUNKNOWN*)*arg);
1291         if (hres) {
1292             FIXME("_unmarshal_interface of %s , %p failed with %lx\n", debugstr_guid(&buf->iid), (LPUNKNOWN*)*arg, hres);
1293             return hres;
1294         }
1295     }
1296     if (debugout) TRACE_(olerelay)("ppv(%p)",(LPVOID)*arg);
1297     return S_OK;
1298 }
1299
1300 static HRESULT
1301 deserialize_DISPPARAM_ptr(
1302     ITypeInfo           *tinfo,
1303     BOOL                readit,
1304     BOOL                debugout,
1305     BOOL                alloc,
1306     TYPEDESC            *tdesc,
1307     DWORD               *arg,
1308     marshal_state       *buf)
1309 {
1310     DWORD       cookie;
1311     DISPPARAMS  *disps;
1312     HRESULT     hres;
1313     int         i;
1314
1315     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
1316         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
1317         return E_FAIL;
1318     }
1319     if (readit) {
1320         hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1321         if (hres)
1322             return hres;
1323         if (cookie == 0) {
1324             *arg = 0;
1325             if (debugout) TRACE_(olerelay)("<DISPPARAMS NULL>");
1326             return S_OK;
1327         }
1328     }
1329     if (alloc)
1330         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPPARAMS));
1331     disps = (DISPPARAMS*)*arg;
1332     if (!readit)
1333         return S_OK;
1334     hres = xbuf_get(buf, (LPBYTE)&disps->cArgs, sizeof(disps->cArgs));
1335     if (hres)
1336         return hres;
1337     if (alloc)
1338         disps->rgvarg = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(VARIANT)*disps->cArgs);
1339     if (debugout) TRACE_(olerelay)("D{");
1340     for (i=0; i< disps->cArgs; i++) {
1341         TYPEDESC vdesc;
1342
1343         vdesc.vt = VT_VARIANT;
1344         hres = deserialize_param(
1345             tinfo,
1346             readit,
1347             debugout,
1348             alloc,
1349             &vdesc,
1350             (DWORD*)(disps->rgvarg+i),
1351             buf
1352         );
1353     }
1354     if (debugout) TRACE_(olerelay)("}{");
1355     hres = xbuf_get(buf, (LPBYTE)&disps->cNamedArgs, sizeof(disps->cNamedArgs));
1356     if (hres)
1357         return hres;
1358     if (disps->cNamedArgs) {
1359         if (alloc)
1360             disps->rgdispidNamedArgs = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPID)*disps->cNamedArgs);
1361         for (i=0; i< disps->cNamedArgs; i++) {
1362             TYPEDESC vdesc;
1363
1364             vdesc.vt = VT_UINT;
1365             hres = deserialize_param(
1366                 tinfo,
1367                 readit,
1368                 debugout,
1369                 alloc,
1370                 &vdesc,
1371                 (DWORD*)(disps->rgdispidNamedArgs+i),
1372                 buf
1373             );
1374             if (debugout && i<(disps->cNamedArgs-1)) TRACE_(olerelay)(",");
1375         }
1376     }
1377     if (debugout) TRACE_(olerelay)("}");
1378     return S_OK;
1379 }
1380
1381 /* Searches function, also in inherited interfaces */
1382 static HRESULT
1383 _get_funcdesc(
1384     ITypeInfo *tinfo, int iMethod, FUNCDESC **fdesc, BSTR *iname, BSTR *fname)
1385 {
1386     int i = 0, j = 0;
1387     HRESULT hres;
1388
1389     if (fname) *fname = NULL;
1390     if (iname) *iname = NULL;
1391
1392     while (1) {
1393         hres = ITypeInfo_GetFuncDesc(tinfo, i, fdesc);
1394         if (hres) {
1395             ITypeInfo   *tinfo2;
1396             HREFTYPE    href;
1397             TYPEATTR    *attr;
1398
1399             hres = ITypeInfo_GetTypeAttr(tinfo, &attr);
1400             if (hres) {
1401                 ERR("GetTypeAttr failed with %lx\n",hres);
1402                 return hres;
1403             }
1404             /* Not found, so look in inherited ifaces. */
1405             for (j=0;j<attr->cImplTypes;j++) {
1406                 hres = ITypeInfo_GetRefTypeOfImplType(tinfo, j, &href);
1407                 if (hres) {
1408                     ERR("Did not find a reftype for interface offset %d?\n",j);
1409                     break;
1410                 }
1411                 hres = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
1412                 if (hres) {
1413                     ERR("Did not find a typeinfo for reftype %ld?\n",href);
1414                     continue;
1415                 }
1416                 hres = _get_funcdesc(tinfo2,iMethod,fdesc,iname,fname);
1417                 ITypeInfo_Release(tinfo2);
1418                 if (!hres) return S_OK;
1419             }
1420             return hres;
1421         }
1422         if (((*fdesc)->oVft/4) == iMethod) {
1423             if (fname)
1424                 ITypeInfo_GetDocumentation(tinfo,(*fdesc)->memid,fname,NULL,NULL,NULL);
1425             if (iname)
1426                 ITypeInfo_GetDocumentation(tinfo,-1,iname,NULL,NULL,NULL);
1427             return S_OK;
1428         }
1429         i++;
1430     }
1431 }
1432
1433 static DWORD
1434 xCall(LPVOID retptr, int method, TMProxyImpl *tpinfo /*, args */)
1435 {
1436     DWORD               *args = ((DWORD*)&tpinfo)+1, *xargs;
1437     FUNCDESC            *fdesc;
1438     HRESULT             hres;
1439     int                 i, relaydeb = TRACE_ON(olerelay);
1440     marshal_state       buf;
1441     RPCOLEMESSAGE       msg;
1442     ULONG               status;
1443     BSTR                fname,iname;
1444     BSTR                names[10];
1445     int                 nrofnames;
1446     int                 is_idispatch_getidsofnames = 0;
1447
1448     EnterCriticalSection(&tpinfo->crit);
1449
1450     hres = _get_funcdesc(tpinfo->tinfo,method,&fdesc,&iname,&fname);
1451     if (hres) {
1452         ERR("Did not find typeinfo/funcdesc entry for method %d!\n",method);
1453         LeaveCriticalSection(&tpinfo->crit);
1454         return E_FAIL;
1455     }
1456
1457     if (!tpinfo->chanbuf)
1458     {
1459         WARN("Tried to use disconnected proxy\n");
1460         LeaveCriticalSection(&tpinfo->crit);
1461         return RPC_E_DISCONNECTED;
1462     }
1463
1464     if (relaydeb) {
1465        TRACE_(olerelay)("->");
1466         if (iname)
1467             TRACE_(olerelay)("%s:",relaystr(iname));
1468         if (fname)
1469             TRACE_(olerelay)("%s(%d)",relaystr(fname),method);
1470         else
1471             TRACE_(olerelay)("%d",method);
1472         TRACE_(olerelay)("(");
1473     }
1474     if (iname && fname && !lstrcmpW(iname,IDispatchW) && !lstrcmpW(fname,GetIDsOfNamesW))
1475         is_idispatch_getidsofnames = 1;
1476
1477     if (iname) SysFreeString(iname);
1478     if (fname) SysFreeString(fname);
1479
1480     memset(&buf,0,sizeof(buf));
1481     buf.iid = IID_IUnknown;
1482
1483     /* Special IDispatch::GetIDsOfNames() serializer */
1484     if (is_idispatch_getidsofnames) {
1485         hres = serialize_IDispatch_GetIDsOfNames(TRUE,relaydeb,args,&buf);
1486         if (hres != S_OK) {
1487             FIXME("serialize of IDispatch::GetIDsOfNames failed!\n");
1488             return hres;
1489         }
1490         goto afterserialize;
1491     }
1492
1493     /* special QueryInterface serialize */
1494     if (method == 0) {
1495         xbuf_add(&buf,(LPBYTE)args[0],sizeof(IID));
1496         if (relaydeb) TRACE_(olerelay)("riid=%s,[out])",debugstr_guid((REFIID)args[0]));
1497         goto afterserialize;
1498     }
1499
1500     /* normal typelib driven serializing */
1501
1502     /* Need them for hack below */
1503     memset(names,0,sizeof(names));
1504     if (ITypeInfo_GetNames(tpinfo->tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames))
1505         nrofnames = 0;
1506     if (nrofnames > sizeof(names)/sizeof(names[0]))
1507         ERR("Need more names!\n");
1508
1509     xargs = args;
1510     for (i=0;i<fdesc->cParams;i++) {
1511         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1512         BOOL    isserialized = FALSE;
1513         if (relaydeb) {
1514             if (i) TRACE_(olerelay)(",");
1515             if (i+1<nrofnames && names[i+1])
1516                 TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1517         }
1518         /* No need to marshal other data than FIN and any VT_PTR. */
1519         if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN) && (elem->tdesc.vt != VT_PTR)) {
1520             xargs+=_argsize(elem->tdesc.vt);
1521             if (relaydeb) TRACE_(olerelay)("[out]");
1522             continue;
1523         }
1524         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1525             /* If the parameter is 'riid', we use it as interface IID
1526              * for a later ppvObject serialization.
1527              */
1528             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1529
1530             /* DISPPARAMS* needs special serializer */
1531             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1532                 hres = serialize_DISPPARAM_ptr(
1533                     tpinfo->tinfo,
1534                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1535                     relaydeb,
1536                     FALSE,
1537                     &elem->tdesc,
1538                     xargs,
1539                     &buf
1540                 );
1541                 isserialized = TRUE;
1542             }
1543             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1544                 hres = serialize_LPVOID_ptr(
1545                     tpinfo->tinfo,
1546                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1547                     relaydeb,
1548                     FALSE,
1549                     &elem->tdesc,
1550                     xargs,
1551                     &buf
1552                 );
1553                 if (hres == S_OK)
1554                     isserialized = TRUE;
1555             }
1556         }
1557         if (!isserialized)
1558             hres = serialize_param(
1559                 tpinfo->tinfo,
1560                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1561                 relaydeb,
1562                 FALSE,
1563                 &elem->tdesc,
1564                 xargs,
1565                 &buf
1566             );
1567
1568         if (hres) {
1569             ERR("Failed to serialize param, hres %lx\n",hres);
1570             break;
1571         }
1572         xargs+=_argsize(elem->tdesc.vt);
1573     }
1574     if (relaydeb) TRACE_(olerelay)(")");
1575
1576 afterserialize:
1577     memset(&msg,0,sizeof(msg));
1578     msg.cbBuffer = buf.curoff;
1579     msg.iMethod  = method;
1580     hres = IRpcChannelBuffer_GetBuffer(tpinfo->chanbuf,&msg,&(tpinfo->iid));
1581     if (hres) {
1582         ERR("RpcChannelBuffer GetBuffer failed, %lx\n",hres);
1583         LeaveCriticalSection(&tpinfo->crit);
1584         return hres;
1585     }
1586     memcpy(msg.Buffer,buf.base,buf.curoff);
1587     if (relaydeb) TRACE_(olerelay)("\n");
1588     hres = IRpcChannelBuffer_SendReceive(tpinfo->chanbuf,&msg,&status);
1589     if (hres) {
1590         ERR("RpcChannelBuffer SendReceive failed, %lx\n",hres);
1591         LeaveCriticalSection(&tpinfo->crit);
1592         return hres;
1593     }
1594
1595     if (relaydeb) TRACE_(olerelay)(" = %08lx (",status);
1596     if (buf.base)
1597         buf.base = HeapReAlloc(GetProcessHeap(),0,buf.base,msg.cbBuffer);
1598     else
1599         buf.base = HeapAlloc(GetProcessHeap(),0,msg.cbBuffer);
1600     buf.size = msg.cbBuffer;
1601     memcpy(buf.base,msg.Buffer,buf.size);
1602     buf.curoff = 0;
1603
1604     /* Special IDispatch::GetIDsOfNames() deserializer */
1605     if (is_idispatch_getidsofnames) {
1606         hres = deserialize_IDispatch_GetIDsOfNames(FALSE,relaydeb,args,&buf);
1607         if (hres != S_OK) {
1608             FIXME("deserialize of IDispatch::GetIDsOfNames failed!\n");
1609             return hres;
1610         }
1611         goto after_deserialize;
1612     }
1613     /* Special QueryInterface deserializer */
1614     if (method == 0) {
1615         _unmarshal_interface(&buf,(REFIID)args[0],(LPUNKNOWN*)args[1]);
1616         if (relaydeb) TRACE_(olerelay)("[in],%p",*((DWORD**)args[1]));
1617         goto after_deserialize;
1618     }
1619
1620     /* generic deserializer using typelib description */
1621     xargs = args;
1622     for (i=0;i<fdesc->cParams;i++) {
1623         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1624         BOOL    isdeserialized = FALSE;
1625
1626         if (relaydeb) {
1627             if (i) TRACE_(olerelay)(",");
1628             if (i+1<nrofnames && names[i+1]) TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1629         }
1630         /* No need to marshal other data than FOUT and any VT_PTR */
1631         if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT) && (elem->tdesc.vt != VT_PTR)) {
1632             xargs += _argsize(elem->tdesc.vt);
1633             if (relaydeb) TRACE_(olerelay)("[in]");
1634             continue;
1635         }
1636         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1637             /* If the parameter is 'riid', we use it as interface IID
1638              * for a later ppvObject serialization.
1639              */
1640             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1641
1642             /* deserialize DISPPARAM */
1643             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1644                 hres = deserialize_DISPPARAM_ptr(
1645                     tpinfo->tinfo,
1646                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1647                     relaydeb,
1648                     FALSE,
1649                     &(elem->tdesc),
1650                     xargs,
1651                     &buf
1652                 );
1653                 if (hres) {
1654                     ERR("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
1655                     break;
1656                 }
1657                 isdeserialized = TRUE;
1658             }
1659             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1660                 hres = deserialize_LPVOID_ptr(
1661                     tpinfo->tinfo,
1662                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1663                     relaydeb,
1664                     FALSE,
1665                     &elem->tdesc,
1666                     xargs,
1667                     &buf
1668                 );
1669                 if (hres == S_OK)
1670                     isdeserialized = TRUE;
1671             }
1672         }
1673         if (!isdeserialized)
1674             hres = deserialize_param(
1675                 tpinfo->tinfo,
1676                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1677                 relaydeb,
1678                 FALSE,
1679                 &(elem->tdesc),
1680                 xargs,
1681                 &buf
1682             );
1683         if (hres) {
1684             ERR("Failed to unmarshall param, hres %lx\n",hres);
1685             status = hres;
1686             break;
1687         }
1688         xargs += _argsize(elem->tdesc.vt);
1689     }
1690 after_deserialize:
1691     if (relaydeb) TRACE_(olerelay)(")\n");
1692     HeapFree(GetProcessHeap(),0,buf.base);
1693
1694     LeaveCriticalSection(&tpinfo->crit);
1695
1696     return status;
1697 }
1698
1699 HRESULT WINAPI ProxyIUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
1700 {
1701     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1702
1703     TRACE("(%s, %p)\n", debugstr_guid(riid), ppv);
1704
1705     if (proxy->outerunknown)
1706         return IUnknown_QueryInterface(proxy->outerunknown, riid, ppv);
1707
1708     FIXME("No interface\n");
1709     return E_NOINTERFACE;
1710 }
1711
1712 ULONG WINAPI ProxyIUnknown_AddRef(IUnknown *iface)
1713 {
1714     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1715
1716     TRACE("\n");
1717
1718     if (proxy->outerunknown)
1719         return IUnknown_AddRef(proxy->outerunknown);
1720
1721     return 2; /* FIXME */
1722 }
1723
1724 ULONG WINAPI ProxyIUnknown_Release(IUnknown *iface)
1725 {
1726     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1727
1728     TRACE("\n");
1729
1730     if (proxy->outerunknown)
1731         return IUnknown_Release(proxy->outerunknown);
1732
1733     return 1; /* FIXME */
1734 }
1735
1736 static HRESULT WINAPI
1737 PSFacBuf_CreateProxy(
1738     LPPSFACTORYBUFFER iface, IUnknown* pUnkOuter, REFIID riid,
1739     IRpcProxyBuffer **ppProxy, LPVOID *ppv)
1740 {
1741     HRESULT     hres;
1742     ITypeInfo   *tinfo;
1743     int         i, nroffuncs;
1744     FUNCDESC    *fdesc;
1745     TMProxyImpl *proxy;
1746
1747     TRACE("(...%s...)\n",debugstr_guid(riid));
1748     hres = _get_typeinfo_for_iid(riid,&tinfo);
1749     if (hres) {
1750         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
1751         return hres;
1752     }
1753     nroffuncs = _nroffuncs(tinfo);
1754     proxy = CoTaskMemAlloc(sizeof(TMProxyImpl));
1755     if (!proxy) return E_OUTOFMEMORY;
1756
1757     assert(sizeof(TMAsmProxy) == 12);
1758
1759     proxy->outerunknown = pUnkOuter;
1760     proxy->asmstubs = VirtualAlloc(NULL, sizeof(TMAsmProxy) * nroffuncs, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
1761     if (!proxy->asmstubs) {
1762         ERR("Could not commit pages for proxy thunks\n");
1763         CoTaskMemFree(proxy);
1764         return E_OUTOFMEMORY;
1765     }
1766
1767     InitializeCriticalSection(&proxy->crit);
1768
1769     proxy->lpvtbl = HeapAlloc(GetProcessHeap(),0,sizeof(LPBYTE)*nroffuncs);
1770     for (i=0;i<nroffuncs;i++) {
1771         TMAsmProxy      *xasm = proxy->asmstubs+i;
1772
1773         switch (i) {
1774         case 0:
1775                 proxy->lpvtbl[i] = ProxyIUnknown_QueryInterface;
1776                 break;
1777         case 1:
1778                 proxy->lpvtbl[i] = ProxyIUnknown_AddRef;
1779                 break;
1780         case 2:
1781                 proxy->lpvtbl[i] = ProxyIUnknown_Release;
1782                 break;
1783         default: {
1784                 int j;
1785                 /* nrofargs without This */
1786                 int nrofargs;
1787                 hres = _get_funcdesc(tinfo,i,&fdesc,NULL,NULL);
1788                 if (hres) {
1789                     ERR("GetFuncDesc %lx should not fail here.\n",hres);
1790                     return hres;
1791                 }
1792                 /* some args take more than 4 byte on the stack */
1793                 nrofargs = 0;
1794                 for (j=0;j<fdesc->cParams;j++)
1795                     nrofargs += _argsize(fdesc->lprgelemdescParam[j].tdesc.vt);
1796
1797                 if (fdesc->callconv != CC_STDCALL) {
1798                     ERR("calling convention is not stdcall????\n");
1799                     return E_FAIL;
1800                 }
1801 /* popl %eax    -       return ptr
1802  * pushl <nr>
1803  * pushl %eax
1804  * call xCall
1805  * lret <nr> (+4)
1806  *
1807  *
1808  * arg3 arg2 arg1 <method> <returnptr>
1809  */
1810                 xasm->popleax   = 0x58;
1811                 xasm->pushlval  = 0x6a;
1812                 xasm->nr        = i;
1813                 xasm->pushleax  = 0x50;
1814                 xasm->lcall     = 0xe8; /* relative jump */
1815                 xasm->xcall     = (DWORD)xCall;
1816                 xasm->xcall     -= (DWORD)&(xasm->lret);
1817                 xasm->lret      = 0xc2;
1818                 xasm->bytestopop= (nrofargs+2)*4; /* pop args, This, iMethod */
1819                 proxy->lpvtbl[i] = xasm;
1820                 break;
1821             }
1822         }
1823     }
1824     proxy->lpvtbl2      = &tmproxyvtable;
1825     /* 1 reference for the proxy and 1 for the object */
1826     proxy->ref          = 2;
1827     proxy->tinfo        = tinfo;
1828     memcpy(&proxy->iid,riid,sizeof(*riid));
1829     proxy->chanbuf      = 0;
1830     *ppv                = (LPVOID)proxy;
1831     *ppProxy            = (IRpcProxyBuffer *)&(proxy->lpvtbl2);
1832     return S_OK;
1833 }
1834
1835 typedef struct _TMStubImpl {
1836     IRpcStubBufferVtbl  *lpvtbl;
1837     ULONG                       ref;
1838
1839     LPUNKNOWN                   pUnk;
1840     ITypeInfo                   *tinfo;
1841     IID                         iid;
1842 } TMStubImpl;
1843
1844 static HRESULT WINAPI
1845 TMStubImpl_QueryInterface(LPRPCSTUBBUFFER iface, REFIID riid, LPVOID *ppv)
1846 {
1847     if (IsEqualIID(riid,&IID_IRpcStubBuffer)||IsEqualIID(riid,&IID_IUnknown)){
1848         *ppv = (LPVOID)iface;
1849         IRpcStubBuffer_AddRef(iface);
1850         return S_OK;
1851     }
1852     FIXME("%s, not supported IID.\n",debugstr_guid(riid));
1853     return E_NOINTERFACE;
1854 }
1855
1856 static ULONG WINAPI
1857 TMStubImpl_AddRef(LPRPCSTUBBUFFER iface)
1858 {
1859     TMStubImpl *This = (TMStubImpl *)iface;
1860     ULONG refCount = InterlockedIncrement(&This->ref);
1861
1862     TRACE("(%p)->(ref before=%lu)\n", This, refCount - 1);
1863
1864     return refCount;
1865 }
1866
1867 static ULONG WINAPI
1868 TMStubImpl_Release(LPRPCSTUBBUFFER iface)
1869 {
1870     TMStubImpl *This = (TMStubImpl *)iface;
1871     ULONG refCount = InterlockedDecrement(&This->ref);
1872
1873     TRACE("(%p)->(ref before=%lu)\n", This, refCount + 1);
1874
1875     if (!refCount)
1876     {
1877         IRpcStubBuffer_Disconnect(iface);
1878         CoTaskMemFree(This);
1879     }
1880     return refCount;
1881 }
1882
1883 static HRESULT WINAPI
1884 TMStubImpl_Connect(LPRPCSTUBBUFFER iface, LPUNKNOWN pUnkServer)
1885 {
1886     TMStubImpl *This = (TMStubImpl *)iface;
1887
1888     TRACE("(%p)->(%p)\n", This, pUnkServer);
1889
1890     IUnknown_AddRef(pUnkServer);
1891     This->pUnk = pUnkServer;
1892     return S_OK;
1893 }
1894
1895 static void WINAPI
1896 TMStubImpl_Disconnect(LPRPCSTUBBUFFER iface)
1897 {
1898     TMStubImpl *This = (TMStubImpl *)iface;
1899
1900     TRACE("(%p)->()\n", This);
1901
1902     IUnknown_Release(This->pUnk);
1903     This->pUnk = NULL;
1904     return;
1905 }
1906
1907 static HRESULT WINAPI
1908 TMStubImpl_Invoke(
1909     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf)
1910 {
1911     int         i;
1912     FUNCDESC    *fdesc;
1913     TMStubImpl *This = (TMStubImpl *)iface;
1914     HRESULT     hres;
1915     DWORD       *args, res, *xargs, nrofargs;
1916     marshal_state       buf;
1917     int         nrofnames;
1918     BSTR        names[10];
1919     BSTR        fname = NULL,iname = NULL;
1920     BOOL        is_idispatch_getidsofnames = 0;
1921
1922     memset(&buf,0,sizeof(buf));
1923     buf.size    = xmsg->cbBuffer;
1924     buf.base    = xmsg->Buffer;
1925     buf.curoff  = 0;
1926     buf.iid     = IID_IUnknown;
1927
1928     TRACE("...\n");
1929     if (xmsg->iMethod == 0) { /* QI */
1930         IID             xiid;
1931         /* in: IID, out: <iface> */
1932
1933         xbuf_get(&buf,(LPBYTE)&xiid,sizeof(xiid));
1934         buf.curoff = 0;
1935         hres = _marshal_interface(&buf,&xiid,This->pUnk);
1936         xmsg->Buffer    = buf.base; /* Might have been reallocated */
1937         xmsg->cbBuffer  = buf.size;
1938         return hres;
1939     }
1940     hres = _get_funcdesc(This->tinfo,xmsg->iMethod,&fdesc,&iname,&fname);
1941     if (hres) {
1942         ERR("GetFuncDesc on method %ld failed with %lx\n",xmsg->iMethod,hres);
1943         return hres;
1944     }
1945
1946     if (iname && fname && !lstrcmpW(iname, IDispatchW) && !lstrcmpW(fname, GetIDsOfNamesW))
1947         is_idispatch_getidsofnames = 1;
1948
1949     if (iname) SysFreeString (iname);
1950     if (fname) SysFreeString (fname);
1951
1952     /* Need them for hack below */
1953     memset(names,0,sizeof(names));
1954     ITypeInfo_GetNames(This->tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
1955     if (nrofnames > sizeof(names)/sizeof(names[0])) {
1956         ERR("Need more names!\n");
1957     }
1958
1959     /*dump_FUNCDESC(fdesc);*/
1960     nrofargs = 0;
1961     for (i=0;i<fdesc->cParams;i++)
1962         nrofargs += _argsize(fdesc->lprgelemdescParam[i].tdesc.vt);
1963     args = HeapAlloc(GetProcessHeap(),0,(nrofargs+1)*sizeof(DWORD));
1964     if (!args) return E_OUTOFMEMORY;
1965
1966     if (is_idispatch_getidsofnames) {
1967         hres = deserialize_IDispatch_GetIDsOfNames(TRUE,FALSE,args+1,&buf);
1968         if (hres != S_OK) {
1969             FIXME("deserialize_IDispatch_GetIDsOfNames failed!\n");
1970             return hres;
1971         }
1972         xargs = args+1+5;
1973         goto afterdeserialize;
1974     }
1975
1976     /* Allocate all stuff used by call. */
1977     xargs = args+1;
1978     for (i=0;i<fdesc->cParams;i++) {
1979         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1980         BOOL            isdeserialized = FALSE;
1981
1982         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1983             /* If the parameter is 'riid', we use it as interface IID
1984              * for a later ppvObject serialization.
1985              */
1986             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1987
1988             /* deserialize DISPPARAM */
1989             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1990                 hres = deserialize_DISPPARAM_ptr(
1991                     This->tinfo,
1992                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1993                     FALSE,
1994                     TRUE,
1995                     &(elem->tdesc),
1996                     xargs,
1997                     &buf
1998                 );
1999                 if (hres) {
2000                     ERR("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
2001                     break;
2002                 }
2003                 isdeserialized = TRUE;
2004             }
2005             if (!lstrcmpW(names[i+1],ppvObjectW)) {
2006                 hres = deserialize_LPVOID_ptr(
2007                     This->tinfo,
2008                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
2009                     FALSE,
2010                     TRUE,
2011                     &elem->tdesc,
2012                     xargs,
2013                     &buf
2014                 );
2015                 if (hres == S_OK)
2016                     isdeserialized = TRUE;
2017             }
2018         }
2019         if (!isdeserialized)
2020             hres = deserialize_param(
2021                 This->tinfo,
2022                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
2023                 FALSE,
2024                 TRUE,
2025                 &(elem->tdesc),
2026                 xargs,
2027                 &buf
2028             );
2029         xargs += _argsize(elem->tdesc.vt);
2030         if (hres) {
2031             ERR("Failed to deserialize param %s, hres %lx\n",relaystr(names[i+1]),hres);
2032             break;
2033         }
2034     }
2035 afterdeserialize:
2036     hres = IUnknown_QueryInterface(This->pUnk,&(This->iid),(LPVOID*)&(args[0]));
2037     if (hres) {
2038         ERR("Does not support iface %s, returning %lx\n",debugstr_guid(&(This->iid)), hres);
2039         return hres;
2040     }
2041     res = _invoke(
2042         (*((FARPROC**)args[0]))[fdesc->oVft/4],
2043         fdesc->callconv,
2044         (xargs-args),
2045         args
2046     );
2047     IUnknown_Release((LPUNKNOWN)args[0]);
2048     buf.curoff = 0;
2049
2050     /* special IDispatch::GetIDsOfNames serializer */
2051     if (is_idispatch_getidsofnames) {
2052         hres = serialize_IDispatch_GetIDsOfNames(FALSE,FALSE,args+1,&buf);
2053         if (hres != S_OK) {
2054             FIXME("serialize of IDispatch::GetIDsOfNames failed!\n");
2055             return hres;
2056         }
2057         goto afterserialize;
2058     }
2059     xargs = args+1;
2060     for (i=0;i<fdesc->cParams;i++) {
2061         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
2062         BOOL            isserialized = FALSE;
2063
2064         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
2065             /* If the parameter is 'riid', we use it as interface IID
2066              * for a later ppvObject serialization.
2067              */
2068             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
2069
2070             /* DISPPARAMS* needs special serializer */
2071             if (!lstrcmpW(names[i+1],pdispparamsW)) {
2072                 hres = serialize_DISPPARAM_ptr(
2073                     This->tinfo,
2074                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
2075                     FALSE,
2076                     TRUE,
2077                     &elem->tdesc,
2078                     xargs,
2079                     &buf
2080                 );
2081                 isserialized = TRUE;
2082             }
2083             if (!lstrcmpW(names[i+1],ppvObjectW)) {
2084                 hres = serialize_LPVOID_ptr(
2085                     This->tinfo,
2086                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
2087                     FALSE,
2088                     TRUE,
2089                     &elem->tdesc,
2090                     xargs,
2091                     &buf
2092                 );
2093                 if (hres == S_OK)
2094                     isserialized = TRUE;
2095             }
2096         }
2097         if (!isserialized)
2098             hres = serialize_param(
2099                This->tinfo,
2100                elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
2101                FALSE,
2102                TRUE,
2103                &elem->tdesc,
2104                xargs,
2105                &buf
2106             );
2107         xargs += _argsize(elem->tdesc.vt);
2108         if (hres) {
2109             ERR("Failed to stuballoc param, hres %lx\n",hres);
2110             break;
2111         }
2112     }
2113 afterserialize:
2114     /* might need to use IRpcChannelBuffer_GetBuffer ? */
2115     xmsg->cbBuffer      = buf.curoff;
2116     xmsg->Buffer        = buf.base;
2117     HeapFree(GetProcessHeap(),0,args);
2118     return res;
2119 }
2120
2121 static LPRPCSTUBBUFFER WINAPI
2122 TMStubImpl_IsIIDSupported(LPRPCSTUBBUFFER iface, REFIID riid) {
2123     FIXME("Huh (%s)?\n",debugstr_guid(riid));
2124     return NULL;
2125 }
2126
2127 static ULONG WINAPI
2128 TMStubImpl_CountRefs(LPRPCSTUBBUFFER iface) {
2129     TMStubImpl *This = (TMStubImpl *)iface;
2130
2131     return This->ref; /*FIXME? */
2132 }
2133
2134 static HRESULT WINAPI
2135 TMStubImpl_DebugServerQueryInterface(LPRPCSTUBBUFFER iface, LPVOID *ppv) {
2136     return E_NOTIMPL;
2137 }
2138
2139 static void WINAPI
2140 TMStubImpl_DebugServerRelease(LPRPCSTUBBUFFER iface, LPVOID ppv) {
2141     return;
2142 }
2143
2144 IRpcStubBufferVtbl tmstubvtbl = {
2145     TMStubImpl_QueryInterface,
2146     TMStubImpl_AddRef,
2147     TMStubImpl_Release,
2148     TMStubImpl_Connect,
2149     TMStubImpl_Disconnect,
2150     TMStubImpl_Invoke,
2151     TMStubImpl_IsIIDSupported,
2152     TMStubImpl_CountRefs,
2153     TMStubImpl_DebugServerQueryInterface,
2154     TMStubImpl_DebugServerRelease
2155 };
2156
2157 static HRESULT WINAPI
2158 PSFacBuf_CreateStub(
2159     LPPSFACTORYBUFFER iface, REFIID riid,IUnknown *pUnkServer,
2160     IRpcStubBuffer** ppStub
2161 ) {
2162     HRESULT hres;
2163     ITypeInfo   *tinfo;
2164     TMStubImpl  *stub;
2165
2166     TRACE("(%s,%p,%p)\n",debugstr_guid(riid),pUnkServer,ppStub);
2167     hres = _get_typeinfo_for_iid(riid,&tinfo);
2168     if (hres) {
2169         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
2170         return hres;
2171     }
2172     stub = CoTaskMemAlloc(sizeof(TMStubImpl));
2173     if (!stub)
2174         return E_OUTOFMEMORY;
2175     stub->lpvtbl        = &tmstubvtbl;
2176     stub->ref           = 1;
2177     stub->tinfo         = tinfo;
2178     memcpy(&(stub->iid),riid,sizeof(*riid));
2179     hres = IRpcStubBuffer_Connect((LPRPCSTUBBUFFER)stub,pUnkServer);
2180     *ppStub             = (LPRPCSTUBBUFFER)stub;
2181     TRACE("IRpcStubBuffer: %p\n", stub);
2182     if (hres)
2183         ERR("Connect to pUnkServer failed?\n");
2184     return hres;
2185 }
2186
2187 static IPSFactoryBufferVtbl psfacbufvtbl = {
2188     PSFacBuf_QueryInterface,
2189     PSFacBuf_AddRef,
2190     PSFacBuf_Release,
2191     PSFacBuf_CreateProxy,
2192     PSFacBuf_CreateStub
2193 };
2194
2195 /* This is the whole PSFactoryBuffer object, just the vtableptr */
2196 static IPSFactoryBufferVtbl *lppsfac = &psfacbufvtbl;
2197
2198 /***********************************************************************
2199  *           DllGetClassObject [OLE32.63]
2200  */
2201 HRESULT WINAPI
2202 TypeLibFac_DllGetClassObject(REFCLSID rclsid, REFIID iid,LPVOID *ppv)
2203 {
2204     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)) {
2205         *ppv = &lppsfac;
2206         return S_OK;
2207     }
2208     return E_NOINTERFACE;
2209 }