dll/win32/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #define COBJMACROS
  26 #define NONAMELESSUNION
  27 #define NONAMELESSSTRUCT
  28
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "wingdi.h"
  32 #include "winuser.h"
  33 #include "winerror.h"
  34
  35 #include "ole2.h"
  36 #include "oleauto.h"
  37 #include "typelib.h"
  38 #include "ocidl.h"
  39 #include "wine/debug.h"
  40
  41 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  42
  43 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  44 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  45 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  46 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  47
  48 static void dump_user_flags(const ULONG *pFlags)
  49 {
  50     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  51         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  52     else
  53         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  54     switch (LOWORD(*pFlags))
  55     {
  56         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  57         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  58         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  59         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  60         default: TRACE("%d)", LOWORD(*pFlags));
  61     }
  62 }
  63
  64 /* CLEANLOCALSTORAGE */
  65
  66 #define CLS_FUNCDESC  'f'
  67 #define CLS_LIBATTR   'l'
  68 #define CLS_TYPEATTR  't'
  69 #define CLS_VARDESC   'v'
  70
  71 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  72 {
  73     ALIGN_LENGTH(Start, 3);
  74     return Start + sizeof(DWORD);
  75 }
  76
  77 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  78 {
  79     ALIGN_POINTER(Buffer, 3);
  80     *(DWORD*)Buffer = pstg->flags;
  81     switch(pstg->flags)
  82     {
  83     case CLS_LIBATTR:
  84         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
  85         break;
  86     case CLS_TYPEATTR:
  87         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
  88         break;
  89     case CLS_FUNCDESC:
  90         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
  91         break;
  92     case CLS_VARDESC:
  93         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
  94         break;
  95
  96     default:
  97         ERR("Unknown type %x\n", pstg->flags);
  98     }
  99
 100     *(VOID**)pstg->pStorage = NULL;
 101     IUnknown_Release(pstg->pInterface);
 102     pstg->pInterface = NULL;
 103
 104     return Buffer + sizeof(DWORD);
 105 }
 106
 107 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
 108 {
 109     ALIGN_POINTER(Buffer, 3);
 110     pstr->flags = *(DWORD*)Buffer;
 111     return Buffer + sizeof(DWORD);
 112 }
 113
 114 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
 115 {
 116     /* Nothing to do */
 117 }
 118
 119 /* BSTR */
 120
 121 typedef struct
 122 {
 123     DWORD len;          /* No. of chars not including trailing '\0' */
 124     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 125     DWORD len2;         /* == len */
 126 } bstr_wire_t;
 127
 128 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 129 {
 130     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 131     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 132     ALIGN_LENGTH(Start, 3);
 133     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 134     TRACE("returning %d\n", Start);
 135     return Start;
 136 }
 137
 138 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 139 {
 140     bstr_wire_t *header;
 141     DWORD len = SysStringByteLen(*pstr);
 142
 143     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 144     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 145
 146     ALIGN_POINTER(Buffer, 3);
 147     header = (bstr_wire_t*)Buffer;
 148     header->len = header->len2 = (len + 1) / 2;
 149     if (*pstr)
 150     {
 151         header->byte_len = len;
 152         memcpy(header + 1, *pstr, header->len * 2);
 153     }
 154     else
 155         header->byte_len = 0xffffffff; /* special case for a null bstr */
 156
 157     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 158 }
 159
 160 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 161 {
 162     bstr_wire_t *header;
 163     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 164
 165     ALIGN_POINTER(Buffer, 3);
 166     header = (bstr_wire_t*)Buffer;
 167     if(header->len != header->len2)
 168         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 169
 170     SysFreeString(*pstr);
 171     *pstr = NULL;
 172
 173     if(header->byte_len != 0xffffffff)
 174         *pstr = SysAllocStringByteLen((char*)(header + 1), header->byte_len);
 175
 176     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 177     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 178 }
 179
 180 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 181 {
 182     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 183     SysFreeString(*pstr);
 184     *pstr = NULL;
 185 }
 186
 187 /* VARIANT */
 188
 189 typedef struct
 190 {
 191     DWORD clSize;
 192     DWORD rpcReserverd;
 193     USHORT vt;
 194     USHORT wReserved1;
 195     USHORT wReserved2;
 196     USHORT wReserved3;
 197     DWORD switch_is;
 198 } variant_wire_t;
 199
 200 static unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 201 {
 202     if (vt & VT_ARRAY) return 4;
 203
 204     switch (vt & ~VT_BYREF) {
 205     case VT_EMPTY:
 206     case VT_NULL:
 207         return 0;
 208     case VT_I1:
 209     case VT_UI1:
 210         return sizeof(CHAR);
 211     case VT_I2:
 212     case VT_UI2:
 213         return sizeof(SHORT);
 214     case VT_I4:
 215     case VT_UI4:
 216         return sizeof(LONG);
 217     case VT_INT:
 218     case VT_UINT:
 219         return sizeof(INT);
 220     case VT_R4:
 221         return sizeof(FLOAT);
 222     case VT_R8:
 223         return sizeof(DOUBLE);
 224     case VT_BOOL:
 225         return sizeof(VARIANT_BOOL);
 226     case VT_ERROR:
 227         return sizeof(SCODE);
 228     case VT_DATE:
 229         return sizeof(DATE);
 230     case VT_CY:
 231         return sizeof(CY);
 232     case VT_DECIMAL:
 233         return sizeof(DECIMAL);
 234     case VT_BSTR:
 235         return sizeof(ULONG);
 236     case VT_VARIANT:
 237         return sizeof(VARIANT);
 238     case VT_UNKNOWN:
 239     case VT_DISPATCH:
 240     case VT_RECORD:
 241         return 0;
 242     default:
 243         FIXME("unhandled VT %d\n", vt);
 244         return 0;
 245     }
 246 }
 247
 248 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 249 {
 250     unsigned int size = get_type_size(pFlags, vt);
 251     if(vt & VT_BYREF) return 3;
 252     if(size == 0) return 0;
 253     if(size <= 4) return size - 1;
 254     return 7;
 255 }
 256
 257 static unsigned interface_variant_size(const ULONG *pFlags, REFIID riid, IUnknown *punk)
 258 {
 259     ULONG size = 0;
 260     HRESULT hr;
 261
 262     if (punk)
 263     {
 264         hr = CoGetMarshalSizeMax(&size, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 265         if (FAILED(hr))
 266         {
 267             ERR("interface variant buffer size calculation failed, HRESULT=0x%x\n", hr);
 268             return 0;
 269         }
 270     }
 271     size += sizeof(ULONG); /* we have to store the buffersize in the stream */
 272     TRACE("wire-size extra of interface variant is %d\n", size);
 273     return size;
 274 }
 275
 276 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 277 {
 278   if (V_ISARRAY(pvar))
 279   {
 280     if (V_ISBYREF(pvar))
 281       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 282     else
 283       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 284   }
 285
 286   switch (V_VT(pvar)) {
 287   case VT_BSTR:
 288     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 289   case VT_BSTR | VT_BYREF:
 290     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 291   case VT_VARIANT | VT_BYREF:
 292     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 293   case VT_UNKNOWN:
 294     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 295   case VT_UNKNOWN | VT_BYREF:
 296     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 297   case VT_DISPATCH:
 298     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 299   case VT_DISPATCH | VT_BYREF:
 300     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 301   case VT_RECORD:
 302     FIXME("wire-size record\n");
 303     return Start;
 304   case VT_SAFEARRAY:
 305   case VT_SAFEARRAY | VT_BYREF:
 306     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 307     return Start;
 308   default:
 309     return Start;
 310   }
 311 }
 312
 313 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer. returns Buffer on failure, new position otherwise */
 314 static unsigned char* interface_variant_marshal(const ULONG *pFlags, unsigned char *Buffer,
 315                                                 REFIID riid, IUnknown *punk)
 316 {
 317   IStream *working;
 318   HGLOBAL working_mem;
 319   void *working_memlocked;
 320   unsigned char *oldpos;
 321   ULONG size;
 322   HRESULT hr;
 323
 324   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 325
 326   if(!punk)
 327   {
 328       memset(Buffer, 0, sizeof(ULONG));
 329       return Buffer + sizeof(ULONG);
 330   }
 331
 332   oldpos = Buffer;
 333
 334   /* CoMarshalInterface needs a stream, whereas at this level we are operating in terms of buffers.
 335    * We create a stream on an HGLOBAL, so we can simply do a memcpy to move it to the buffer.
 336    * in rpcrt4/ndr_ole.c, a simple IStream implementation is wrapped around the buffer object,
 337    * but that would be overkill here, hence this implementation. We save the size because the unmarshal
 338    * code has no way to know how long the marshalled buffer is. */
 339
 340   size = interface_variant_size(pFlags, riid, punk);
 341
 342   working_mem = GlobalAlloc(0, size);
 343   if (!working_mem) return oldpos;
 344
 345   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 346   if (hr != S_OK) {
 347     GlobalFree(working_mem);
 348     return oldpos;
 349   }
 350
 351   hr = CoMarshalInterface(working, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 352   if (hr != S_OK) {
 353     IStream_Release(working); /* this also releases the hglobal */
 354     return oldpos;
 355   }
 356
 357   working_memlocked = GlobalLock(working_mem);
 358   memcpy(Buffer, &size, sizeof(ULONG)); /* copy the buffersize */
 359   memcpy(Buffer + sizeof(ULONG), working_memlocked, size - sizeof(ULONG));
 360   GlobalUnlock(working_mem);
 361
 362   IStream_Release(working);
 363
 364   /* size includes the ULONG for the size written above */
 365   TRACE("done, size=%d\n", size);
 366   return Buffer + size;
 367 }
 368
 369 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer. returns Buffer on failure, new position otherwise */
 370 static unsigned char *interface_variant_unmarshal(const ULONG *pFlags, unsigned char *Buffer,
 371                                                   REFIID riid, IUnknown **ppunk)
 372 {
 373   IStream *working;
 374   HGLOBAL working_mem;
 375   void *working_memlocked;
 376   unsigned char *oldpos;
 377   ULONG size;
 378   HRESULT hr;
 379
 380   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 381
 382   oldpos = Buffer;
 383
 384   /* get the buffersize */
 385   memcpy(&size, Buffer, sizeof(ULONG));
 386   TRACE("buffersize=%d\n", size);
 387
 388   if(!size)
 389   {
 390       *ppunk = NULL;
 391       return Buffer + sizeof(ULONG);
 392   }
 393
 394   working_mem = GlobalAlloc(0, size);
 395   if (!working_mem) return oldpos;
 396
 397   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 398   if (hr != S_OK) {
 399     GlobalFree(working_mem);
 400     return oldpos;
 401   }
 402
 403   working_memlocked = GlobalLock(working_mem);
 404
 405   /* now we copy the contents of the marshalling buffer to working_memlocked, unlock it, and demarshal the stream */
 406   memcpy(working_memlocked, Buffer + sizeof(ULONG), size);
 407   GlobalUnlock(working_mem);
 408
 409   hr = CoUnmarshalInterface(working, riid, (void**)ppunk);
 410   if (hr != S_OK) {
 411     IStream_Release(working);
 412     return oldpos;
 413   }
 414
 415   IStream_Release(working); /* this also frees the underlying hglobal */
 416
 417   /* size includes the ULONG for the size written above */
 418   TRACE("done, processed=%d bytes\n", size);
 419   return Buffer + size;
 420 }
 421
 422
 423 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 424 {
 425     int align;
 426     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 427     TRACE("vt=%04x\n", V_VT(pvar));
 428
 429     ALIGN_LENGTH(Start, 7);
 430     Start += sizeof(variant_wire_t);
 431     if(V_VT(pvar) & VT_BYREF)
 432         Start += 4;
 433
 434     align = get_type_alignment(pFlags, V_VT(pvar));
 435     ALIGN_LENGTH(Start, align);
 436     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 437         Start += 4;
 438     else
 439         Start += get_type_size(pFlags, V_VT(pvar));
 440     Start = wire_extra_user_size(pFlags, Start, pvar);
 441
 442     TRACE("returning %d\n", Start);
 443     return Start;
 444 }
 445
 446 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 447 {
 448     variant_wire_t *header;
 449     ULONG type_size;
 450     int align;
 451     unsigned char *Pos;
 452
 453     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 454     TRACE("vt=%04x\n", V_VT(pvar));
 455
 456     ALIGN_POINTER(Buffer, 7);
 457
 458     header = (variant_wire_t *)Buffer;
 459
 460     header->clSize = 0; /* fixed up at the end */
 461     header->rpcReserverd = 0;
 462     header->vt = pvar->n1.n2.vt;
 463     header->wReserved1 = pvar->n1.n2.wReserved1;
 464     header->wReserved2 = pvar->n1.n2.wReserved2;
 465     header->wReserved3 = pvar->n1.n2.wReserved3;
 466     header->switch_is = pvar->n1.n2.vt;
 467     if(header->switch_is & VT_ARRAY)
 468         header->switch_is &= ~VT_TYPEMASK;
 469
 470     Pos = (unsigned char*)(header + 1);
 471     type_size = get_type_size(pFlags, V_VT(pvar));
 472     align = get_type_alignment(pFlags, V_VT(pvar));
 473     ALIGN_POINTER(Pos, align);
 474
 475     if(header->vt & VT_BYREF)
 476     {
 477         *(DWORD *)Pos = max(type_size, 4);
 478         Pos += 4;
 479         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 480         {
 481             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 482             Pos += type_size;
 483         }
 484         else
 485         {
 486             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 487             Pos += 4;
 488         }
 489     }
 490     else
 491     {
 492         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 493             memcpy(Pos, pvar, type_size);
 494         else
 495             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 496         Pos += type_size;
 497     }
 498
 499     if(header->vt & VT_ARRAY)
 500     {
 501         if(header->vt & VT_BYREF)
 502             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 503         else
 504             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 505     }
 506     else
 507     {
 508         switch (header->vt)
 509         {
 510         case VT_BSTR:
 511             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 512             break;
 513         case VT_BSTR | VT_BYREF:
 514             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 515             break;
 516         case VT_VARIANT | VT_BYREF:
 517             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 518             break;
 519         case VT_UNKNOWN:
 520             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 521             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 522             break;
 523         case VT_UNKNOWN | VT_BYREF:
 524             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 525             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 526             break;
 527         case VT_DISPATCH:
 528             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 529             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 530             break;
 531         case VT_DISPATCH | VT_BYREF:
 532             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 533             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 534             break;
 535         case VT_RECORD:
 536             FIXME("handle BRECORD by val\n");
 537             break;
 538         case VT_RECORD | VT_BYREF:
 539             FIXME("handle BRECORD by ref\n");
 540             break;
 541         }
 542     }
 543     header->clSize = ((Pos - Buffer) + 7) >> 3;
 544     TRACE("marshalled size=%d\n", header->clSize);
 545     return Pos;
 546 }
 547
 548 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 549 {
 550     variant_wire_t *header;
 551     ULONG type_size;
 552     int align;
 553     unsigned char *Pos;
 554
 555     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 556
 557     ALIGN_POINTER(Buffer, 7);
 558
 559     header = (variant_wire_t *)Buffer;
 560
 561     Pos = (unsigned char*)(header + 1);
 562     type_size = get_type_size(pFlags, header->vt);
 563     align = get_type_alignment(pFlags, header->vt);
 564     ALIGN_POINTER(Pos, align);
 565
 566     if(header->vt & VT_BYREF)
 567     {
 568         ULONG mem_size;
 569         Pos += 4;
 570
 571         switch (header->vt & ~VT_BYREF)
 572         {
 573         /* these types have a different memory size compared to wire size */
 574         case VT_UNKNOWN:
 575         case VT_DISPATCH:
 576         case VT_BSTR:
 577             mem_size = sizeof(void *);
 578             break;
 579         default:
 580             mem_size = type_size;
 581             break;
 582         }
 583
 584         if (V_VT(pvar) != header->vt)
 585         {
 586             VariantClear(pvar);
 587             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 588         }
 589         else if (!V_BYREF(pvar))
 590             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 591         memcpy(V_BYREF(pvar), Pos, type_size);
 592         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 593             Pos += type_size;
 594         else
 595             Pos += 4;
 596     }
 597     else
 598     {
 599         VariantClear(pvar);
 600         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 601             memcpy(pvar, Pos, type_size);
 602         else
 603             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 604         Pos += type_size;
 605     }
 606
 607     pvar->n1.n2.vt = header->vt;
 608     pvar->n1.n2.wReserved1 = header->wReserved1;
 609     pvar->n1.n2.wReserved2 = header->wReserved2;
 610     pvar->n1.n2.wReserved3 = header->wReserved3;
 611
 612     if(header->vt & VT_ARRAY)
 613     {
 614         if(header->vt & VT_BYREF)
 615             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 616         else
 617             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 618     }
 619     else
 620     {
 621         switch (header->vt)
 622         {
 623         case VT_BSTR:
 624             V_BSTR(pvar) = NULL;
 625             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 626             break;
 627         case VT_BSTR | VT_BYREF:
 628             *V_BSTRREF(pvar) = NULL;
 629             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 630             break;
 631         case VT_VARIANT | VT_BYREF:
 632             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 633             break;
 634         case VT_UNKNOWN:
 635             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 636             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 637             break;
 638         case VT_UNKNOWN | VT_BYREF:
 639             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 640             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 641             break;
 642         case VT_DISPATCH:
 643             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 644             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 645             break;
 646         case VT_DISPATCH | VT_BYREF:
 647             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 648             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 649             break;
 650         case VT_RECORD:
 651             FIXME("handle BRECORD by val\n");
 652             break;
 653         case VT_RECORD | VT_BYREF:
 654             FIXME("handle BRECORD by ref\n");
 655             break;
 656         }
 657     }
 658     return Pos;
 659 }
 660
 661 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 662 {
 663   VARTYPE vt = V_VT(pvar);
 664   PVOID ref = NULL;
 665
 666   TRACE("(%x,%p)\n", *pFlags, pvar);
 667   TRACE("vt=%04x\n", V_VT(pvar));
 668
 669   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 670
 671   VariantClear(pvar);
 672   if (!ref) return;
 673
 674   if(vt & VT_ARRAY)
 675   {
 676     if (vt & VT_BYREF)
 677       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 678     else
 679       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 680   }
 681   else
 682   {
 683     switch (vt)
 684     {
 685     case VT_BSTR | VT_BYREF:
 686       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 687       break;
 688     case VT_VARIANT | VT_BYREF:
 689       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 690       break;
 691     case VT_RECORD | VT_BYREF:
 692       FIXME("handle BRECORD by ref\n");
 693       break;
 694     case VT_UNKNOWN | VT_BYREF:
 695     case VT_DISPATCH | VT_BYREF:
 696       IUnknown_Release(*V_UNKNOWNREF(pvar));
 697       break;
 698     }
 699   }
 700
 701   CoTaskMemFree(ref);
 702 }
 703
 704 /* LPSAFEARRAY */
 705
 706 /* Get the number of cells in a SafeArray */
 707 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 708 {
 709     const SAFEARRAYBOUND* psab = psa->rgsabound;
 710     USHORT cCount = psa->cDims;
 711     ULONG ulNumCells = 1;
 712
 713     while (cCount--)
 714     {
 715         /* This is a valid bordercase. See testcases. -Marcus */
 716         if (!psab->cElements)
 717             return 0;
 718         ulNumCells *= psab->cElements;
 719         psab++;
 720     }
 721     return ulNumCells;
 722 }
 723
 724 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 725 {
 726     VARTYPE vt;
 727     HRESULT hr;
 728
 729     hr = SafeArrayGetVartype(psa, &vt);
 730     if (FAILED(hr))
 731     {
 732         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 733
 734         switch(psa->cbElements)
 735         {
 736         case 1: vt = VT_I1; break;
 737         case 2: vt = VT_I2; break;
 738         case 4: vt = VT_I4; break;
 739         case 8: vt = VT_I8; break;
 740         default:
 741             RpcRaiseException(hr);
 742         }
 743     }
 744
 745     if (psa->fFeatures & FADF_HAVEIID)
 746         return SF_HAVEIID;
 747
 748     switch (vt)
 749     {
 750     case VT_I1:
 751     case VT_UI1:      return SF_I1;
 752     case VT_BOOL:
 753     case VT_I2:
 754     case VT_UI2:      return SF_I2;
 755     case VT_INT:
 756     case VT_UINT:
 757     case VT_I4:
 758     case VT_UI4:
 759     case VT_R4:       return SF_I4;
 760     case VT_DATE:
 761     case VT_CY:
 762     case VT_R8:
 763     case VT_I8:
 764     case VT_UI8:      return SF_I8;
 765     case VT_INT_PTR:
 766     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 767     case VT_BSTR:     return SF_BSTR;
 768     case VT_DISPATCH: return SF_DISPATCH;
 769     case VT_VARIANT:  return SF_VARIANT;
 770     case VT_UNKNOWN:  return SF_UNKNOWN;
 771     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 772      * of a UDT is taken from the result of IRecordInfo_GetSize().
 773      */
 774     case VT_RECORD:   return SF_RECORD;
 775     default:          return SF_ERROR;
 776     }
 777 }
 778
 779 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 780 {
 781     if (sftype == SF_BSTR)
 782         return sizeof(DWORD);
 783     else if (sftype == SF_VARIANT)
 784         return sizeof(variant_wire_t) - sizeof(DWORD);
 785     else
 786         return lpsa->cbElements;
 787 }
 788
 789 static DWORD elem_mem_size(wireSAFEARRAY wiresa, SF_TYPE sftype)
 790 {
 791     if (sftype == SF_BSTR)
 792         return sizeof(BSTR);
 793     else if (sftype == SF_VARIANT)
 794         return sizeof(VARIANT);
 795     else
 796         return wiresa->cbElements;
 797 }
 798
 799 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 800 {
 801     ULONG size = StartingSize;
 802
 803     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 804
 805     ALIGN_LENGTH(size, 3);
 806     size += sizeof(ULONG);
 807     if (*ppsa)
 808     {
 809         SAFEARRAY *psa = *ppsa;
 810         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 811         SF_TYPE sftype;
 812         HRESULT hr;
 813
 814         size += sizeof(ULONG);
 815         size += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 816
 817         sftype = SAFEARRAY_GetUnionType(psa);
 818         size += sizeof(ULONG);
 819
 820         size += sizeof(ULONG);
 821         size += sizeof(ULONG);
 822         if (sftype == SF_HAVEIID)
 823             size += sizeof(IID);
 824
 825         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 826
 827         size += sizeof(ULONG);
 828
 829         switch (sftype)
 830         {
 831             case SF_BSTR:
 832             {
 833                 BSTR* lpBstr;
 834
 835                 for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 836                     size = BSTR_UserSize(pFlags, size, lpBstr);
 837
 838                 break;
 839             }
 840             case SF_DISPATCH:
 841             case SF_UNKNOWN:
 842             case SF_HAVEIID:
 843                 FIXME("size interfaces\n");
 844                 break;
 845             case SF_VARIANT:
 846             {
 847                 VARIANT* lpVariant;
 848
 849                 for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 850                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 851
 852                 break;
 853             }
 854             case SF_RECORD:
 855             {
 856                 IRecordInfo* pRecInfo = NULL;
 857
 858                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 859                 if (FAILED(hr))
 860                     RpcRaiseException(hr);
 861
 862                 if (pRecInfo)
 863                 {
 864                     FIXME("size record info %p\n", pRecInfo);
 865
 866                     IRecordInfo_Release(pRecInfo);
 867                 }
 868                 break;
 869             }
 870             case SF_I8:
 871                 ALIGN_LENGTH(size, 7);
 872                 /* fallthrough */
 873             case SF_I1:
 874             case SF_I2:
 875             case SF_I4:
 876                 size += ulCellCount * psa->cbElements;
 877                 break;
 878             default:
 879                 break;
 880         }
 881
 882     }
 883
 884     return size;
 885 }
 886
 887 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 888 {
 889     HRESULT hr;
 890
 891     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 892
 893     ALIGN_POINTER(Buffer, 3);
 894     *(ULONG *)Buffer = *ppsa ? 0x1 : 0x0;
 895     Buffer += sizeof(ULONG);
 896     if (*ppsa)
 897     {
 898         VARTYPE vt;
 899         SAFEARRAY *psa = *ppsa;
 900         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 901         SF_TYPE sftype;
 902         GUID guid;
 903
 904         sftype = SAFEARRAY_GetUnionType(psa);
 905
 906         *(ULONG *)Buffer = psa->cDims;
 907         Buffer += sizeof(ULONG);
 908         *(USHORT *)Buffer = psa->cDims;
 909         Buffer += sizeof(USHORT);
 910         *(USHORT *)Buffer = psa->fFeatures;
 911         Buffer += sizeof(USHORT);
 912         *(ULONG *)Buffer = elem_wire_size(psa, sftype);
 913         Buffer += sizeof(ULONG);
 914
 915         hr = SafeArrayGetVartype(psa, &vt);
 916         if (FAILED(hr)) vt = 0;
 917
 918         *(ULONG *)Buffer = (USHORT)psa->cLocks | (vt << 16);
 919         Buffer += sizeof(ULONG);
 920
 921         *(ULONG *)Buffer = sftype;
 922         Buffer += sizeof(ULONG);
 923
 924         *(ULONG *)Buffer = ulCellCount;
 925         Buffer += sizeof(ULONG);
 926         *(ULONG *)Buffer = psa->pvData ? 0x2 : 0x0;
 927         Buffer += sizeof(ULONG);
 928         if (sftype == SF_HAVEIID)
 929         {
 930             SafeArrayGetIID(psa, &guid);
 931             memcpy(Buffer, &guid, sizeof(guid));
 932             Buffer += sizeof(guid);
 933         }
 934
 935         memcpy(Buffer, psa->rgsabound, sizeof(psa->rgsabound[0]) * psa->cDims);
 936         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 937
 938         *(ULONG *)Buffer = ulCellCount;
 939         Buffer += sizeof(ULONG);
 940
 941         if (psa->pvData)
 942         {
 943             switch (sftype)
 944             {
 945                 case SF_BSTR:
 946                 {
 947                     BSTR* lpBstr;
 948
 949                     for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 950                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 951
 952                     break;
 953                 }
 954                 case SF_DISPATCH:
 955                 case SF_UNKNOWN:
 956                 case SF_HAVEIID:
 957                     FIXME("marshal interfaces\n");
 958                     break;
 959                 case SF_VARIANT:
 960                 {
 961                     VARIANT* lpVariant;
 962
 963                     for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 964                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 965
 966                     break;
 967                 }
 968                 case SF_RECORD:
 969                 {
 970                     IRecordInfo* pRecInfo = NULL;
 971
 972                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 973                     if (FAILED(hr))
 974                         RpcRaiseException(hr);
 975
 976                     if (pRecInfo)
 977                     {
 978                         FIXME("write record info %p\n", pRecInfo);
 979
 980                         IRecordInfo_Release(pRecInfo);
 981                     }
 982                     break;
 983                 }
 984
 985                 case SF_I8:
 986                     ALIGN_POINTER(Buffer, 7);
 987                     /* fallthrough */
 988                 case SF_I1:
 989                 case SF_I2:
 990                 case SF_I4:
 991                     /* Just copy the data over */
 992                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
 993                     Buffer += ulCellCount * psa->cbElements;
 994                     break;
 995                 default:
 996                     break;
 997             }
 998         }
 999
1000     }
1001     return Buffer;
1002 }
1003
1004 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
1005                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
1006                            FADF_VARIANT | FADF_CREATEVECTOR)
1007
1008 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
1009 {
1010     ULONG ptr;
1011     wireSAFEARRAY wiresa;
1012     ULONG cDims;
1013     HRESULT hr;
1014     SF_TYPE sftype;
1015     ULONG cell_count;
1016     GUID guid;
1017     VARTYPE vt;
1018     SAFEARRAYBOUND *wiresab;
1019
1020     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
1021
1022     ALIGN_POINTER(Buffer, 3);
1023     ptr = *(ULONG *)Buffer;
1024     Buffer += sizeof(ULONG);
1025
1026     if (!ptr)
1027     {
1028         *ppsa = NULL;
1029
1030         TRACE("NULL safe array unmarshaled\n");
1031
1032         return Buffer;
1033     }
1034
1035     cDims = *(ULONG *)Buffer;
1036     Buffer += sizeof(ULONG);
1037
1038     wiresa = (wireSAFEARRAY)Buffer;
1039     Buffer += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
1040
1041     if (cDims != wiresa->cDims)
1042         RpcRaiseException(RPC_S_INVALID_BOUND);
1043
1044     /* FIXME: there should be a limit on how large cDims can be */
1045
1046     vt = HIWORD(wiresa->cLocks);
1047
1048     sftype = *(ULONG *)Buffer;
1049     Buffer += sizeof(ULONG);
1050
1051     cell_count = *(ULONG *)Buffer;
1052     Buffer += sizeof(ULONG);
1053     ptr = *(ULONG *)Buffer;
1054     Buffer += sizeof(ULONG);
1055     if (sftype == SF_HAVEIID)
1056     {
1057         memcpy(&guid, Buffer, sizeof(guid));
1058         Buffer += sizeof(guid);
1059     }
1060
1061     wiresab = (SAFEARRAYBOUND *)Buffer;
1062     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1063
1064     if(vt)
1065         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1066     else
1067     {
1068         SafeArrayAllocDescriptor(wiresa->cDims, ppsa);
1069         if(*ppsa)
1070             memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1071     }
1072     if (!*ppsa)
1073         RpcRaiseException(E_OUTOFMEMORY);
1074
1075     /* be careful about which flags we set since they could be a security
1076      * risk */
1077     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1078     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1079     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1080     (*ppsa)->cbElements = elem_mem_size(wiresa, sftype);
1081     (*ppsa)->cLocks = LOWORD(wiresa->cLocks);
1082
1083     /* SafeArrayCreateEx allocates the data for us, but
1084      * SafeArrayAllocDescriptor doesn't */
1085     if(!vt)
1086     {
1087         hr = SafeArrayAllocData(*ppsa);
1088         if (FAILED(hr))
1089             RpcRaiseException(hr);
1090     }
1091
1092     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1093         RpcRaiseException(RPC_S_INVALID_BOUND);
1094     Buffer += sizeof(ULONG);
1095
1096     if (ptr)
1097     {
1098         switch (sftype)
1099         {
1100             case SF_BSTR:
1101             {
1102                 BSTR* lpBstr;
1103
1104                 for (lpBstr = (*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1105                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1106
1107                 break;
1108             }
1109             case SF_DISPATCH:
1110             case SF_UNKNOWN:
1111             case SF_HAVEIID:
1112                 FIXME("marshal interfaces\n");
1113                 break;
1114             case SF_VARIANT:
1115             {
1116                 VARIANT* lpVariant;
1117
1118                 for (lpVariant = (*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1119                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1120
1121                 break;
1122             }
1123             case SF_RECORD:
1124             {
1125                 FIXME("set record info\n");
1126
1127                 break;
1128             }
1129
1130             case SF_I8:
1131                 ALIGN_POINTER(Buffer, 7);
1132                 /* fallthrough */
1133             case SF_I1:
1134             case SF_I2:
1135             case SF_I4:
1136                 /* Just copy the data over */
1137                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1138                 Buffer += cell_count * (*ppsa)->cbElements;
1139                 break;
1140             default:
1141                 break;
1142         }
1143     }
1144
1145     TRACE("safe array unmarshaled: %p\n", *ppsa);
1146
1147     return Buffer;
1148 }
1149
1150 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1151 {
1152     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1153
1154     SafeArrayDestroy(*ppsa);
1155 }
1156
1157
1158 ULONG WINAPI HFONT_UserSize(ULONG *pFlags, ULONG Start, HFONT *phfont)
1159 {
1160     FIXME(":stub\n");
1161     return 0;
1162 }
1163
1164 unsigned char * WINAPI HFONT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1165 {
1166     FIXME(":stub\n");
1167     return NULL;
1168 }
1169
1170 unsigned char * WINAPI HFONT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1171 {
1172     FIXME(":stub\n");
1173     return NULL;
1174 }
1175
1176 void WINAPI HFONT_UserFree(ULONG *pFlags, HFONT *phfont)
1177 {
1178     FIXME(":stub\n");
1179     return;
1180 }
1181
1182
1183 /* IDispatch */
1184 /* exactly how Invoke is marshalled is not very clear to me yet,
1185  * but the way I've done it seems to work for me */
1186
1187 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1188     IDispatch* This,
1189     DISPID dispIdMember,
1190     REFIID riid,
1191     LCID lcid,
1192     WORD wFlags,
1193     DISPPARAMS* pDispParams,
1194     VARIANT* pVarResult,
1195     EXCEPINFO* pExcepInfo,
1196     UINT* puArgErr)
1197 {
1198   HRESULT hr;
1199   VARIANT VarResult;
1200   UINT* rgVarRefIdx = NULL;
1201   VARIANTARG* rgVarRef = NULL;
1202   UINT u, cVarRef;
1203   UINT uArgErr;
1204   EXCEPINFO ExcepInfo;
1205
1206   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1207         dispIdMember, debugstr_guid(riid),
1208         lcid, wFlags, pDispParams, pVarResult,
1209         pExcepInfo, puArgErr);
1210
1211   /* [out] args can't be null, use dummy vars if needed */
1212   if (!pVarResult) pVarResult = &VarResult;
1213   if (!puArgErr) puArgErr = &uArgErr;
1214   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1215
1216   /* count by-ref args */
1217   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1218     VARIANTARG* arg = &pDispParams->rgvarg[u];
1219     if (V_ISBYREF(arg)) {
1220       cVarRef++;
1221     }
1222   }
1223   if (cVarRef) {
1224     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1225     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1226     /* make list of by-ref args */
1227     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1228       VARIANTARG* arg = &pDispParams->rgvarg[u];
1229       if (V_ISBYREF(arg)) {
1230         rgVarRefIdx[cVarRef] = u;
1231         VariantInit(&rgVarRef[cVarRef]);
1232         VariantCopy(&rgVarRef[cVarRef], arg);
1233         VariantClear(arg);
1234         cVarRef++;
1235       }
1236     }
1237   } else {
1238     /* [out] args still can't be null,
1239      * but we can point these anywhere in this case,
1240      * since they won't be written to when cVarRef is 0 */
1241     rgVarRefIdx = puArgErr;
1242     rgVarRef = pVarResult;
1243   }
1244   TRACE("passed by ref: %d args\n", cVarRef);
1245   hr = IDispatch_RemoteInvoke_Proxy(This,
1246                                     dispIdMember,
1247                                     riid,
1248                                     lcid,
1249                                     wFlags,
1250                                     pDispParams,
1251                                     pVarResult,
1252                                     pExcepInfo,
1253                                     puArgErr,
1254                                     cVarRef,
1255                                     rgVarRefIdx,
1256                                     rgVarRef);
1257   if (cVarRef) {
1258     for (u=0; u<cVarRef; u++) {
1259       unsigned i = rgVarRefIdx[u];
1260       VariantCopy(&pDispParams->rgvarg[i],
1261                   &rgVarRef[u]);
1262       VariantClear(&rgVarRef[u]);
1263     }
1264     CoTaskMemFree(rgVarRef);
1265     CoTaskMemFree(rgVarRefIdx);
1266   }
1267
1268   if(pExcepInfo == &ExcepInfo)
1269   {
1270     SysFreeString(pExcepInfo->bstrSource);
1271     SysFreeString(pExcepInfo->bstrDescription);
1272     SysFreeString(pExcepInfo->bstrHelpFile);
1273   }
1274   return hr;
1275 }
1276
1277 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1278     IDispatch* This,
1279     DISPID dispIdMember,
1280     REFIID riid,
1281     LCID lcid,
1282     DWORD dwFlags,
1283     DISPPARAMS* pDispParams,
1284     VARIANT* pVarResult,
1285     EXCEPINFO* pExcepInfo,
1286     UINT* pArgErr,
1287     UINT cVarRef,
1288     UINT* rgVarRefIdx,
1289     VARIANTARG* rgVarRef)
1290 {
1291   HRESULT hr = S_OK;
1292   VARIANTARG *rgvarg, *arg;
1293   UINT u;
1294
1295   /* initialize out parameters, so that they can be marshalled
1296    * in case the real Invoke doesn't initialize them */
1297   VariantInit(pVarResult);
1298   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1299   *pArgErr = 0;
1300
1301   /* let the real Invoke operate on a copy of the in parameters,
1302    * so we don't risk losing pointers to allocated memory */
1303   rgvarg = pDispParams->rgvarg;
1304   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1305   if (!arg) return E_OUTOFMEMORY;
1306
1307   /* init all args so we can call VariantClear on all the args if the copy
1308    * below fails */
1309   for (u = 0; u < pDispParams->cArgs; u++)
1310     VariantInit(&arg[u]);
1311
1312   for (u = 0; u < pDispParams->cArgs; u++) {
1313     hr = VariantCopy(&arg[u], &rgvarg[u]);
1314     if (FAILED(hr))
1315         break;
1316   }
1317
1318   if (SUCCEEDED(hr)) {
1319     /* copy ref args to arg array */
1320     for (u=0; u<cVarRef; u++) {
1321       unsigned i = rgVarRefIdx[u];
1322       VariantCopy(&arg[i], &rgVarRef[u]);
1323     }
1324
1325     pDispParams->rgvarg = arg;
1326
1327     hr = IDispatch_Invoke(This,
1328                           dispIdMember,
1329                           riid,
1330                           lcid,
1331                           dwFlags,
1332                           pDispParams,
1333                           pVarResult,
1334                           pExcepInfo,
1335                           pArgErr);
1336
1337     /* copy ref args from arg array */
1338     for (u=0; u<cVarRef; u++) {
1339       unsigned i = rgVarRefIdx[u];
1340       VariantCopy(&rgVarRef[u], &arg[i]);
1341     }
1342   }
1343
1344   /* clear the duplicate argument list */
1345   for (u=0; u<pDispParams->cArgs; u++)
1346     VariantClear(&arg[u]);
1347
1348   pDispParams->rgvarg = rgvarg;
1349   CoTaskMemFree(arg);
1350
1351   return hr;
1352 }
1353
1354 /* IEnumVARIANT */
1355
1356 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1357     IEnumVARIANT* This,
1358     ULONG celt,
1359     VARIANT* rgVar,
1360     ULONG* pCeltFetched)
1361 {
1362   ULONG fetched;
1363   if (!pCeltFetched)
1364     pCeltFetched = &fetched;
1365   return IEnumVARIANT_RemoteNext_Proxy(This,
1366                                        celt,
1367                                        rgVar,
1368                                        pCeltFetched);
1369 }
1370
1371 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1372     IEnumVARIANT* This,
1373     ULONG celt,
1374     VARIANT* rgVar,
1375     ULONG* pCeltFetched)
1376 {
1377   HRESULT hr;
1378   *pCeltFetched = 0;
1379   hr = IEnumVARIANT_Next(This,
1380                          celt,
1381                          rgVar,
1382                          pCeltFetched);
1383   if (hr == S_OK) *pCeltFetched = celt;
1384   return hr;
1385 }
1386
1387 /* TypeInfo related freers */
1388
1389 static void free_embedded_typedesc(TYPEDESC *tdesc);
1390 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1391 {
1392     switch(adesc->tdescElem.vt)
1393     {
1394     case VT_PTR:
1395     case VT_SAFEARRAY:
1396         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1397         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1398         break;
1399     case VT_CARRAY:
1400         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1401         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1402         break;
1403     }
1404 }
1405
1406 static void free_embedded_typedesc(TYPEDESC *tdesc)
1407 {
1408     switch(tdesc->vt)
1409     {
1410     case VT_PTR:
1411     case VT_SAFEARRAY:
1412         free_embedded_typedesc(tdesc->u.lptdesc);
1413         CoTaskMemFree(tdesc->u.lptdesc);
1414         break;
1415     case VT_CARRAY:
1416         free_embedded_arraydesc(tdesc->u.lpadesc);
1417         CoTaskMemFree(tdesc->u.lpadesc);
1418         break;
1419     }
1420 }
1421
1422 static void free_embedded_elemdesc(ELEMDESC *edesc)
1423 {
1424     free_embedded_typedesc(&edesc->tdesc);
1425     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1426         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1427 }
1428
1429 /* ITypeComp */
1430
1431 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1432     ITypeComp* This,
1433     LPOLESTR szName,
1434     ULONG lHashVal,
1435     WORD wFlags,
1436     ITypeInfo** ppTInfo,
1437     DESCKIND* pDescKind,
1438     BINDPTR* pBindPtr)
1439 {
1440   FIXME("not implemented\n");
1441   return E_FAIL;
1442 }
1443
1444 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1445     ITypeComp* This,
1446     LPOLESTR szName,
1447     ULONG lHashVal,
1448     WORD wFlags,
1449     ITypeInfo** ppTInfo,
1450     DESCKIND* pDescKind,
1451     LPFUNCDESC* ppFuncDesc,
1452     LPVARDESC* ppVarDesc,
1453     ITypeComp** ppTypeComp,
1454     CLEANLOCALSTORAGE* pDummy)
1455 {
1456   FIXME("not implemented\n");
1457   return E_FAIL;
1458 }
1459
1460 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1461     ITypeComp* This,
1462     LPOLESTR szName,
1463     ULONG lHashVal,
1464     ITypeInfo** ppTInfo,
1465     ITypeComp** ppTComp)
1466 {
1467   FIXME("not implemented\n");
1468   return E_FAIL;
1469 }
1470
1471 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1472     ITypeComp* This,
1473     LPOLESTR szName,
1474     ULONG lHashVal,
1475     ITypeInfo** ppTInfo)
1476 {
1477   FIXME("not implemented\n");
1478   return E_FAIL;
1479 }
1480
1481 /* ITypeInfo */
1482
1483 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1484     ITypeInfo* This,
1485     TYPEATTR** ppTypeAttr)
1486
1487 {
1488     CLEANLOCALSTORAGE stg;
1489     TRACE("(%p, %p)\n", This, ppTypeAttr);
1490
1491     stg.flags = 0;
1492     stg.pStorage = NULL;
1493     stg.pInterface = NULL;
1494
1495     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1496 }
1497
1498 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1499     ITypeInfo* This,
1500     LPTYPEATTR* ppTypeAttr,
1501     CLEANLOCALSTORAGE* pDummy)
1502 {
1503     HRESULT hr;
1504     TRACE("(%p, %p)\n", This, ppTypeAttr);
1505
1506     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1507     if(hr != S_OK)
1508         return hr;
1509
1510     pDummy->flags = CLS_TYPEATTR;
1511     ITypeInfo_AddRef(This);
1512     pDummy->pInterface = (IUnknown*)This;
1513     pDummy->pStorage = ppTypeAttr;
1514     return hr;
1515 }
1516
1517 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1518     ITypeInfo* This,
1519     UINT index,
1520     FUNCDESC** ppFuncDesc)
1521 {
1522     CLEANLOCALSTORAGE stg;
1523     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1524
1525     stg.flags = 0;
1526     stg.pStorage = NULL;
1527     stg.pInterface = NULL;
1528
1529     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1530 }
1531
1532 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1533     ITypeInfo* This,
1534     UINT index,
1535     LPFUNCDESC* ppFuncDesc,
1536     CLEANLOCALSTORAGE* pDummy)
1537 {
1538     HRESULT hr;
1539     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1540
1541     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1542     if(hr != S_OK)
1543         return hr;
1544
1545     pDummy->flags = CLS_FUNCDESC;
1546     ITypeInfo_AddRef(This);
1547     pDummy->pInterface = (IUnknown*)This;
1548     pDummy->pStorage = ppFuncDesc;
1549     return hr;
1550 }
1551
1552 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1553     ITypeInfo* This,
1554     UINT index,
1555     VARDESC** ppVarDesc)
1556 {
1557     CLEANLOCALSTORAGE stg;
1558     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1559
1560     stg.flags = 0;
1561     stg.pStorage = NULL;
1562     stg.pInterface = NULL;
1563
1564     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1565 }
1566
1567 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1568     ITypeInfo* This,
1569     UINT index,
1570     LPVARDESC* ppVarDesc,
1571     CLEANLOCALSTORAGE* pDummy)
1572 {
1573     HRESULT hr;
1574     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1575
1576     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1577     if(hr != S_OK)
1578         return hr;
1579
1580     pDummy->flags = CLS_VARDESC;
1581     ITypeInfo_AddRef(This);
1582     pDummy->pInterface = (IUnknown*)This;
1583     pDummy->pStorage = ppVarDesc;
1584     return hr;
1585 }
1586
1587 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1588     ITypeInfo* This,
1589     MEMBERID memid,
1590     BSTR* rgBstrNames,
1591     UINT cMaxNames,
1592     UINT* pcNames)
1593 {
1594   FIXME("not implemented\n");
1595   return E_FAIL;
1596 }
1597
1598 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1599     ITypeInfo* This,
1600     MEMBERID memid,
1601     BSTR* rgBstrNames,
1602     UINT cMaxNames,
1603     UINT* pcNames)
1604 {
1605   FIXME("not implemented\n");
1606   return E_FAIL;
1607 }
1608
1609 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1610     ITypeInfo* This,
1611     LPOLESTR* rgszNames,
1612     UINT cNames,
1613     MEMBERID* pMemId)
1614 {
1615   FIXME("not implemented\n");
1616   return E_FAIL;
1617 }
1618
1619 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1620     ITypeInfo* This)
1621 {
1622   FIXME("not implemented\n");
1623   return E_FAIL;
1624 }
1625
1626 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1627     ITypeInfo* This,
1628     PVOID pvInstance,
1629     MEMBERID memid,
1630     WORD wFlags,
1631     DISPPARAMS* pDispParams,
1632     VARIANT* pVarResult,
1633     EXCEPINFO* pExcepInfo,
1634     UINT* puArgErr)
1635 {
1636   FIXME("not implemented\n");
1637   return E_FAIL;
1638 }
1639
1640 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1641     ITypeInfo* This)
1642 {
1643   FIXME("not implemented\n");
1644   return E_FAIL;
1645 }
1646
1647 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(
1648     ITypeInfo* This,
1649     MEMBERID memid,
1650     BSTR* pBstrName,
1651     BSTR* pBstrDocString,
1652     DWORD* pdwHelpContext,
1653     BSTR* pBstrHelpFile)
1654 {
1655     DWORD help_context;
1656     BSTR name, doc_string, help_file;
1657     HRESULT hr;
1658     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1659
1660     /* FIXME: presumably refPtrFlags is supposed to be a bitmask of which ptrs we actually want? */
1661     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, 0, &name, &doc_string, &help_context, &help_file);
1662     if(SUCCEEDED(hr))
1663     {
1664         if(pBstrName) *pBstrName = name;
1665         else SysFreeString(name);
1666
1667         if(pBstrDocString) *pBstrDocString = doc_string;
1668         else SysFreeString(doc_string);
1669
1670         if(pBstrHelpFile) *pBstrHelpFile = help_file;
1671         else SysFreeString(help_file);
1672
1673         if(pdwHelpContext) *pdwHelpContext = help_context;
1674     }
1675     return hr;
1676 }
1677
1678 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(
1679     ITypeInfo* This,
1680     MEMBERID memid,
1681     DWORD refPtrFlags,
1682     BSTR* pBstrName,
1683     BSTR* pBstrDocString,
1684     DWORD* pdwHelpContext,
1685     BSTR* pBstrHelpFile)
1686 {
1687     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, refPtrFlags, pBstrName, pBstrDocString,
1688           pdwHelpContext, pBstrHelpFile);
1689     return ITypeInfo_GetDocumentation(This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1690 }
1691
1692 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(
1693     ITypeInfo* This,
1694     MEMBERID memid,
1695     INVOKEKIND invKind,
1696     BSTR* pBstrDllName,
1697     BSTR* pBstrName,
1698     WORD* pwOrdinal)
1699 {
1700   FIXME("not implemented\n");
1701   return E_FAIL;
1702 }
1703
1704 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(
1705     ITypeInfo* This,
1706     MEMBERID memid,
1707     INVOKEKIND invKind,
1708     DWORD refPtrFlags,
1709     BSTR* pBstrDllName,
1710     BSTR* pBstrName,
1711     WORD* pwOrdinal)
1712 {
1713   FIXME("not implemented\n");
1714   return E_FAIL;
1715 }
1716
1717 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1718     ITypeInfo* This,
1719     MEMBERID memid,
1720     INVOKEKIND invKind,
1721     PVOID* ppv)
1722 {
1723   FIXME("not implemented\n");
1724   return E_FAIL;
1725 }
1726
1727 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1728     ITypeInfo* This)
1729 {
1730   FIXME("not implemented\n");
1731   return E_FAIL;
1732 }
1733
1734 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1735     ITypeInfo* This,
1736     IUnknown* pUnkOuter,
1737     REFIID riid,
1738     PVOID* ppvObj)
1739 {
1740   FIXME("not implemented\n");
1741   return E_FAIL;
1742 }
1743
1744 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1745     ITypeInfo* This,
1746     REFIID riid,
1747     IUnknown** ppvObj)
1748 {
1749   FIXME("not implemented\n");
1750   return E_FAIL;
1751 }
1752
1753 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1754     ITypeInfo* This,
1755     ITypeLib** ppTLib,
1756     UINT* pIndex)
1757 {
1758     ITypeLib *pTL;
1759     UINT index;
1760     HRESULT hr;
1761
1762     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1763
1764     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1765     if(SUCCEEDED(hr))
1766     {
1767         if(pIndex)
1768             *pIndex = index;
1769
1770         if(ppTLib)
1771             *ppTLib = pTL;
1772         else
1773             ITypeLib_Release(pTL);
1774     }
1775     return hr;
1776 }
1777
1778 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1779     ITypeInfo* This,
1780     ITypeLib** ppTLib,
1781     UINT* pIndex)
1782 {
1783     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1784     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1785 }
1786
1787 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1788     ITypeInfo* This,
1789     TYPEATTR* pTypeAttr)
1790 {
1791     TRACE("(%p, %p)\n", This, pTypeAttr);
1792     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1793     CoTaskMemFree(pTypeAttr);
1794 }
1795
1796 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1797     ITypeInfo* This)
1798 {
1799     TRACE("nothing to do\n");
1800     return S_OK;
1801 }
1802
1803 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1804     ITypeInfo* This,
1805     FUNCDESC* pFuncDesc)
1806 {
1807     SHORT param;
1808     TRACE("(%p, %p)\n", This, pFuncDesc);
1809
1810     for(param = 0; param < pFuncDesc->cParams; param++)
1811         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1812     if(param)
1813         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1814
1815     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1816
1817     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1818         CoTaskMemFree(pFuncDesc->lprgscode);
1819
1820     CoTaskMemFree(pFuncDesc);
1821 }
1822
1823 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1824     ITypeInfo* This)
1825 {
1826     TRACE("nothing to do\n");
1827     return S_OK;
1828 }
1829
1830 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1831     ITypeInfo* This,
1832     VARDESC* pVarDesc)
1833 {
1834     TRACE("(%p, %p)\n", This, pVarDesc);
1835
1836     CoTaskMemFree(pVarDesc->lpstrSchema);
1837
1838     if(pVarDesc->varkind == VAR_CONST)
1839         CoTaskMemFree(pVarDesc->u.lpvarValue);
1840
1841     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1842     CoTaskMemFree(pVarDesc);
1843 }
1844
1845 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1846     ITypeInfo* This)
1847 {
1848     TRACE("nothing to do\n");
1849     return S_OK;
1850 }
1851
1852
1853 /* ITypeInfo2 */
1854
1855 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(
1856     ITypeInfo2* This,
1857     MEMBERID memid,
1858     LCID lcid,
1859     BSTR* pbstrHelpString,
1860     DWORD* pdwHelpStringContext,
1861     BSTR* pbstrHelpStringDll)
1862 {
1863   FIXME("not implemented\n");
1864   return E_FAIL;
1865 }
1866
1867 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(
1868     ITypeInfo2* This,
1869     MEMBERID memid,
1870     LCID lcid,
1871     DWORD refPtrFlags,
1872     BSTR* pbstrHelpString,
1873     DWORD* pdwHelpStringContext,
1874     BSTR* pbstrHelpStringDll)
1875 {
1876   FIXME("not implemented\n");
1877   return E_FAIL;
1878 }
1879
1880 /* ITypeLib */
1881
1882 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1883     ITypeLib* This)
1884 {
1885     UINT count = 0;
1886     TRACE("(%p)\n", This);
1887
1888     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1889
1890     return count;
1891 }
1892
1893 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1894     ITypeLib* This,
1895     UINT* pcTInfo)
1896 {
1897     TRACE("(%p, %p)\n", This, pcTInfo);
1898     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1899     return S_OK;
1900 }
1901
1902 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1903     ITypeLib* This,
1904     TLIBATTR** ppTLibAttr)
1905 {
1906     CLEANLOCALSTORAGE stg;
1907     TRACE("(%p, %p)\n", This, ppTLibAttr);
1908
1909     stg.flags = 0;
1910     stg.pStorage = NULL;
1911     stg.pInterface = NULL;
1912
1913     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1914 }
1915
1916 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1917     ITypeLib* This,
1918     LPTLIBATTR* ppTLibAttr,
1919     CLEANLOCALSTORAGE* pDummy)
1920 {
1921     HRESULT hr;
1922     TRACE("(%p, %p)\n", This, ppTLibAttr);
1923
1924     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1925     if(hr != S_OK)
1926         return hr;
1927
1928     pDummy->flags = CLS_LIBATTR;
1929     ITypeLib_AddRef(This);
1930     pDummy->pInterface = (IUnknown*)This;
1931     pDummy->pStorage = ppTLibAttr;
1932     return hr;
1933 }
1934
1935 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(
1936     ITypeLib* This,
1937     INT index,
1938     BSTR* pBstrName,
1939     BSTR* pBstrDocString,
1940     DWORD* pdwHelpContext,
1941     BSTR* pBstrHelpFile)
1942 {
1943   FIXME("not implemented\n");
1944   return E_FAIL;
1945 }
1946
1947 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(
1948     ITypeLib* This,
1949     INT index,
1950     DWORD refPtrFlags,
1951     BSTR* pBstrName,
1952     BSTR* pBstrDocString,
1953     DWORD* pdwHelpContext,
1954     BSTR* pBstrHelpFile)
1955 {
1956   FIXME("not implemented\n");
1957   return E_FAIL;
1958 }
1959
1960 HRESULT CALLBACK ITypeLib_IsName_Proxy(
1961     ITypeLib* This,
1962     LPOLESTR szNameBuf,
1963     ULONG lHashVal,
1964     BOOL* pfName)
1965 {
1966   FIXME("not implemented\n");
1967   return E_FAIL;
1968 }
1969
1970 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
1971     ITypeLib* This,
1972     LPOLESTR szNameBuf,
1973     ULONG lHashVal,
1974     BOOL* pfName,
1975     BSTR* pBstrLibName)
1976 {
1977   FIXME("not implemented\n");
1978   return E_FAIL;
1979 }
1980
1981 HRESULT CALLBACK ITypeLib_FindName_Proxy(
1982     ITypeLib* This,
1983     LPOLESTR szNameBuf,
1984     ULONG lHashVal,
1985     ITypeInfo** ppTInfo,
1986     MEMBERID* rgMemId,
1987     USHORT* pcFound)
1988 {
1989   FIXME("not implemented\n");
1990   return E_FAIL;
1991 }
1992
1993 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
1994     ITypeLib* This,
1995     LPOLESTR szNameBuf,
1996     ULONG lHashVal,
1997     ITypeInfo** ppTInfo,
1998     MEMBERID* rgMemId,
1999     USHORT* pcFound,
2000     BSTR* pBstrLibName)
2001 {
2002   FIXME("not implemented\n");
2003   return E_FAIL;
2004 }
2005
2006 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
2007     ITypeLib* This,
2008     TLIBATTR* pTLibAttr)
2009 {
2010     TRACE("(%p, %p)\n", This, pTLibAttr);
2011     CoTaskMemFree(pTLibAttr);
2012 }
2013
2014 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
2015     ITypeLib* This)
2016 {
2017     TRACE("nothing to do\n");
2018     return S_OK;
2019 }
2020
2021
2022 /* ITypeLib2 */
2023
2024 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
2025     ITypeLib2* This,
2026     ULONG* pcUniqueNames,
2027     ULONG* pcchUniqueNames)
2028 {
2029   FIXME("not implemented\n");
2030   return E_FAIL;
2031 }
2032
2033 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
2034     ITypeLib2* This,
2035     ULONG* pcUniqueNames,
2036     ULONG* pcchUniqueNames)
2037 {
2038   FIXME("not implemented\n");
2039   return E_FAIL;
2040 }
2041
2042 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(
2043     ITypeLib2* This,
2044     INT index,
2045     LCID lcid,
2046     BSTR* pbstrHelpString,
2047     DWORD* pdwHelpStringContext,
2048     BSTR* pbstrHelpStringDll)
2049 {
2050   FIXME("not implemented\n");
2051   return E_FAIL;
2052 }
2053
2054 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(
2055     ITypeLib2* This,
2056     INT index,
2057     LCID lcid,
2058     DWORD refPtrFlags,
2059     BSTR* pbstrHelpString,
2060     DWORD* pdwHelpStringContext,
2061     BSTR* pbstrHelpStringDll)
2062 {
2063   FIXME("not implemented\n");
2064   return E_FAIL;
2065 }
2066
2067 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2068     IPropertyBag* This,
2069     LPCOLESTR pszPropName,
2070     VARIANT *pVar,
2071     IErrorLog *pErrorLog)
2072 {
2073   IUnknown *pUnk = NULL;
2074   TRACE("(%p, %s, %p, %p)\n", This, debugstr_w(pszPropName), pVar, pErrorLog);
2075
2076   if(!pVar)
2077     return E_POINTER;
2078
2079   if(V_VT(pVar) & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2080   {
2081     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2082     return E_NOTIMPL;
2083   }
2084
2085   switch(V_VT(pVar))
2086   {
2087     case VT_DISPATCH:
2088       pUnk = (IUnknown*)V_DISPATCH(pVar);
2089       break;
2090     case VT_UNKNOWN:
2091       pUnk = V_UNKNOWN(pVar);
2092       break;
2093     case VT_SAFEARRAY:
2094       FIXME("Safearray support not yet implemented.\n");
2095       return E_NOTIMPL;
2096     default:
2097       FIXME("Unknown V_VT %d - support not yet implemented.\n", V_VT(pVar));
2098       return E_NOTIMPL;
2099   }
2100
2101   return IPropertyBag_RemoteRead_Proxy(This, pszPropName, pVar, pErrorLog,
2102                                        V_VT(pVar), pUnk);
2103 }
2104
2105 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2106     IPropertyBag* This,
2107     LPCOLESTR pszPropName,
2108     VARIANT *pVar,
2109     IErrorLog *pErrorLog,
2110     DWORD varType,
2111     IUnknown *pUnkObj)
2112 {
2113   static const WCHAR emptyWstr[1] = {0};
2114   IDispatch *disp;
2115   HRESULT hr;
2116   TRACE("(%p, %s, %p, %p, %x, %p)\n", This, debugstr_w(pszPropName), pVar,
2117                                      pErrorLog, varType, pUnkObj);
2118
2119   if(varType & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2120   {
2121     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2122     return E_NOTIMPL;
2123   }
2124
2125   V_VT(pVar) = varType;
2126   switch(varType)
2127   {
2128     case VT_DISPATCH:
2129       hr = IUnknown_QueryInterface(pUnkObj, &IID_IDispatch, (LPVOID*)&disp);
2130       if(FAILED(hr))
2131         return hr;
2132       IUnknown_Release(pUnkObj);
2133       V_DISPATCH(pVar) = disp;
2134       break;
2135     case VT_UNKNOWN:
2136       V_UNKNOWN(pVar) = pUnkObj;
2137       break;
2138     case VT_BSTR:
2139       V_BSTR(pVar) = SysAllocString(emptyWstr);
2140       break;
2141     case VT_SAFEARRAY:
2142       FIXME("Safearray support not yet implemented.\n");
2143       return E_NOTIMPL;
2144     default:
2145       break;
2146   }
2147   hr = IPropertyBag_Read(This, pszPropName, pVar, pErrorLog);
2148   if(FAILED(hr))
2149     VariantClear(pVar);
2150
2151   return hr;
2152 }
2153
2154 /* call_as/local stubs for ocidl.idl */
2155
2156 HRESULT CALLBACK IClassFactory2_CreateInstanceLic_Proxy(
2157     IClassFactory2* This,
2158     IUnknown *pUnkOuter,
2159     IUnknown *pUnkReserved,
2160     REFIID riid,
2161     BSTR bstrKey,
2162     PVOID *ppvObj)
2163 {
2164     FIXME("not implemented\n");
2165     return E_NOTIMPL;
2166 }
2167
2168 HRESULT __RPC_STUB IClassFactory2_CreateInstanceLic_Stub(
2169     IClassFactory2* This,
2170     REFIID riid,
2171     BSTR bstrKey,
2172     IUnknown **ppvObj)
2173 {
2174     FIXME("not implemented\n");
2175     return E_NOTIMPL;
2176 }
2177
2178 HRESULT CALLBACK IEnumConnections_Next_Proxy(
2179     IEnumConnections* This,
2180     ULONG cConnections,
2181     LPCONNECTDATA rgcd,
2182     ULONG *pcFetched)
2183 {
2184     FIXME("not implemented\n");
2185     return E_NOTIMPL;
2186 }
2187
2188 HRESULT __RPC_STUB IEnumConnections_Next_Stub(
2189     IEnumConnections* This,
2190     ULONG cConnections,
2191     LPCONNECTDATA rgcd,
2192     ULONG *pcFetched)
2193 {
2194     FIXME("not implemented\n");
2195     return E_NOTIMPL;
2196 }
2197
2198 HRESULT CALLBACK IEnumConnectionPoints_Next_Proxy(
2199     IEnumConnectionPoints* This,
2200     ULONG cConnections,
2201     LPCONNECTIONPOINT *ppCP,
2202     ULONG *pcFetched)
2203 {
2204     FIXME("not implemented\n");
2205     return E_NOTIMPL;
2206 }
2207
2208 HRESULT __RPC_STUB IEnumConnectionPoints_Next_Stub(
2209     IEnumConnectionPoints* This,
2210     ULONG cConnections,
2211     LPCONNECTIONPOINT *ppCP,
2212     ULONG *pcFetched)
2213 {
2214     FIXME("not implemented\n");
2215     return E_NOTIMPL;
2216 }
2217
2218 HRESULT CALLBACK IPersistMemory_Load_Proxy(
2219     IPersistMemory* This,
2220     LPVOID pMem,
2221     ULONG cbSize)
2222 {
2223     FIXME("not implemented\n");
2224     return E_NOTIMPL;
2225 }
2226
2227 HRESULT __RPC_STUB IPersistMemory_Load_Stub(
2228     IPersistMemory* This,
2229     BYTE *pMem,
2230     ULONG cbSize)
2231 {
2232     FIXME("not implemented\n");
2233     return E_NOTIMPL;
2234 }
2235
2236 HRESULT CALLBACK IPersistMemory_Save_Proxy(
2237     IPersistMemory* This,
2238     LPVOID pMem,
2239     BOOL fClearDirty,
2240     ULONG cbSize)
2241 {
2242     FIXME("not implemented\n");
2243     return E_NOTIMPL;
2244 }
2245
2246 HRESULT __RPC_STUB IPersistMemory_Save_Stub(
2247     IPersistMemory* This,
2248     BYTE *pMem,
2249     BOOL fClearDirty,
2250     ULONG cbSize)
2251 {
2252     FIXME("not implemented\n");
2253     return E_NOTIMPL;
2254 }
2255
2256 void CALLBACK IAdviseSinkEx_OnViewStatusChange_Proxy(
2257     IAdviseSinkEx* This,
2258     DWORD dwViewStatus)
2259 {
2260     FIXME("not implemented\n");
2261 }
2262
2263 HRESULT __RPC_STUB IAdviseSinkEx_OnViewStatusChange_Stub(
2264     IAdviseSinkEx* This,
2265     DWORD dwViewStatus)
2266 {
2267     FIXME("not implemented\n");
2268     return E_NOTIMPL;
2269 }
2270
2271 HRESULT CALLBACK IEnumOleUndoUnits_Next_Proxy(
2272     IEnumOleUndoUnits* This,
2273     ULONG cElt,
2274     IOleUndoUnit **rgElt,
2275     ULONG *pcEltFetched)
2276 {
2277     FIXME("not implemented\n");
2278     return E_NOTIMPL;
2279 }
2280
2281 HRESULT __RPC_STUB IEnumOleUndoUnits_Next_Stub(
2282     IEnumOleUndoUnits* This,
2283     ULONG cElt,
2284     IOleUndoUnit **rgElt,
2285     ULONG *pcEltFetched)
2286 {
2287     FIXME("not implemented\n");
2288     return E_NOTIMPL;
2289 }
2290
2291 HRESULT CALLBACK IQuickActivate_QuickActivate_Proxy(
2292     IQuickActivate* This,
2293     QACONTAINER *pQaContainer,
2294     QACONTROL *pQaControl)
2295 {
2296     FIXME("not implemented\n");
2297     return E_NOTIMPL;
2298 }
2299
2300 HRESULT __RPC_STUB IQuickActivate_QuickActivate_Stub(
2301     IQuickActivate* This,
2302     QACONTAINER *pQaContainer,
2303     QACONTROL *pQaControl)
2304 {
2305     FIXME("not implemented\n");
2306     return E_NOTIMPL;
2307 }