reactos/dll/win32/oleaut32/tmarshal.c

   1 /*
   2  *      TYPELIB Marshaler
   3  *
   4  *      Copyright 2002,2005     Marcus Meissner
   5  *
   6  * The olerelay debug channel allows you to see calls marshalled by
   7  * the typelib marshaller. It is not a generic COM relaying system.
   8  *
   9  * This library is free software; you can redistribute it and/or
  10  * modify it under the terms of the GNU Lesser General Public
  11  * License as published by the Free Software Foundation; either
  12  * version 2.1 of the License, or (at your option) any later version.
  13  *
  14  * This library is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  17  * Lesser General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU Lesser General Public
  20  * License along with this library; if not, write to the Free Software
  21  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  22  */
  23
  24 #include "precomp.h"
  25
  26 #include "typelib.h"
  27
  28 #include <wine/exception.h>
  29
  30 static const WCHAR IDispatchW[] = { 'I','D','i','s','p','a','t','c','h',0};
  31
  32 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  33 WINE_DECLARE_DEBUG_CHANNEL(olerelay);
  34
  35 static HRESULT TMarshalDispatchChannel_Create(
  36     IRpcChannelBuffer *pDelegateChannel, REFIID tmarshal_riid,
  37     IRpcChannelBuffer **ppChannel);
  38
  39 typedef struct _marshal_state {
  40     LPBYTE      base;
  41     int         size;
  42     int         curoff;
  43 } marshal_state;
  44
  45 /* used in the olerelay code to avoid having the L"" stuff added by debugstr_w */
  46 static char *relaystr(WCHAR *in) {
  47     char *tmp = (char *)debugstr_w(in);
  48     tmp += 2;
  49     tmp[strlen(tmp)-1] = '\0';
  50     return tmp;
  51 }
  52
  53 static HRESULT
  54 xbuf_resize(marshal_state *buf, DWORD newsize)
  55 {
  56     if(buf->size >= newsize)
  57         return S_FALSE;
  58
  59     if(buf->base)
  60     {
  61         buf->base = HeapReAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, buf->base, newsize);
  62         if(!buf->base)
  63             return E_OUTOFMEMORY;
  64     }
  65     else
  66     {
  67         buf->base = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, newsize);
  68         if(!buf->base)
  69             return E_OUTOFMEMORY;
  70     }
  71     buf->size = newsize;
  72     return S_OK;
  73 }
  74
  75 static HRESULT
  76 xbuf_add(marshal_state *buf, const BYTE *stuff, DWORD size)
  77 {
  78     HRESULT hr;
  79
  80     if(buf->size - buf->curoff < size)
  81     {
  82         hr = xbuf_resize(buf, buf->size + size + 100);
  83         if(FAILED(hr)) return hr;
  84     }
  85     memcpy(buf->base+buf->curoff,stuff,size);
  86     buf->curoff += size;
  87     return S_OK;
  88 }
  89
  90 static HRESULT
  91 xbuf_get(marshal_state *buf, LPBYTE stuff, DWORD size) {
  92     if (buf->size < buf->curoff+size) return E_FAIL;
  93     memcpy(stuff,buf->base+buf->curoff,size);
  94     buf->curoff += size;
  95     return S_OK;
  96 }
  97
  98 static HRESULT
  99 xbuf_skip(marshal_state *buf, DWORD size) {
 100     if (buf->size < buf->curoff+size) return E_FAIL;
 101     buf->curoff += size;
 102     return S_OK;
 103 }
 104
 105 static HRESULT
 106 _unmarshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN *pUnk) {
 107     IStream             *pStm;
 108     ULARGE_INTEGER      newpos;
 109     LARGE_INTEGER       seekto;
 110     ULONG               res;
 111     HRESULT             hres;
 112     DWORD               xsize;
 113
 114     TRACE("...%s...\n",debugstr_guid(riid));
 115
 116     *pUnk = NULL;
 117     hres = xbuf_get(buf,(LPBYTE)&xsize,sizeof(xsize));
 118     if (hres) {
 119         ERR("xbuf_get failed\n");
 120         return hres;
 121     }
 122
 123     if (xsize == 0) return S_OK;
 124
 125     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 126     if (hres) {
 127         ERR("Stream create failed %x\n",hres);
 128         return hres;
 129     }
 130
 131     hres = IStream_Write(pStm,buf->base+buf->curoff,xsize,&res);
 132     if (hres) {
 133         ERR("stream write %x\n",hres);
 134         IStream_Release(pStm);
 135         return hres;
 136     }
 137
 138     memset(&seekto,0,sizeof(seekto));
 139     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 140     if (hres) {
 141         ERR("Failed Seek %x\n",hres);
 142         IStream_Release(pStm);
 143         return hres;
 144     }
 145
 146     hres = CoUnmarshalInterface(pStm,riid,(LPVOID*)pUnk);
 147     if (hres) {
 148         ERR("Unmarshalling interface %s failed with %x\n",debugstr_guid(riid),hres);
 149         IStream_Release(pStm);
 150         return hres;
 151     }
 152
 153     IStream_Release(pStm);
 154     return xbuf_skip(buf,xsize);
 155 }
 156
 157 static HRESULT
 158 _marshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN pUnk) {
 159     LPBYTE              tempbuf = NULL;
 160     IStream             *pStm = NULL;
 161     STATSTG             ststg;
 162     ULARGE_INTEGER      newpos;
 163     LARGE_INTEGER       seekto;
 164     ULONG               res;
 165     DWORD               xsize;
 166     HRESULT             hres;
 167
 168     if (!pUnk) {
 169         /* this is valid, if for instance we serialize
 170          * a VT_DISPATCH with NULL ptr which apparently
 171          * can happen. S_OK to make sure we continue
 172          * serializing.
 173          */
 174         WARN("pUnk is NULL\n");
 175         xsize = 0;
 176         return xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 177     }
 178
 179     hres = E_FAIL;
 180
 181     TRACE("...%s...\n",debugstr_guid(riid));
 182
 183     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 184     if (hres) {
 185         ERR("Stream create failed %x\n",hres);
 186         goto fail;
 187     }
 188
 189     hres = CoMarshalInterface(pStm,riid,pUnk,0,NULL,0);
 190     if (hres) {
 191         ERR("Marshalling interface %s failed with %x\n", debugstr_guid(riid), hres);
 192         goto fail;
 193     }
 194
 195     hres = IStream_Stat(pStm,&ststg,STATFLAG_NONAME);
 196     if (hres) {
 197         ERR("Stream stat failed\n");
 198         goto fail;
 199     }
 200
 201     tempbuf = HeapAlloc(GetProcessHeap(), 0, ststg.cbSize.u.LowPart);
 202     memset(&seekto,0,sizeof(seekto));
 203     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 204     if (hres) {
 205         ERR("Failed Seek %x\n",hres);
 206         goto fail;
 207     }
 208
 209     hres = IStream_Read(pStm,tempbuf,ststg.cbSize.u.LowPart,&res);
 210     if (hres) {
 211         ERR("Failed Read %x\n",hres);
 212         goto fail;
 213     }
 214
 215     xsize = ststg.cbSize.u.LowPart;
 216     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 217     hres = xbuf_add(buf,tempbuf,ststg.cbSize.u.LowPart);
 218
 219     HeapFree(GetProcessHeap(),0,tempbuf);
 220     IStream_Release(pStm);
 221
 222     return hres;
 223
 224 fail:
 225     xsize = 0;
 226     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 227     if (pStm) IStream_Release(pStm);
 228     HeapFree(GetProcessHeap(), 0, tempbuf);
 229     return hres;
 230 }
 231
 232 /********************* OLE Proxy/Stub Factory ********************************/
 233 static HRESULT WINAPI
 234 PSFacBuf_QueryInterface(LPPSFACTORYBUFFER iface, REFIID iid, LPVOID *ppv) {
 235     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)||IsEqualIID(iid,&IID_IUnknown)) {
 236         *ppv = iface;
 237         /* No ref counting, static class */
 238         return S_OK;
 239     }
 240     FIXME("(%s) unknown IID?\n",debugstr_guid(iid));
 241     return E_NOINTERFACE;
 242 }
 243
 244 static ULONG WINAPI PSFacBuf_AddRef(LPPSFACTORYBUFFER iface) { return 2; }
 245 static ULONG WINAPI PSFacBuf_Release(LPPSFACTORYBUFFER iface) { return 1; }
 246
 247 static HRESULT
 248 _get_typeinfo_for_iid(REFIID riid, ITypeInfo**ti) {
 249     HRESULT     hres;
 250     HKEY        ikey;
 251     char        tlguid[200],typelibkey[300],interfacekey[300],ver[100];
 252     char        tlfn[260];
 253     OLECHAR     tlfnW[260];
 254     DWORD       tlguidlen, verlen, type;
 255     LONG        tlfnlen;
 256     ITypeLib    *tl;
 257
 258     sprintf( interfacekey, "Interface\\{%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\Typelib",
 259         riid->Data1, riid->Data2, riid->Data3,
 260         riid->Data4[0], riid->Data4[1], riid->Data4[2], riid->Data4[3],
 261         riid->Data4[4], riid->Data4[5], riid->Data4[6], riid->Data4[7]
 262     );
 263
 264     if (RegOpenKeyA(HKEY_CLASSES_ROOT,interfacekey,&ikey)) {
 265         ERR("No %s key found.\n",interfacekey);
 266         return E_FAIL;
 267     }
 268     tlguidlen = sizeof(tlguid);
 269     if (RegQueryValueExA(ikey,NULL,NULL,&type,(LPBYTE)tlguid,&tlguidlen)) {
 270         ERR("Getting typelib guid failed.\n");
 271         RegCloseKey(ikey);
 272         return E_FAIL;
 273     }
 274     verlen = sizeof(ver);
 275     if (RegQueryValueExA(ikey,"Version",NULL,&type,(LPBYTE)ver,&verlen)) {
 276         ERR("Could not get version value?\n");
 277         RegCloseKey(ikey);
 278         return E_FAIL;
 279     }
 280     RegCloseKey(ikey);
 281     sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win%u",tlguid,ver,(sizeof(void*) == 8) ? 64 : 32);
 282     tlfnlen = sizeof(tlfn);
 283     if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 284 #ifdef _WIN64
 285         sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win32",tlguid,ver);
 286         tlfnlen = sizeof(tlfn);
 287         if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 288 #endif
 289             ERR("Could not get typelib fn?\n");
 290             return E_FAIL;
 291 #ifdef _WIN64
 292         }
 293 #endif
 294     }
 295     MultiByteToWideChar(CP_ACP, 0, tlfn, -1, tlfnW, sizeof(tlfnW) / sizeof(tlfnW[0]));
 296     hres = LoadTypeLib(tlfnW,&tl);
 297     if (hres) {
 298         ERR("Failed to load typelib for %s, but it should be there.\n",debugstr_guid(riid));
 299         return hres;
 300     }
 301     hres = ITypeLib_GetTypeInfoOfGuid(tl,riid,ti);
 302     if (hres) {
 303         ERR("typelib does not contain info for %s?\n",debugstr_guid(riid));
 304         ITypeLib_Release(tl);
 305         return hres;
 306     }
 307     ITypeLib_Release(tl);
 308     return hres;
 309 }
 310
 311 /*
 312  * Determine the number of functions including all inherited functions
 313  * and well as the size of the vtbl.
 314  * Note for non-dual dispinterfaces we simply return the size of IDispatch.
 315  */
 316 static HRESULT num_of_funcs(ITypeInfo *tinfo, unsigned int *num,
 317                             unsigned int *vtbl_size)
 318 {
 319     HRESULT hr;
 320     TYPEATTR *attr;
 321     ITypeInfo *tinfo2;
 322     UINT inherited_funcs = 0, i;
 323
 324     *num = 0;
 325     if(vtbl_size) *vtbl_size = 0;
 326
 327     hr = ITypeInfo_GetTypeAttr(tinfo, &attr);
 328     if (hr)
 329     {
 330         ERR("GetTypeAttr failed with %x\n", hr);
 331         return hr;
 332     }
 333
 334     if(attr->typekind == TKIND_DISPATCH)
 335     {
 336         if(attr->wTypeFlags & TYPEFLAG_FDUAL)
 337         {
 338             HREFTYPE href;
 339
 340             ITypeInfo_ReleaseTypeAttr(tinfo, attr);
 341             hr = ITypeInfo_GetRefTypeOfImplType(tinfo, -1, &href);
 342             if(FAILED(hr))
 343             {
 344                 ERR("Unable to get interface href from dual dispinterface\n");
 345                 return hr;
 346             }
 347             hr = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
 348             if(FAILED(hr))
 349             {
 350                 ERR("Unable to get interface from dual dispinterface\n");
 351                 return hr;
 352             }
 353             hr = num_of_funcs(tinfo2, num, vtbl_size);
 354             ITypeInfo_Release(tinfo2);
 355             return hr;
 356         }
 357         else /* non-dual dispinterface */
 358         {
 359             /* These will be the size of IDispatchVtbl */
 360             *num = attr->cbSizeVft / sizeof(void *);
 361             if(vtbl_size) *vtbl_size = attr->cbSizeVft;
 362             ITypeInfo_ReleaseTypeAttr(tinfo, attr);
 363             return hr;
 364         }
 365     }
 366
 367     for (i = 0; i < attr->cImplTypes; i++)
 368     {
 369         HREFTYPE href;
 370         ITypeInfo *pSubTypeInfo;
 371         UINT sub_funcs;
 372
 373         hr = ITypeInfo_GetRefTypeOfImplType(tinfo, i, &href);
 374         if (FAILED(hr)) goto end;
 375         hr = ITypeInfo_GetRefTypeInfo(tinfo, href, &pSubTypeInfo);
 376         if (FAILED(hr)) goto end;
 377
 378         hr = num_of_funcs(pSubTypeInfo, &sub_funcs, NULL);
 379         ITypeInfo_Release(pSubTypeInfo);
 380
 381         if(FAILED(hr)) goto end;
 382         inherited_funcs += sub_funcs;
 383     }
 384
 385     *num = inherited_funcs + attr->cFuncs;
 386     if(vtbl_size) *vtbl_size = attr->cbSizeVft;
 387
 388  end:
 389     ITypeInfo_ReleaseTypeAttr(tinfo, attr);
 390     return hr;
 391 }
 392
 393 #ifdef __i386__
 394
 395 #include "pshpack1.h"
 396
 397 typedef struct _TMAsmProxy {
 398     DWORD       lealeax;
 399     BYTE        pushleax;
 400     BYTE        pushlval;
 401     DWORD       nr;
 402     BYTE        lcall;
 403     DWORD       xcall;
 404     BYTE        lret;
 405     WORD        bytestopop;
 406     WORD        nop;
 407 } TMAsmProxy;
 408
 409 #include "poppack.h"
 410
 411 #else /* __i386__ */
 412 #ifdef _MSC_VER
 413 #pragma message("You need to implement stubless proxies for your architecture")
 414 #else
 415 # warning You need to implement stubless proxies for your architecture
 416 #endif
 417 typedef struct _TMAsmProxy {
 418     char a;
 419 } TMAsmProxy;
 420 #endif
 421
 422 typedef struct _TMProxyImpl {
 423     LPVOID                             *lpvtbl;
 424     IRpcProxyBuffer                     IRpcProxyBuffer_iface;
 425     LONG                                ref;
 426
 427     TMAsmProxy                          *asmstubs;
 428     ITypeInfo*                          tinfo;
 429     IRpcChannelBuffer*                  chanbuf;
 430     IID                                 iid;
 431     CRITICAL_SECTION    crit;
 432     IUnknown                            *outerunknown;
 433     IDispatch                           *dispatch;
 434     IRpcProxyBuffer                     *dispatch_proxy;
 435 } TMProxyImpl;
 436
 437 static inline TMProxyImpl *impl_from_IRpcProxyBuffer( IRpcProxyBuffer *iface )
 438 {
 439     return CONTAINING_RECORD(iface, TMProxyImpl, IRpcProxyBuffer_iface);
 440 }
 441
 442 static HRESULT WINAPI
 443 TMProxyImpl_QueryInterface(LPRPCPROXYBUFFER iface, REFIID riid, LPVOID *ppv)
 444 {
 445     TRACE("()\n");
 446     if (IsEqualIID(riid,&IID_IUnknown)||IsEqualIID(riid,&IID_IRpcProxyBuffer)) {
 447         *ppv = iface;
 448         IRpcProxyBuffer_AddRef(iface);
 449         return S_OK;
 450     }
 451     FIXME("no interface for %s\n",debugstr_guid(riid));
 452     return E_NOINTERFACE;
 453 }
 454
 455 static ULONG WINAPI
 456 TMProxyImpl_AddRef(LPRPCPROXYBUFFER iface)
 457 {
 458     TMProxyImpl *This = impl_from_IRpcProxyBuffer( iface );
 459     ULONG refCount = InterlockedIncrement(&This->ref);
 460
 461     TRACE("(%p)->(ref before=%u)\n",This, refCount - 1);
 462
 463     return refCount;
 464 }
 465
 466 static ULONG WINAPI
 467 TMProxyImpl_Release(LPRPCPROXYBUFFER iface)
 468 {
 469     TMProxyImpl *This = impl_from_IRpcProxyBuffer( iface );
 470     ULONG refCount = InterlockedDecrement(&This->ref);
 471
 472     TRACE("(%p)->(ref before=%u)\n",This, refCount + 1);
 473
 474     if (!refCount)
 475     {
 476         if (This->dispatch_proxy) IRpcProxyBuffer_Release(This->dispatch_proxy);
 477         This->crit.DebugInfo->Spare[0] = 0;
 478         DeleteCriticalSection(&This->crit);
 479         if (This->chanbuf) IRpcChannelBuffer_Release(This->chanbuf);
 480         VirtualFree(This->asmstubs, 0, MEM_RELEASE);
 481         HeapFree(GetProcessHeap(), 0, This->lpvtbl);
 482         ITypeInfo_Release(This->tinfo);
 483         CoTaskMemFree(This);
 484     }
 485     return refCount;
 486 }
 487
 488 static HRESULT WINAPI
 489 TMProxyImpl_Connect(
 490     LPRPCPROXYBUFFER iface,IRpcChannelBuffer* pRpcChannelBuffer)
 491 {
 492     TMProxyImpl *This = impl_from_IRpcProxyBuffer( iface );
 493
 494     TRACE("(%p)\n", pRpcChannelBuffer);
 495
 496     EnterCriticalSection(&This->crit);
 497
 498     IRpcChannelBuffer_AddRef(pRpcChannelBuffer);
 499     This->chanbuf = pRpcChannelBuffer;
 500
 501     LeaveCriticalSection(&This->crit);
 502
 503     if (This->dispatch_proxy)
 504     {
 505         IRpcChannelBuffer *pDelegateChannel;
 506         HRESULT hr = TMarshalDispatchChannel_Create(pRpcChannelBuffer, &This->iid, &pDelegateChannel);
 507         if (FAILED(hr))
 508             return hr;
 509         hr = IRpcProxyBuffer_Connect(This->dispatch_proxy, pDelegateChannel);
 510         IRpcChannelBuffer_Release(pDelegateChannel);
 511         return hr;
 512     }
 513
 514     return S_OK;
 515 }
 516
 517 static void WINAPI
 518 TMProxyImpl_Disconnect(LPRPCPROXYBUFFER iface)
 519 {
 520     TMProxyImpl *This = impl_from_IRpcProxyBuffer( iface );
 521
 522     TRACE("()\n");
 523
 524     EnterCriticalSection(&This->crit);
 525
 526     IRpcChannelBuffer_Release(This->chanbuf);
 527     This->chanbuf = NULL;
 528
 529     LeaveCriticalSection(&This->crit);
 530
 531     if (This->dispatch_proxy)
 532         IRpcProxyBuffer_Disconnect(This->dispatch_proxy);
 533 }
 534
 535
 536 static const IRpcProxyBufferVtbl tmproxyvtable = {
 537     TMProxyImpl_QueryInterface,
 538     TMProxyImpl_AddRef,
 539     TMProxyImpl_Release,
 540     TMProxyImpl_Connect,
 541     TMProxyImpl_Disconnect
 542 };
 543
 544 /* how much space do we use on stack in DWORD steps. */
 545 static int
 546 _argsize(TYPEDESC *tdesc, ITypeInfo *tinfo) {
 547     switch (tdesc->vt) {
 548     case VT_I8:
 549     case VT_UI8:
 550         return 8/sizeof(DWORD);
 551     case VT_R8:
 552         return sizeof(double)/sizeof(DWORD);
 553     case VT_CY:
 554         return sizeof(CY)/sizeof(DWORD);
 555     case VT_DATE:
 556         return sizeof(DATE)/sizeof(DWORD);
 557     case VT_DECIMAL:
 558         return (sizeof(DECIMAL)+3)/sizeof(DWORD);
 559     case VT_VARIANT:
 560         return (sizeof(VARIANT)+3)/sizeof(DWORD);
 561     case VT_USERDEFINED:
 562     {
 563         ITypeInfo *tinfo2;
 564         TYPEATTR *tattr;
 565         HRESULT hres;
 566         DWORD ret;
 567
 568         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 569         if (FAILED(hres))
 570             return 0; /* should fail critically in serialize_param */
 571         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 572         ret = (tattr->cbSizeInstance+3)/sizeof(DWORD);
 573         ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
 574         ITypeInfo_Release(tinfo2);
 575         return ret;
 576     }
 577     default:
 578         return 1;
 579     }
 580 }
 581
 582 /* how much space do we use on the heap (in bytes) */
 583 static int
 584 _xsize(const TYPEDESC *td, ITypeInfo *tinfo) {
 585     switch (td->vt) {
 586     case VT_DATE:
 587         return sizeof(DATE);
 588     case VT_CY:
 589         return sizeof(CY);
 590     case VT_VARIANT:
 591         return sizeof(VARIANT);
 592     case VT_CARRAY: {
 593         int i, arrsize = 1;
 594         const ARRAYDESC *adesc = td->u.lpadesc;
 595
 596         for (i=0;i<adesc->cDims;i++)
 597             arrsize *= adesc->rgbounds[i].cElements;
 598         return arrsize*_xsize(&adesc->tdescElem, tinfo);
 599     }
 600     case VT_UI8:
 601     case VT_I8:
 602     case VT_R8:
 603         return 8;
 604     case VT_UI2:
 605     case VT_I2:
 606     case VT_BOOL:
 607         return 2;
 608     case VT_UI1:
 609     case VT_I1:
 610         return 1;
 611     case VT_USERDEFINED:
 612     {
 613         ITypeInfo *tinfo2;
 614         TYPEATTR *tattr;
 615         HRESULT hres;
 616         DWORD ret;
 617
 618         hres = ITypeInfo_GetRefTypeInfo(tinfo,td->u.hreftype,&tinfo2);
 619         if (FAILED(hres))
 620             return 0;
 621         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 622         ret = tattr->cbSizeInstance;
 623         ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
 624         ITypeInfo_Release(tinfo2);
 625         return ret;
 626     }
 627     default:
 628         return 4;
 629     }
 630 }
 631
 632 /* Whether we pass this type by reference or by value */
 633 static BOOL
 634 _passbyref(const TYPEDESC *td, ITypeInfo *tinfo) {
 635     return (td->vt == VT_USERDEFINED ||
 636             td->vt == VT_VARIANT     ||
 637             td->vt == VT_PTR);
 638 }
 639
 640 static HRESULT
 641 serialize_param(
 642     ITypeInfo           *tinfo,
 643     BOOL                writeit,
 644     BOOL                debugout,
 645     BOOL                dealloc,
 646     TYPEDESC            *tdesc,
 647     DWORD               *arg,
 648     marshal_state       *buf)
 649 {
 650     HRESULT hres = S_OK;
 651     VARTYPE vartype;
 652
 653     TRACE("(tdesc.vt %s)\n",debugstr_vt(tdesc->vt));
 654
 655     vartype = tdesc->vt;
 656     if ((vartype & 0xf000) == VT_ARRAY)
 657         vartype = VT_SAFEARRAY;
 658
 659     switch (vartype) {
 660     case VT_DATE:
 661     case VT_I8:
 662     case VT_UI8:
 663     case VT_R8:
 664     case VT_CY:
 665         hres = S_OK;
 666         if (debugout) TRACE_(olerelay)("%x%x\n",arg[0],arg[1]);
 667         if (writeit)
 668             hres = xbuf_add(buf,(LPBYTE)arg,8);
 669         return hres;
 670     case VT_ERROR:
 671     case VT_INT:
 672     case VT_UINT:
 673     case VT_I4:
 674     case VT_R4:
 675     case VT_UI4:
 676         hres = S_OK;
 677         if (debugout) TRACE_(olerelay)("%x\n",*arg);
 678         if (writeit)
 679             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 680         return hres;
 681     case VT_I2:
 682     case VT_UI2:
 683     case VT_BOOL:
 684         hres = S_OK;
 685         if (debugout) TRACE_(olerelay)("%04x\n",*arg & 0xffff);
 686         if (writeit)
 687             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 688         return hres;
 689     case VT_I1:
 690     case VT_UI1:
 691         hres = S_OK;
 692         if (debugout) TRACE_(olerelay)("%02x\n",*arg & 0xff);
 693         if (writeit)
 694             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 695         return hres;
 696     case VT_VARIANT: {
 697         if (debugout) TRACE_(olerelay)("Vt(%s%s)(",debugstr_vt(V_VT((VARIANT *)arg)),debugstr_vf(V_VT((VARIANT *)arg)));
 698         if (writeit)
 699         {
 700             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 701             ULONG size = VARIANT_UserSize(&flags, buf->curoff, (VARIANT *)arg);
 702             xbuf_resize(buf, size);
 703             VARIANT_UserMarshal(&flags, buf->base + buf->curoff, (VARIANT *)arg);
 704             buf->curoff = size;
 705         }
 706         if (dealloc)
 707         {
 708             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 709             VARIANT_UserFree(&flags, (VARIANT *)arg);
 710         }
 711         return S_OK;
 712     }
 713     case VT_BSTR: {
 714         if (writeit && debugout) {
 715             if (*arg)
 716                    TRACE_(olerelay)("%s",relaystr((WCHAR*)*arg));
 717             else
 718                     TRACE_(olerelay)("<bstr NULL>");
 719         }
 720         if (writeit)
 721         {
 722             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 723             ULONG size = BSTR_UserSize(&flags, buf->curoff, (BSTR *)arg);
 724             xbuf_resize(buf, size);
 725             BSTR_UserMarshal(&flags, buf->base + buf->curoff, (BSTR *)arg);
 726             buf->curoff = size;
 727         }
 728         if (dealloc)
 729         {
 730             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 731             BSTR_UserFree(&flags, (BSTR *)arg);
 732         }
 733         return S_OK;
 734     }
 735     case VT_PTR: {
 736         DWORD cookie;
 737         BOOL        derefhere = TRUE;
 738
 739         if (tdesc->u.lptdesc->vt == VT_USERDEFINED) {
 740             ITypeInfo   *tinfo2;
 741             TYPEATTR    *tattr;
 742
 743             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.lptdesc->u.hreftype,&tinfo2);
 744             if (hres) {
 745                 ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.lptdesc->u.hreftype);
 746                 return hres;
 747             }
 748             ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 749             switch (tattr->typekind) {
 750             case TKIND_ALIAS:
 751                 if (tattr->tdescAlias.vt == VT_USERDEFINED)
 752                 {
 753                     DWORD href = tattr->tdescAlias.u.hreftype;
 754                     ITypeInfo_ReleaseTypeAttr(tinfo, tattr);
 755                     ITypeInfo_Release(tinfo2);
 756                     hres = ITypeInfo_GetRefTypeInfo(tinfo,href,&tinfo2);
 757                     if (hres) {
 758                         ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.lptdesc->u.hreftype);
 759                         return hres;
 760                     }
 761                     ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 762                     derefhere = (tattr->typekind != TKIND_DISPATCH && tattr->typekind != TKIND_INTERFACE);
 763                 }
 764                 break;
 765             case TKIND_ENUM:    /* confirmed */
 766             case TKIND_RECORD:  /* FIXME: mostly untested */
 767                 break;
 768             case TKIND_DISPATCH:        /* will be done in VT_USERDEFINED case */
 769             case TKIND_INTERFACE:       /* will be done in VT_USERDEFINED case */
 770                 derefhere=FALSE;
 771                 break;
 772             default:
 773                 FIXME("unhandled switch cases tattr->typekind %d\n", tattr->typekind);
 774                 derefhere=FALSE;
 775                 break;
 776             }
 777             ITypeInfo_ReleaseTypeAttr(tinfo, tattr);
 778             ITypeInfo_Release(tinfo2);
 779         }
 780
 781         if (debugout) TRACE_(olerelay)("*");
 782         /* Write always, so the other side knows when it gets a NULL pointer.
 783          */
 784         cookie = *arg ? 0x42424242 : 0;
 785         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 786         if (hres)
 787             return hres;
 788         if (!*arg) {
 789             if (debugout) TRACE_(olerelay)("NULL");
 790             return S_OK;
 791         }
 792         hres = serialize_param(tinfo,writeit,debugout,dealloc,tdesc->u.lptdesc,(DWORD*)*arg,buf);
 793         if (derefhere && dealloc) HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 794         return hres;
 795     }
 796     case VT_UNKNOWN:
 797         if (debugout) TRACE_(olerelay)("unk(0x%x)",*arg);
 798         if (writeit)
 799             hres = _marshal_interface(buf,&IID_IUnknown,(LPUNKNOWN)*arg);
 800         if (dealloc && *(IUnknown **)arg)
 801             IUnknown_Release((LPUNKNOWN)*arg);
 802         return hres;
 803     case VT_DISPATCH:
 804         if (debugout) TRACE_(olerelay)("idisp(0x%x)",*arg);
 805         if (writeit)
 806             hres = _marshal_interface(buf,&IID_IDispatch,(LPUNKNOWN)*arg);
 807         if (dealloc && *(IUnknown **)arg)
 808             IUnknown_Release((LPUNKNOWN)*arg);
 809         return hres;
 810     case VT_VOID:
 811         if (debugout) TRACE_(olerelay)("<void>");
 812         return S_OK;
 813     case VT_USERDEFINED: {
 814         ITypeInfo       *tinfo2;
 815         TYPEATTR        *tattr;
 816
 817         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 818         if (hres) {
 819             ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.hreftype);
 820             return hres;
 821         }
 822         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 823         switch (tattr->typekind) {
 824         case TKIND_DISPATCH:
 825         case TKIND_INTERFACE:
 826             if (writeit)
 827                hres=_marshal_interface(buf,&(tattr->guid),(LPUNKNOWN)arg);
 828             if (dealloc)
 829                 IUnknown_Release((LPUNKNOWN)arg);
 830             break;
 831         case TKIND_RECORD: {
 832             int i;
 833             if (debugout) TRACE_(olerelay)("{");
 834             for (i=0;i<tattr->cVars;i++) {
 835                 VARDESC *vdesc;
 836                 ELEMDESC *elem2;
 837                 TYPEDESC *tdesc2;
 838
 839                 hres = ITypeInfo_GetVarDesc(tinfo2, i, &vdesc);
 840                 if (hres) {
 841                     ERR("Could not get vardesc of %d\n",i);
 842                     return hres;
 843                 }
 844                 elem2 = &vdesc->elemdescVar;
 845                 tdesc2 = &elem2->tdesc;
 846                 hres = serialize_param(
 847                     tinfo2,
 848                     writeit,
 849                     debugout,
 850                     dealloc,
 851                     tdesc2,
 852                     (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
 853                     buf
 854                 );
 855                 ITypeInfo_ReleaseVarDesc(tinfo2, vdesc);
 856                 if (hres!=S_OK)
 857                     return hres;
 858                 if (debugout && (i<(tattr->cVars-1)))
 859                     TRACE_(olerelay)(",");
 860             }
 861             if (debugout) TRACE_(olerelay)("}");
 862             break;
 863         }
 864         case TKIND_ALIAS:
 865             hres = serialize_param(tinfo2,writeit,debugout,dealloc,&tattr->tdescAlias,arg,buf);
 866             break;
 867         case TKIND_ENUM:
 868             hres = S_OK;
 869             if (debugout) TRACE_(olerelay)("%x",*arg);
 870             if (writeit)
 871                 hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 872             break;
 873         default:
 874             FIXME("Unhandled typekind %d\n",tattr->typekind);
 875             hres = E_FAIL;
 876             break;
 877         }
 878         ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
 879         ITypeInfo_Release(tinfo2);
 880         return hres;
 881     }
 882     case VT_CARRAY: {
 883         ARRAYDESC *adesc = tdesc->u.lpadesc;
 884         int i, arrsize = 1;
 885
 886         if (debugout) TRACE_(olerelay)("carr");
 887         for (i=0;i<adesc->cDims;i++) {
 888             if (debugout) TRACE_(olerelay)("[%d]",adesc->rgbounds[i].cElements);
 889             arrsize *= adesc->rgbounds[i].cElements;
 890         }
 891         if (debugout) TRACE_(olerelay)("(vt %s)",debugstr_vt(adesc->tdescElem.vt));
 892         if (debugout) TRACE_(olerelay)("[");
 893         for (i=0;i<arrsize;i++) {
 894             LPBYTE base = _passbyref(&adesc->tdescElem, tinfo) ? (LPBYTE) *arg : (LPBYTE) arg;
 895             hres = serialize_param(tinfo, writeit, debugout, dealloc, &adesc->tdescElem, (DWORD*)((LPBYTE)base+i*_xsize(&adesc->tdescElem, tinfo)), buf);
 896             if (hres)
 897                 return hres;
 898             if (debugout && (i<arrsize-1)) TRACE_(olerelay)(",");
 899         }
 900         if (debugout) TRACE_(olerelay)("]");
 901         if (dealloc)
 902             HeapFree(GetProcessHeap(), 0, *(void **)arg);
 903         return S_OK;
 904     }
 905     case VT_SAFEARRAY: {
 906         if (writeit)
 907         {
 908             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 909             ULONG size = LPSAFEARRAY_UserSize(&flags, buf->curoff, (LPSAFEARRAY *)arg);
 910             xbuf_resize(buf, size);
 911             LPSAFEARRAY_UserMarshal(&flags, buf->base + buf->curoff, (LPSAFEARRAY *)arg);
 912             buf->curoff = size;
 913         }
 914         if (dealloc)
 915         {
 916             ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 917             LPSAFEARRAY_UserFree(&flags, (LPSAFEARRAY *)arg);
 918         }
 919         return S_OK;
 920     }
 921     default:
 922         ERR("Unhandled marshal type %d.\n",tdesc->vt);
 923         return S_OK;
 924     }
 925 }
 926
 927 static HRESULT
 928 deserialize_param(
 929     ITypeInfo           *tinfo,
 930     BOOL                readit,
 931     BOOL                debugout,
 932     BOOL                alloc,
 933     TYPEDESC            *tdesc,
 934     DWORD               *arg,
 935     marshal_state       *buf)
 936 {
 937     HRESULT hres = S_OK;
 938     VARTYPE vartype;
 939
 940     TRACE("vt %s at %p\n",debugstr_vt(tdesc->vt),arg);
 941
 942     vartype = tdesc->vt;
 943     if ((vartype & 0xf000) == VT_ARRAY)
 944         vartype = VT_SAFEARRAY;
 945
 946     while (1) {
 947         switch (vartype) {
 948         case VT_VARIANT: {
 949             if (readit)
 950             {
 951                 ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
 952                 unsigned char *buffer;
 953                 buffer = VARIANT_UserUnmarshal(&flags, buf->base + buf->curoff, (VARIANT *)arg);
 954                 buf->curoff = buffer - buf->base;
 955             }
 956             return S_OK;
 957         }
 958         case VT_DATE:
 959         case VT_I8:
 960         case VT_UI8:
 961         case VT_R8:
 962         case VT_CY:
 963             if (readit) {
 964                 hres = xbuf_get(buf,(LPBYTE)arg,8);
 965                 if (hres) ERR("Failed to read integer 8 byte\n");
 966             }
 967             if (debugout) TRACE_(olerelay)("%x%x",arg[0],arg[1]);
 968             return hres;
 969         case VT_ERROR:
 970         case VT_I4:
 971         case VT_INT:
 972         case VT_UINT:
 973         case VT_R4:
 974         case VT_UI4:
 975             if (readit) {
 976                 hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
 977                 if (hres) ERR("Failed to read integer 4 byte\n");
 978             }
 979             if (debugout) TRACE_(olerelay)("%x",*arg);
 980             return hres;
 981         case VT_I2:
 982         case VT_UI2:
 983         case VT_BOOL:
 984             if (readit) {
 985                 DWORD x;
 986                 hres = xbuf_get(buf,(LPBYTE)&x,sizeof(DWORD));
 987                 if (hres) ERR("Failed to read integer 4 byte\n");
 988                 memcpy(arg,&x,2);
 989             }
 990             if (debugout) TRACE_(olerelay)("%04x",*arg & 0xffff);
 991             return hres;
 992         case VT_I1:
 993         case VT_UI1:
 994             if (readit) {
 995                 DWORD x;
 996                 hres = xbuf_get(buf,(LPBYTE)&x,sizeof(DWORD));
 997                 if (hres) ERR("Failed to read integer 4 byte\n");
 998                 memcpy(arg,&x,1);
 999             }
1000             if (debugout) TRACE_(olerelay)("%02x",*arg & 0xff);
1001             return hres;
1002         case VT_BSTR: {
1003             if (readit)
1004             {
1005                 ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
1006                 unsigned char *buffer;
1007                 buffer = BSTR_UserUnmarshal(&flags, buf->base + buf->curoff, (BSTR *)arg);
1008                 buf->curoff = buffer - buf->base;
1009                 if (debugout) TRACE_(olerelay)("%s",debugstr_w(*(BSTR *)arg));
1010             }
1011             return S_OK;
1012         }
1013         case VT_PTR: {
1014             DWORD       cookie;
1015             BOOL        derefhere = TRUE;
1016
1017             if (tdesc->u.lptdesc->vt == VT_USERDEFINED) {
1018                 ITypeInfo       *tinfo2;
1019                 TYPEATTR        *tattr;
1020
1021                 hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.lptdesc->u.hreftype,&tinfo2);
1022                 if (hres) {
1023                     ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.lptdesc->u.hreftype);
1024                     return hres;
1025                 }
1026                 ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1027                 switch (tattr->typekind) {
1028                 case TKIND_ALIAS:
1029                     if (tattr->tdescAlias.vt == VT_USERDEFINED)
1030                     {
1031                         DWORD href = tattr->tdescAlias.u.hreftype;
1032                         ITypeInfo_ReleaseTypeAttr(tinfo, tattr);
1033                         ITypeInfo_Release(tinfo2);
1034                         hres = ITypeInfo_GetRefTypeInfo(tinfo,href,&tinfo2);
1035                         if (hres) {
1036                             ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.lptdesc->u.hreftype);
1037                             return hres;
1038                         }
1039                         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1040                         derefhere = (tattr->typekind != TKIND_DISPATCH && tattr->typekind != TKIND_INTERFACE);
1041                     }
1042                     break;
1043                 case TKIND_ENUM:        /* confirmed */
1044                 case TKIND_RECORD:      /* FIXME: mostly untested */
1045                     break;
1046                 case TKIND_DISPATCH:    /* will be done in VT_USERDEFINED case */
1047                 case TKIND_INTERFACE:   /* will be done in VT_USERDEFINED case */
1048                     derefhere=FALSE;
1049                     break;
1050                 default:
1051                     FIXME("unhandled switch cases tattr->typekind %d\n", tattr->typekind);
1052                     derefhere=FALSE;
1053                     break;
1054                 }
1055                 ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
1056                 ITypeInfo_Release(tinfo2);
1057             }
1058             /* read it in all cases, we need to know if we have
1059              * NULL pointer or not.
1060              */
1061             hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
1062             if (hres) {
1063                 ERR("Failed to load pointer cookie.\n");
1064                 return hres;
1065             }
1066             if (cookie != 0x42424242) {
1067                 /* we read a NULL ptr from the remote side */
1068                 if (debugout) TRACE_(olerelay)("NULL");
1069                 *arg = 0;
1070                 return S_OK;
1071             }
1072             if (debugout) TRACE_(olerelay)("*");
1073             if (alloc) {
1074                 /* Allocate space for the referenced struct */
1075                 if (derefhere)
1076                     *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc, tinfo));
1077             }
1078             if (derefhere)
1079                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, (LPDWORD)*arg, buf);
1080             else
1081                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, arg, buf);
1082         }
1083         case VT_UNKNOWN:
1084             /* FIXME: UNKNOWN is unknown ..., but allocate 4 byte for it */
1085             if (alloc)
1086                 *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
1087             hres = S_OK;
1088             if (readit)
1089                 hres = _unmarshal_interface(buf,&IID_IUnknown,(LPUNKNOWN*)arg);
1090             if (debugout)
1091                 TRACE_(olerelay)("unk(%p)",arg);
1092             return hres;
1093         case VT_DISPATCH:
1094             hres = S_OK;
1095             if (readit)
1096                 hres = _unmarshal_interface(buf,&IID_IDispatch,(LPUNKNOWN*)arg);
1097             if (debugout)
1098                 TRACE_(olerelay)("idisp(%p)",arg);
1099             return hres;
1100         case VT_VOID:
1101             if (debugout) TRACE_(olerelay)("<void>");
1102             return S_OK;
1103         case VT_USERDEFINED: {
1104             ITypeInfo   *tinfo2;
1105             TYPEATTR    *tattr;
1106
1107             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
1108             if (hres) {
1109                 ERR("Could not get typeinfo of hreftype %x for VT_USERDEFINED.\n",tdesc->u.hreftype);
1110                 return hres;
1111             }
1112             hres = ITypeInfo_GetTypeAttr(tinfo2,&tattr);
1113             if (hres) {
1114                 ERR("Could not get typeattr in VT_USERDEFINED.\n");
1115             } else {
1116                 switch (tattr->typekind) {
1117                 case TKIND_DISPATCH:
1118                 case TKIND_INTERFACE:
1119                     if (readit)
1120                         hres = _unmarshal_interface(buf,&(tattr->guid),(LPUNKNOWN*)arg);
1121                     break;
1122                 case TKIND_RECORD: {
1123                     int i;
1124
1125                     if (debugout) TRACE_(olerelay)("{");
1126                     for (i=0;i<tattr->cVars;i++) {
1127                         VARDESC *vdesc;
1128
1129                         hres = ITypeInfo_GetVarDesc(tinfo2, i, &vdesc);
1130                         if (hres) {
1131                             ERR("Could not get vardesc of %d\n",i);
1132                             ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
1133                             ITypeInfo_Release(tinfo2);
1134                             return hres;
1135                         }
1136                         hres = deserialize_param(
1137                             tinfo2,
1138                             readit,
1139                             debugout,
1140                             alloc,
1141                             &vdesc->elemdescVar.tdesc,
1142                             (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
1143                             buf
1144                         );
1145                         ITypeInfo_ReleaseVarDesc(tinfo2, vdesc);
1146                         if (debugout && (i<tattr->cVars-1)) TRACE_(olerelay)(",");
1147                     }
1148                     if (debugout) TRACE_(olerelay)("}");
1149                     break;
1150                 }
1151                 case TKIND_ALIAS:
1152                     hres = deserialize_param(tinfo2,readit,debugout,alloc,&tattr->tdescAlias,arg,buf);
1153                     break;
1154                 case TKIND_ENUM:
1155                     if (readit) {
1156                         hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
1157                         if (hres) ERR("Failed to read enum (4 byte)\n");
1158                     }
1159                     if (debugout) TRACE_(olerelay)("%x",*arg);
1160                     break;
1161                 default:
1162                     ERR("Unhandled typekind %d\n",tattr->typekind);
1163                     hres = E_FAIL;
1164                     break;
1165                 }
1166                 ITypeInfo_ReleaseTypeAttr(tinfo2, tattr);
1167             }
1168             if (hres)
1169                 ERR("failed to stuballoc in TKIND_RECORD.\n");
1170             ITypeInfo_Release(tinfo2);
1171             return hres;
1172         }
1173         case VT_CARRAY: {
1174             /* arg is pointing to the start of the array. */
1175             LPBYTE base = (LPBYTE) arg;
1176             ARRAYDESC *adesc = tdesc->u.lpadesc;
1177             int         arrsize,i;
1178             arrsize = 1;
1179             if (adesc->cDims > 1) FIXME("cDims > 1 in VT_CARRAY. Does it work?\n");
1180             for (i=0;i<adesc->cDims;i++)
1181                 arrsize *= adesc->rgbounds[i].cElements;
1182             if (_passbyref(&adesc->tdescElem, tinfo))
1183             {
1184                 base = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc, tinfo) * arrsize);
1185                 *arg = (DWORD) base;
1186             }
1187             for (i=0;i<arrsize;i++)
1188                 deserialize_param(
1189                     tinfo,
1190                     readit,
1191                     debugout,
1192                     alloc,
1193                     &adesc->tdescElem,
1194                     (DWORD*)(base + i*_xsize(&adesc->tdescElem, tinfo)),
1195                     buf
1196                 );
1197             return S_OK;
1198         }
1199         case VT_SAFEARRAY: {
1200             if (readit)
1201             {
1202                 ULONG flags = MAKELONG(MSHCTX_DIFFERENTMACHINE, NDR_LOCAL_DATA_REPRESENTATION);
1203                 unsigned char *buffer;
1204                 buffer = LPSAFEARRAY_UserUnmarshal(&flags, buf->base + buf->curoff, (LPSAFEARRAY *)arg);
1205                 buf->curoff = buffer - buf->base;
1206             }
1207             return S_OK;
1208         }
1209         default:
1210             ERR("No handler for VT type %d!\n",tdesc->vt);
1211             return S_OK;
1212         }
1213     }
1214 }
1215
1216 /* Retrieves a function's funcdesc, searching back into inherited interfaces. */
1217 static HRESULT get_funcdesc(ITypeInfo *tinfo, int iMethod, ITypeInfo **tactual, const FUNCDESC **fdesc,
1218                             BSTR *iname, BSTR *fname, UINT *num)
1219 {
1220     HRESULT hr;
1221     UINT i, impl_types;
1222     UINT inherited_funcs = 0;
1223     TYPEATTR *attr;
1224
1225     if (fname) *fname = NULL;
1226     if (iname) *iname = NULL;
1227     if (num) *num = 0;
1228     *tactual = NULL;
1229
1230     hr = ITypeInfo_GetTypeAttr(tinfo, &attr);
1231     if (FAILED(hr))
1232     {
1233         ERR("GetTypeAttr failed with %x\n",hr);
1234         return hr;
1235     }
1236
1237     if(attr->typekind == TKIND_DISPATCH)
1238     {
1239         if(attr->wTypeFlags & TYPEFLAG_FDUAL)
1240         {
1241             HREFTYPE href;
1242             ITypeInfo *tinfo2;
1243
1244             hr = ITypeInfo_GetRefTypeOfImplType(tinfo, -1, &href);
1245             if(FAILED(hr))
1246             {
1247                 ERR("Cannot get interface href from dual dispinterface\n");
1248                 ITypeInfo_ReleaseTypeAttr(tinfo, attr);
1249                 return hr;
1250             }
1251             hr = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
1252             if(FAILED(hr))
1253             {
1254                 ERR("Cannot get interface from dual dispinterface\n");
1255                 ITypeInfo_ReleaseTypeAttr(tinfo, attr);
1256                 return hr;
1257             }
1258             hr = get_funcdesc(tinfo2, iMethod, tactual, fdesc, iname, fname, num);
1259             ITypeInfo_Release(tinfo2);
1260             ITypeInfo_ReleaseTypeAttr(tinfo, attr);
1261             return hr;
1262         }
1263         ERR("Shouldn't be called with a non-dual dispinterface\n");
1264         return E_FAIL;
1265     }
1266
1267     impl_types = attr->cImplTypes;
1268     ITypeInfo_ReleaseTypeAttr(tinfo, attr);
1269
1270     for (i = 0; i < impl_types; i++)
1271     {
1272         HREFTYPE href;
1273         ITypeInfo *pSubTypeInfo;
1274         UINT sub_funcs;
1275
1276         hr = ITypeInfo_GetRefTypeOfImplType(tinfo, i, &href);
1277         if (FAILED(hr)) return hr;
1278         hr = ITypeInfo_GetRefTypeInfo(tinfo, href, &pSubTypeInfo);
1279         if (FAILED(hr)) return hr;
1280
1281         hr = get_funcdesc(pSubTypeInfo, iMethod, tactual, fdesc, iname, fname, &sub_funcs);
1282         inherited_funcs += sub_funcs;
1283         ITypeInfo_Release(pSubTypeInfo);
1284         if(SUCCEEDED(hr)) return hr;
1285     }
1286     if(iMethod < inherited_funcs)
1287     {
1288         ERR("shouldn't be here\n");
1289         return E_INVALIDARG;
1290     }
1291
1292     for(i = inherited_funcs; i <= iMethod; i++)
1293     {
1294         hr = ITypeInfoImpl_GetInternalFuncDesc(tinfo, i - inherited_funcs, fdesc);
1295         if(FAILED(hr))
1296         {
1297             if(num) *num = i;
1298             return hr;
1299         }
1300     }
1301
1302     /* found it. We don't care about num so zero it */
1303     if(num) *num = 0;
1304     *tactual = tinfo;
1305     ITypeInfo_AddRef(*tactual);
1306     if (fname) ITypeInfo_GetDocumentation(tinfo,(*fdesc)->memid,fname,NULL,NULL,NULL);
1307     if (iname) ITypeInfo_GetDocumentation(tinfo,-1,iname,NULL,NULL,NULL);
1308     return S_OK;
1309 }
1310
1311 static inline BOOL is_in_elem(const ELEMDESC *elem)
1312 {
1313     return (elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN || !elem->u.paramdesc.wParamFlags);
1314 }
1315
1316 static inline BOOL is_out_elem(const ELEMDESC *elem)
1317 {
1318     return (elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT || !elem->u.paramdesc.wParamFlags);
1319 }
1320
1321 static DWORD WINAPI xCall(int method, void **args)
1322 {
1323     TMProxyImpl *tpinfo = args[0];
1324     DWORD *xargs;
1325     const FUNCDESC      *fdesc;
1326     HRESULT             hres;
1327     int                 i;
1328     marshal_state       buf;
1329     RPCOLEMESSAGE       msg;
1330     ULONG               status;
1331     BSTR                fname,iname;
1332     BSTR                names[10];
1333     UINT                nrofnames;
1334     DWORD               remoteresult = 0;
1335     ITypeInfo           *tinfo;
1336     IRpcChannelBuffer *chanbuf;
1337
1338     EnterCriticalSection(&tpinfo->crit);
1339
1340     hres = get_funcdesc(tpinfo->tinfo,method,&tinfo,&fdesc,&iname,&fname,NULL);
1341     if (hres) {
1342         ERR("Did not find typeinfo/funcdesc entry for method %d!\n",method);
1343         LeaveCriticalSection(&tpinfo->crit);
1344         return E_FAIL;
1345     }
1346
1347     if (!tpinfo->chanbuf)
1348     {
1349         WARN("Tried to use disconnected proxy\n");
1350         ITypeInfo_Release(tinfo);
1351         LeaveCriticalSection(&tpinfo->crit);
1352         return RPC_E_DISCONNECTED;
1353     }
1354     chanbuf = tpinfo->chanbuf;
1355     IRpcChannelBuffer_AddRef(chanbuf);
1356
1357     LeaveCriticalSection(&tpinfo->crit);
1358
1359     if (TRACE_ON(olerelay)) {
1360        TRACE_(olerelay)("->");
1361         if (iname)
1362             TRACE_(olerelay)("%s:",relaystr(iname));
1363         if (fname)
1364             TRACE_(olerelay)("%s(%d)",relaystr(fname),method);
1365         else
1366             TRACE_(olerelay)("%d",method);
1367         TRACE_(olerelay)("(");
1368     }
1369
1370     SysFreeString(iname);
1371     SysFreeString(fname);
1372
1373     memset(&buf,0,sizeof(buf));
1374
1375     /* normal typelib driven serializing */
1376
1377     /* Need them for hack below */
1378     memset(names,0,sizeof(names));
1379     if (ITypeInfo_GetNames(tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames))
1380         nrofnames = 0;
1381     if (nrofnames > sizeof(names)/sizeof(names[0]))
1382         ERR("Need more names!\n");
1383
1384     xargs = (DWORD *)(args + 1);
1385     for (i=0;i<fdesc->cParams;i++) {
1386         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1387         if (TRACE_ON(olerelay)) {
1388             if (i) TRACE_(olerelay)(",");
1389             if (i+1<nrofnames && names[i+1])
1390                 TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1391         }
1392         /* No need to marshal other data than FIN and any VT_PTR. */
1393         if (!is_in_elem(elem))
1394         {
1395             if (elem->tdesc.vt != VT_PTR)
1396             {
1397                 xargs+=_argsize(&elem->tdesc, tinfo);
1398                 TRACE_(olerelay)("[out]");
1399                 continue;
1400             }
1401             else
1402             {
1403                 memset( *(void **)xargs, 0, _xsize( elem->tdesc.u.lptdesc, tinfo ) );
1404             }
1405         }
1406
1407         hres = serialize_param(
1408             tinfo,
1409             is_in_elem(elem),
1410             TRACE_ON(olerelay),
1411             FALSE,
1412             &elem->tdesc,
1413             xargs,
1414             &buf
1415         );
1416
1417         if (hres) {
1418             ERR("Failed to serialize param, hres %x\n",hres);
1419             break;
1420         }
1421         xargs+=_argsize(&elem->tdesc, tinfo);
1422     }
1423     TRACE_(olerelay)(")");
1424
1425     memset(&msg,0,sizeof(msg));
1426     msg.cbBuffer = buf.curoff;
1427     msg.iMethod  = method;
1428     hres = IRpcChannelBuffer_GetBuffer(chanbuf,&msg,&(tpinfo->iid));
1429     if (hres) {
1430         ERR("RpcChannelBuffer GetBuffer failed, %x\n",hres);
1431         goto exit;
1432     }
1433     memcpy(msg.Buffer,buf.base,buf.curoff);
1434     TRACE_(olerelay)("\n");
1435     hres = IRpcChannelBuffer_SendReceive(chanbuf,&msg,&status);
1436     if (hres) {
1437         ERR("RpcChannelBuffer SendReceive failed, %x\n",hres);
1438         goto exit;
1439     }
1440
1441     TRACE_(olerelay)(" status = %08x (",status);
1442     if (buf.base)
1443         buf.base = HeapReAlloc(GetProcessHeap(),0,buf.base,msg.cbBuffer);
1444     else
1445         buf.base = HeapAlloc(GetProcessHeap(),0,msg.cbBuffer);
1446     buf.size = msg.cbBuffer;
1447     memcpy(buf.base,msg.Buffer,buf.size);
1448     buf.curoff = 0;
1449
1450     /* generic deserializer using typelib description */
1451     xargs = (DWORD *)(args + 1);
1452     status = S_OK;
1453     for (i=0;i<fdesc->cParams;i++) {
1454         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1455
1456         if (i) TRACE_(olerelay)(",");
1457         if (i+1<nrofnames && names[i+1]) TRACE_(olerelay)("%s=",relaystr(names[i+1]));
1458
1459         /* No need to marshal other data than FOUT and any VT_PTR */
1460         if (!is_out_elem(elem) && (elem->tdesc.vt != VT_PTR)) {
1461             xargs += _argsize(&elem->tdesc, tinfo);
1462             TRACE_(olerelay)("[in]");
1463             continue;
1464         }
1465         hres = deserialize_param(
1466             tinfo,
1467             is_out_elem(elem),
1468             TRACE_ON(olerelay),
1469             FALSE,
1470             &(elem->tdesc),
1471             xargs,
1472             &buf
1473         );
1474         if (hres) {
1475             ERR("Failed to unmarshall param, hres %x\n",hres);
1476             status = hres;
1477             break;
1478         }
1479         xargs += _argsize(&elem->tdesc, tinfo);
1480     }
1481
1482     hres = xbuf_get(&buf, (LPBYTE)&remoteresult, sizeof(DWORD));
1483     if (hres != S_OK)
1484         goto exit;
1485     TRACE_(olerelay)(") = %08x\n", remoteresult);
1486
1487     hres = remoteresult;
1488
1489 exit:
1490     IRpcChannelBuffer_FreeBuffer(chanbuf,&msg);
1491     for (i = 0; i < nrofnames; i++)
1492         SysFreeString(names[i]);
1493     HeapFree(GetProcessHeap(),0,buf.base);
1494     IRpcChannelBuffer_Release(chanbuf);
1495     ITypeInfo_Release(tinfo);
1496     TRACE("-- 0x%08x\n", hres);
1497     return hres;
1498 }
1499
1500 static HRESULT WINAPI ProxyIUnknown_QueryInterface(IUnknown *iface, REFIID riid, void **ppv)
1501 {
1502     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1503
1504     TRACE("(%s, %p)\n", debugstr_guid(riid), ppv);
1505
1506     if (proxy->outerunknown)
1507         return IUnknown_QueryInterface(proxy->outerunknown, riid, ppv);
1508
1509     FIXME("No interface\n");
1510     return E_NOINTERFACE;
1511 }
1512
1513 static ULONG WINAPI ProxyIUnknown_AddRef(IUnknown *iface)
1514 {
1515     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1516
1517     TRACE("\n");
1518
1519     if (proxy->outerunknown)
1520         return IUnknown_AddRef(proxy->outerunknown);
1521
1522     return 2; /* FIXME */
1523 }
1524
1525 static ULONG WINAPI ProxyIUnknown_Release(IUnknown *iface)
1526 {
1527     TMProxyImpl *proxy = (TMProxyImpl *)iface;
1528
1529     TRACE("\n");
1530
1531     if (proxy->outerunknown)
1532         return IUnknown_Release(proxy->outerunknown);
1533
1534     return 1; /* FIXME */
1535 }
1536
1537 static HRESULT WINAPI ProxyIDispatch_GetTypeInfoCount(LPDISPATCH iface, UINT * pctinfo)
1538 {
1539     TMProxyImpl *This = (TMProxyImpl *)iface;
1540
1541     TRACE("(%p)\n", pctinfo);
1542
1543     return IDispatch_GetTypeInfoCount(This->dispatch, pctinfo);
1544 }
1545
1546 static HRESULT WINAPI ProxyIDispatch_GetTypeInfo(LPDISPATCH iface, UINT iTInfo, LCID lcid, ITypeInfo** ppTInfo)
1547 {
1548     TMProxyImpl *This = (TMProxyImpl *)iface;
1549
1550     TRACE("(%d, %x, %p)\n", iTInfo, lcid, ppTInfo);
1551
1552     return IDispatch_GetTypeInfo(This->dispatch, iTInfo, lcid, ppTInfo);
1553 }
1554
1555 static HRESULT WINAPI ProxyIDispatch_GetIDsOfNames(LPDISPATCH iface, REFIID riid, LPOLESTR * rgszNames, UINT cNames, LCID lcid, DISPID * rgDispId)
1556 {
1557     TMProxyImpl *This = (TMProxyImpl *)iface;
1558
1559     TRACE("(%s, %p, %d, 0x%x, %p)\n", debugstr_guid(riid), rgszNames, cNames, lcid, rgDispId);
1560
1561     return IDispatch_GetIDsOfNames(This->dispatch, riid, rgszNames,
1562                                    cNames, lcid, rgDispId);
1563 }
1564
1565 static HRESULT WINAPI ProxyIDispatch_Invoke(LPDISPATCH iface, DISPID dispIdMember, REFIID riid, LCID lcid,
1566                                             WORD wFlags, DISPPARAMS * pDispParams, VARIANT * pVarResult,
1567                                             EXCEPINFO * pExcepInfo, UINT * puArgErr)
1568 {
1569     TMProxyImpl *This = (TMProxyImpl *)iface;
1570
1571     TRACE("(%d, %s, 0x%x, 0x%x, %p, %p, %p, %p)\n", dispIdMember,
1572           debugstr_guid(riid), lcid, wFlags, pDispParams, pVarResult,
1573           pExcepInfo, puArgErr);
1574
1575     return IDispatch_Invoke(This->dispatch, dispIdMember, riid, lcid,
1576                             wFlags, pDispParams, pVarResult, pExcepInfo,
1577                             puArgErr);
1578 }
1579
1580 typedef struct
1581 {
1582     IRpcChannelBuffer     IRpcChannelBuffer_iface;
1583     LONG                  refs;
1584     /* the IDispatch-derived interface we are handling */
1585     IID                   tmarshal_iid;
1586     IRpcChannelBuffer    *pDelegateChannel;
1587 } TMarshalDispatchChannel;
1588
1589 static inline TMarshalDispatchChannel *impl_from_IRpcChannelBuffer(IRpcChannelBuffer *iface)
1590 {
1591     return CONTAINING_RECORD(iface, TMarshalDispatchChannel, IRpcChannelBuffer_iface);
1592 }
1593
1594 static HRESULT WINAPI TMarshalDispatchChannel_QueryInterface(IRpcChannelBuffer *iface, REFIID riid, LPVOID *ppv)
1595 {
1596     *ppv = NULL;
1597     if (IsEqualIID(riid,&IID_IRpcChannelBuffer) || IsEqualIID(riid,&IID_IUnknown))
1598     {
1599         *ppv = iface;
1600         IRpcChannelBuffer_AddRef(iface);
1601         return S_OK;
1602     }
1603     return E_NOINTERFACE;
1604 }
1605
1606 static ULONG WINAPI TMarshalDispatchChannel_AddRef(LPRPCCHANNELBUFFER iface)
1607 {
1608     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1609     return InterlockedIncrement(&This->refs);
1610 }
1611
1612 static ULONG WINAPI TMarshalDispatchChannel_Release(LPRPCCHANNELBUFFER iface)
1613 {
1614     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1615     ULONG ref;
1616
1617     ref = InterlockedDecrement(&This->refs);
1618     if (ref)
1619         return ref;
1620
1621     IRpcChannelBuffer_Release(This->pDelegateChannel);
1622     HeapFree(GetProcessHeap(), 0, This);
1623     return 0;
1624 }
1625
1626 static HRESULT WINAPI TMarshalDispatchChannel_GetBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg, REFIID riid)
1627 {
1628     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1629     TRACE("(%p, %s)\n", olemsg, debugstr_guid(riid));
1630     /* Note: we are pretending to invoke a method on the interface identified
1631      * by tmarshal_iid so that we can re-use the IDispatch proxy/stub code
1632      * without the RPC runtime getting confused by not exporting an IDispatch interface */
1633     return IRpcChannelBuffer_GetBuffer(This->pDelegateChannel, olemsg, &This->tmarshal_iid);
1634 }
1635
1636 static HRESULT WINAPI TMarshalDispatchChannel_SendReceive(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE *olemsg, ULONG *pstatus)
1637 {
1638     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1639     TRACE("(%p, %p)\n", olemsg, pstatus);
1640     return IRpcChannelBuffer_SendReceive(This->pDelegateChannel, olemsg, pstatus);
1641 }
1642
1643 static HRESULT WINAPI TMarshalDispatchChannel_FreeBuffer(LPRPCCHANNELBUFFER iface, RPCOLEMESSAGE* olemsg)
1644 {
1645     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1646     TRACE("(%p)\n", olemsg);
1647     return IRpcChannelBuffer_FreeBuffer(This->pDelegateChannel, olemsg);
1648 }
1649
1650 static HRESULT WINAPI TMarshalDispatchChannel_GetDestCtx(LPRPCCHANNELBUFFER iface, DWORD* pdwDestContext, void** ppvDestContext)
1651 {
1652     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1653     TRACE("(%p,%p)\n", pdwDestContext, ppvDestContext);
1654     return IRpcChannelBuffer_GetDestCtx(This->pDelegateChannel, pdwDestContext, ppvDestContext);
1655 }
1656
1657 static HRESULT WINAPI TMarshalDispatchChannel_IsConnected(LPRPCCHANNELBUFFER iface)
1658 {
1659     TMarshalDispatchChannel *This = impl_from_IRpcChannelBuffer(iface);
1660     TRACE("()\n");
1661     return IRpcChannelBuffer_IsConnected(This->pDelegateChannel);
1662 }
1663
1664 static const IRpcChannelBufferVtbl TMarshalDispatchChannelVtbl =
1665 {
1666     TMarshalDispatchChannel_QueryInterface,
1667     TMarshalDispatchChannel_AddRef,
1668     TMarshalDispatchChannel_Release,
1669     TMarshalDispatchChannel_GetBuffer,
1670     TMarshalDispatchChannel_SendReceive,
1671     TMarshalDispatchChannel_FreeBuffer,
1672     TMarshalDispatchChannel_GetDestCtx,
1673     TMarshalDispatchChannel_IsConnected
1674 };
1675
1676 static HRESULT TMarshalDispatchChannel_Create(
1677     IRpcChannelBuffer *pDelegateChannel, REFIID tmarshal_riid,
1678     IRpcChannelBuffer **ppChannel)
1679 {
1680     TMarshalDispatchChannel *This = HeapAlloc(GetProcessHeap(), 0, sizeof(*This));
1681     if (!This)
1682         return E_OUTOFMEMORY;
1683
1684     This->IRpcChannelBuffer_iface.lpVtbl = &TMarshalDispatchChannelVtbl;
1685     This->refs = 1;
1686     IRpcChannelBuffer_AddRef(pDelegateChannel);
1687     This->pDelegateChannel = pDelegateChannel;
1688     This->tmarshal_iid = *tmarshal_riid;
1689
1690     *ppChannel = &This->IRpcChannelBuffer_iface;
1691     return S_OK;
1692 }
1693
1694
1695 static inline HRESULT get_facbuf_for_iid(REFIID riid, IPSFactoryBuffer **facbuf)
1696 {
1697     HRESULT       hr;
1698     CLSID         clsid;
1699
1700     if ((hr = CoGetPSClsid(riid, &clsid)))
1701         return hr;
1702     return CoGetClassObject(&clsid, CLSCTX_INPROC_SERVER, NULL,
1703                              &IID_IPSFactoryBuffer, (LPVOID*)facbuf);
1704 }
1705
1706 static HRESULT init_proxy_entry_point(TMProxyImpl *proxy, unsigned int num)
1707 {
1708     int j;
1709     /* nrofargs including This */
1710     int nrofargs = 1;
1711     ITypeInfo *tinfo2;
1712     TMAsmProxy  *xasm = proxy->asmstubs + num;
1713     HRESULT hres;
1714     const FUNCDESC *fdesc;
1715
1716     hres = get_funcdesc(proxy->tinfo, num, &tinfo2, &fdesc, NULL, NULL, NULL);
1717     if (hres) {
1718         ERR("GetFuncDesc %x should not fail here.\n",hres);
1719         return hres;
1720     }
1721     ITypeInfo_Release(tinfo2);
1722     /* some args take more than 4 byte on the stack */
1723     for (j=0;j<fdesc->cParams;j++)
1724         nrofargs += _argsize(&fdesc->lprgelemdescParam[j].tdesc, proxy->tinfo);
1725
1726 #ifdef __i386__
1727     if (fdesc->callconv != CC_STDCALL) {
1728         ERR("calling convention is not stdcall????\n");
1729         return E_FAIL;
1730     }
1731 /* leal 4(%esp),%eax
1732  * pushl %eax
1733  * pushl <nr>
1734  * call xCall
1735  * lret <nr>
1736  */
1737     xasm->lealeax       = 0x0424448d;
1738     xasm->pushleax      = 0x50;
1739     xasm->pushlval      = 0x68;
1740     xasm->nr            = num;
1741     xasm->lcall         = 0xe8;
1742     xasm->xcall         = (char *)xCall - (char *)&xasm->lret;
1743     xasm->lret          = 0xc2;
1744     xasm->bytestopop    = nrofargs * 4;
1745     xasm->nop           = 0x9090;
1746     proxy->lpvtbl[fdesc->oVft / sizeof(void *)] = xasm;
1747 #else
1748     FIXME("not implemented on non i386\n");
1749     return E_FAIL;
1750 #endif
1751     return S_OK;
1752 }
1753
1754 static HRESULT WINAPI
1755 PSFacBuf_CreateProxy(
1756     LPPSFACTORYBUFFER iface, IUnknown* pUnkOuter, REFIID riid,
1757     IRpcProxyBuffer **ppProxy, LPVOID *ppv)
1758 {
1759     HRESULT     hres;
1760     ITypeInfo   *tinfo;
1761     unsigned int i, nroffuncs, vtbl_size;
1762     TMProxyImpl *proxy;
1763     TYPEATTR    *typeattr;
1764     BOOL        defer_to_dispatch = FALSE;
1765
1766     TRACE("(...%s...)\n",debugstr_guid(riid));
1767     hres = _get_typeinfo_for_iid(riid,&tinfo);
1768     if (hres) {
1769         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
1770         return hres;
1771     }
1772
1773     hres = num_of_funcs(tinfo, &nroffuncs, &vtbl_size);
1774     TRACE("Got %d funcs, vtbl size %d\n", nroffuncs, vtbl_size);
1775
1776     if (FAILED(hres)) {
1777         ERR("Cannot get number of functions for typeinfo %s\n",debugstr_guid(riid));
1778         ITypeInfo_Release(tinfo);
1779         return hres;
1780     }
1781
1782     proxy = CoTaskMemAlloc(sizeof(TMProxyImpl));
1783     if (!proxy) return E_OUTOFMEMORY;
1784
1785     proxy->dispatch = NULL;
1786     proxy->dispatch_proxy = NULL;
1787     proxy->outerunknown = pUnkOuter;
1788     proxy->asmstubs = VirtualAlloc(NULL, sizeof(TMAsmProxy) * nroffuncs, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
1789     if (!proxy->asmstubs) {
1790         ERR("Could not commit pages for proxy thunks\n");
1791         CoTaskMemFree(proxy);
1792         return E_OUTOFMEMORY;
1793     }
1794     proxy->IRpcProxyBuffer_iface.lpVtbl = &tmproxyvtable;
1795     /* one reference for the proxy */
1796     proxy->ref          = 1;
1797     proxy->tinfo        = tinfo;
1798     proxy->iid          = *riid;
1799     proxy->chanbuf      = 0;
1800
1801     InitializeCriticalSection(&proxy->crit);
1802     proxy->crit.DebugInfo->Spare[0] = (DWORD_PTR)(__FILE__ ": TMProxyImpl.crit");
1803
1804     proxy->lpvtbl = HeapAlloc(GetProcessHeap(), 0, vtbl_size);
1805
1806     /* if we derive from IDispatch then defer to its proxy for its methods */
1807     hres = ITypeInfo_GetTypeAttr(tinfo, &typeattr);
1808     if (hres == S_OK)
1809     {
1810         if (typeattr->wTypeFlags & TYPEFLAG_FDISPATCHABLE)
1811         {
1812             IPSFactoryBuffer *factory_buffer;
1813             hres = get_facbuf_for_iid(&IID_IDispatch, &factory_buffer);
1814             if (hres == S_OK)
1815             {
1816                 hres = IPSFactoryBuffer_CreateProxy(factory_buffer, NULL,
1817                     &IID_IDispatch, &proxy->dispatch_proxy,
1818                     (void **)&proxy->dispatch);
1819                 IPSFactoryBuffer_Release(factory_buffer);
1820             }
1821             if ((hres == S_OK) && (nroffuncs < 7))
1822             {
1823                 ERR("nroffuncs calculated incorrectly (%d)\n", nroffuncs);
1824                 hres = E_UNEXPECTED;
1825             }
1826             if (hres == S_OK)
1827             {
1828                 defer_to_dispatch = TRUE;
1829             }
1830         }
1831         ITypeInfo_ReleaseTypeAttr(tinfo, typeattr);
1832     }
1833
1834     for (i=0;i<nroffuncs;i++) {
1835         switch (i) {
1836         case 0:
1837                 proxy->lpvtbl[i] = ProxyIUnknown_QueryInterface;
1838                 break;
1839         case 1:
1840                 proxy->lpvtbl[i] = ProxyIUnknown_AddRef;
1841                 break;
1842         case 2:
1843                 proxy->lpvtbl[i] = ProxyIUnknown_Release;
1844                 break;
1845         case 3:
1846                 if(!defer_to_dispatch) hres = init_proxy_entry_point(proxy, i);
1847                 else proxy->lpvtbl[3] = ProxyIDispatch_GetTypeInfoCount;
1848                 break;
1849         case 4:
1850                 if(!defer_to_dispatch) hres = init_proxy_entry_point(proxy, i);
1851                 else proxy->lpvtbl[4] = ProxyIDispatch_GetTypeInfo;
1852                 break;
1853         case 5:
1854                 if(!defer_to_dispatch) hres = init_proxy_entry_point(proxy, i);
1855                 else proxy->lpvtbl[5] = ProxyIDispatch_GetIDsOfNames;
1856                 break;
1857         case 6:
1858                 if(!defer_to_dispatch) hres = init_proxy_entry_point(proxy, i);
1859                 else proxy->lpvtbl[6] = ProxyIDispatch_Invoke;
1860                 break;
1861         default:
1862                 hres = init_proxy_entry_point(proxy, i);
1863         }
1864     }
1865
1866     if (hres == S_OK)
1867     {
1868         *ppv = proxy;
1869         *ppProxy = &proxy->IRpcProxyBuffer_iface;
1870         IUnknown_AddRef((IUnknown *)*ppv);
1871         return S_OK;
1872     }
1873     else
1874         TMProxyImpl_Release(&proxy->IRpcProxyBuffer_iface);
1875     return hres;
1876 }
1877
1878 typedef struct _TMStubImpl {
1879     IRpcStubBuffer              IRpcStubBuffer_iface;
1880     LONG                        ref;
1881
1882     LPUNKNOWN                   pUnk;
1883     ITypeInfo                   *tinfo;
1884     IID                         iid;
1885     IRpcStubBuffer              *dispatch_stub;
1886     BOOL                        dispatch_derivative;
1887 } TMStubImpl;
1888
1889 static inline TMStubImpl *impl_from_IRpcStubBuffer(IRpcStubBuffer *iface)
1890 {
1891     return CONTAINING_RECORD(iface, TMStubImpl, IRpcStubBuffer_iface);
1892 }
1893
1894 static HRESULT WINAPI
1895 TMStubImpl_QueryInterface(LPRPCSTUBBUFFER iface, REFIID riid, LPVOID *ppv)
1896 {
1897     if (IsEqualIID(riid,&IID_IRpcStubBuffer)||IsEqualIID(riid,&IID_IUnknown)){
1898         *ppv = iface;
1899         IRpcStubBuffer_AddRef(iface);
1900         return S_OK;
1901     }
1902     FIXME("%s, not supported IID.\n",debugstr_guid(riid));
1903     return E_NOINTERFACE;
1904 }
1905
1906 static ULONG WINAPI
1907 TMStubImpl_AddRef(LPRPCSTUBBUFFER iface)
1908 {
1909     TMStubImpl *This = impl_from_IRpcStubBuffer(iface);
1910     ULONG refCount = InterlockedIncrement(&This->ref);
1911
1912     TRACE("(%p)->(ref before=%u)\n", This, refCount - 1);
1913
1914     return refCount;
1915 }
1916
1917 static ULONG WINAPI
1918 TMStubImpl_Release(LPRPCSTUBBUFFER iface)
1919 {
1920     TMStubImpl *This = impl_from_IRpcStubBuffer(iface);
1921     ULONG refCount = InterlockedDecrement(&This->ref);
1922
1923     TRACE("(%p)->(ref before=%u)\n", This, refCount + 1);
1924
1925     if (!refCount)
1926     {
1927         IRpcStubBuffer_Disconnect(iface);
1928         ITypeInfo_Release(This->tinfo);
1929         if (This->dispatch_stub)
1930             IRpcStubBuffer_Release(This->dispatch_stub);
1931         CoTaskMemFree(This);
1932     }
1933     return refCount;
1934 }
1935
1936 static HRESULT WINAPI
1937 TMStubImpl_Connect(LPRPCSTUBBUFFER iface, LPUNKNOWN pUnkServer)
1938 {
1939     TMStubImpl *This = impl_from_IRpcStubBuffer(iface);
1940
1941     TRACE("(%p)->(%p)\n", This, pUnkServer);
1942
1943     IUnknown_AddRef(pUnkServer);
1944     This->pUnk = pUnkServer;
1945
1946     if (This->dispatch_stub)
1947         IRpcStubBuffer_Connect(This->dispatch_stub, pUnkServer);
1948
1949     return S_OK;
1950 }
1951
1952 static void WINAPI
1953 TMStubImpl_Disconnect(LPRPCSTUBBUFFER iface)
1954 {
1955     TMStubImpl *This = impl_from_IRpcStubBuffer(iface);
1956
1957     TRACE("(%p)->()\n", This);
1958
1959     if (This->pUnk)
1960     {
1961         IUnknown_Release(This->pUnk);
1962         This->pUnk = NULL;
1963     }
1964
1965     if (This->dispatch_stub)
1966         IRpcStubBuffer_Disconnect(This->dispatch_stub);
1967 }
1968
1969 static HRESULT WINAPI
1970 TMStubImpl_Invoke(
1971     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf)
1972 {
1973 #ifdef __i386__
1974     int         i;
1975     const FUNCDESC *fdesc;
1976     TMStubImpl *This = impl_from_IRpcStubBuffer(iface);
1977     HRESULT     hres;
1978     DWORD       *args = NULL, res, *xargs, nrofargs;
1979     marshal_state       buf;
1980     UINT        nrofnames = 0;
1981     BSTR        names[10];
1982     BSTR        iname = NULL;
1983     ITypeInfo   *tinfo = NULL;
1984
1985     TRACE("...\n");
1986
1987     if (xmsg->iMethod < 3) {
1988         ERR("IUnknown methods cannot be marshaled by the typelib marshaler\n");
1989         return E_UNEXPECTED;
1990     }
1991
1992     if (This->dispatch_derivative && xmsg->iMethod < sizeof(IDispatchVtbl)/sizeof(void *))
1993     {
1994         if (!This->dispatch_stub)
1995         {
1996             IPSFactoryBuffer *factory_buffer;
1997             hres = get_facbuf_for_iid(&IID_IDispatch, &factory_buffer);
1998             if (hres == S_OK)
1999             {
2000                 hres = IPSFactoryBuffer_CreateStub(factory_buffer, &IID_IDispatch,
2001                     This->pUnk, &This->dispatch_stub);
2002                 IPSFactoryBuffer_Release(factory_buffer);
2003             }
2004             if (hres != S_OK)
2005                 return hres;
2006         }
2007         return IRpcStubBuffer_Invoke(This->dispatch_stub, xmsg, rpcchanbuf);
2008     }
2009
2010     memset(&buf,0,sizeof(buf));
2011     buf.size    = xmsg->cbBuffer;
2012     buf.base    = HeapAlloc(GetProcessHeap(), 0, xmsg->cbBuffer);
2013     memcpy(buf.base, xmsg->Buffer, xmsg->cbBuffer);
2014     buf.curoff  = 0;
2015
2016     hres = get_funcdesc(This->tinfo,xmsg->iMethod,&tinfo,&fdesc,&iname,NULL,NULL);
2017     if (hres) {
2018         ERR("GetFuncDesc on method %d failed with %x\n",xmsg->iMethod,hres);
2019         return hres;
2020     }
2021
2022     if (iname && !lstrcmpW(iname, IDispatchW))
2023     {
2024         ERR("IDispatch cannot be marshaled by the typelib marshaler\n");
2025         hres = E_UNEXPECTED;
2026         SysFreeString (iname);
2027         goto exit;
2028     }
2029
2030     SysFreeString (iname);
2031
2032     /* Need them for hack below */
2033     memset(names,0,sizeof(names));
2034     ITypeInfo_GetNames(tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
2035     if (nrofnames > sizeof(names)/sizeof(names[0])) {
2036         ERR("Need more names!\n");
2037     }
2038
2039     /*dump_FUNCDESC(fdesc);*/
2040     nrofargs = 0;
2041     for (i=0;i<fdesc->cParams;i++)
2042         nrofargs += _argsize(&fdesc->lprgelemdescParam[i].tdesc, tinfo);
2043     args = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,(nrofargs+1)*sizeof(DWORD));
2044     if (!args)
2045     {
2046         hres = E_OUTOFMEMORY;
2047         goto exit;
2048     }
2049
2050     /* Allocate all stuff used by call. */
2051     xargs = args+1;
2052     for (i=0;i<fdesc->cParams;i++) {
2053         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
2054
2055         hres = deserialize_param(
2056            tinfo,
2057            is_in_elem(elem),
2058            FALSE,
2059            TRUE,
2060            &(elem->tdesc),
2061            xargs,
2062            &buf
2063         );
2064         xargs += _argsize(&elem->tdesc, tinfo);
2065         if (hres) {
2066             ERR("Failed to deserialize param %s, hres %x\n",relaystr(names[i+1]),hres);
2067             break;
2068         }
2069     }
2070
2071     args[0] = (DWORD)This->pUnk;
2072
2073     __TRY
2074     {
2075         res = _invoke(
2076             (*((FARPROC**)args[0]))[fdesc->oVft/4],
2077             fdesc->callconv,
2078             (xargs-args),
2079             args
2080         );
2081     }
2082     __EXCEPT_ALL
2083     {
2084         DWORD dwExceptionCode = GetExceptionCode();
2085         ERR("invoke call failed with exception 0x%08x (%d)\n", dwExceptionCode, dwExceptionCode);
2086         if (FAILED(dwExceptionCode))
2087             hres = dwExceptionCode;
2088         else
2089             hres = HRESULT_FROM_WIN32(dwExceptionCode);
2090     }
2091     __ENDTRY
2092
2093     if (hres != S_OK)
2094         goto exit;
2095
2096     buf.curoff = 0;
2097
2098     xargs = args+1;
2099     for (i=0;i<fdesc->cParams;i++) {
2100         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
2101         hres = serialize_param(
2102            tinfo,
2103            is_out_elem(elem),
2104            FALSE,
2105            TRUE,
2106            &elem->tdesc,
2107            xargs,
2108            &buf
2109         );
2110         xargs += _argsize(&elem->tdesc, tinfo);
2111         if (hres) {
2112             ERR("Failed to stuballoc param, hres %x\n",hres);
2113             break;
2114         }
2115     }
2116
2117     hres = xbuf_add (&buf, (LPBYTE)&res, sizeof(DWORD));
2118
2119     if (hres != S_OK)
2120         goto exit;
2121
2122     xmsg->cbBuffer      = buf.curoff;
2123     hres = IRpcChannelBuffer_GetBuffer(rpcchanbuf, xmsg, &This->iid);
2124     if (hres != S_OK)
2125         ERR("IRpcChannelBuffer_GetBuffer failed with error 0x%08x\n", hres);
2126
2127     if (hres == S_OK)
2128         memcpy(xmsg->Buffer, buf.base, buf.curoff);
2129
2130 exit:
2131     for (i = 0; i < nrofnames; i++)
2132         SysFreeString(names[i]);
2133
2134     ITypeInfo_Release(tinfo);
2135     HeapFree(GetProcessHeap(), 0, args);
2136
2137     HeapFree(GetProcessHeap(), 0, buf.base);
2138
2139     TRACE("returning\n");
2140     return hres;
2141 #else
2142     FIXME( "not implemented on non-i386\n" );
2143     return E_FAIL;
2144 #endif
2145 }
2146
2147 static LPRPCSTUBBUFFER WINAPI
2148 TMStubImpl_IsIIDSupported(LPRPCSTUBBUFFER iface, REFIID riid) {
2149     FIXME("Huh (%s)?\n",debugstr_guid(riid));
2150     return NULL;
2151 }
2152
2153 static ULONG WINAPI
2154 TMStubImpl_CountRefs(LPRPCSTUBBUFFER iface) {
2155     TMStubImpl *This = impl_from_IRpcStubBuffer(iface);
2156
2157     FIXME("()\n");
2158     return This->ref; /*FIXME? */
2159 }
2160
2161 static HRESULT WINAPI
2162 TMStubImpl_DebugServerQueryInterface(LPRPCSTUBBUFFER iface, LPVOID *ppv) {
2163     return E_NOTIMPL;
2164 }
2165
2166 static void WINAPI
2167 TMStubImpl_DebugServerRelease(LPRPCSTUBBUFFER iface, LPVOID ppv) {
2168     return;
2169 }
2170
2171 static const IRpcStubBufferVtbl tmstubvtbl = {
2172     TMStubImpl_QueryInterface,
2173     TMStubImpl_AddRef,
2174     TMStubImpl_Release,
2175     TMStubImpl_Connect,
2176     TMStubImpl_Disconnect,
2177     TMStubImpl_Invoke,
2178     TMStubImpl_IsIIDSupported,
2179     TMStubImpl_CountRefs,
2180     TMStubImpl_DebugServerQueryInterface,
2181     TMStubImpl_DebugServerRelease
2182 };
2183
2184 static HRESULT WINAPI
2185 PSFacBuf_CreateStub(
2186     LPPSFACTORYBUFFER iface, REFIID riid,IUnknown *pUnkServer,
2187     IRpcStubBuffer** ppStub
2188 ) {
2189     HRESULT hres;
2190     ITypeInfo   *tinfo;
2191     TMStubImpl  *stub;
2192     TYPEATTR *typeattr;
2193
2194     TRACE("(%s,%p,%p)\n",debugstr_guid(riid),pUnkServer,ppStub);
2195
2196     hres = _get_typeinfo_for_iid(riid,&tinfo);
2197     if (hres) {
2198         ERR("No typeinfo for %s?\n",debugstr_guid(riid));
2199         return hres;
2200     }
2201
2202     stub = CoTaskMemAlloc(sizeof(TMStubImpl));
2203     if (!stub)
2204         return E_OUTOFMEMORY;
2205     stub->IRpcStubBuffer_iface.lpVtbl = &tmstubvtbl;
2206     stub->ref           = 1;
2207     stub->tinfo         = tinfo;
2208     stub->dispatch_stub = NULL;
2209     stub->dispatch_derivative = FALSE;
2210     stub->iid           = *riid;
2211     hres = IRpcStubBuffer_Connect(&stub->IRpcStubBuffer_iface,pUnkServer);
2212     *ppStub = &stub->IRpcStubBuffer_iface;
2213     TRACE("IRpcStubBuffer: %p\n", stub);
2214     if (hres)
2215         ERR("Connect to pUnkServer failed?\n");
2216
2217     /* if we derive from IDispatch then defer to its stub for some of its methods */
2218     hres = ITypeInfo_GetTypeAttr(tinfo, &typeattr);
2219     if (hres == S_OK)
2220     {
2221         if (typeattr->wTypeFlags & TYPEFLAG_FDISPATCHABLE)
2222             stub->dispatch_derivative = TRUE;
2223         ITypeInfo_ReleaseTypeAttr(tinfo, typeattr);
2224     }
2225
2226     return hres;
2227 }
2228
2229 static const IPSFactoryBufferVtbl psfacbufvtbl = {
2230     PSFacBuf_QueryInterface,
2231     PSFacBuf_AddRef,
2232     PSFacBuf_Release,
2233     PSFacBuf_CreateProxy,
2234     PSFacBuf_CreateStub
2235 };
2236
2237 /* This is the whole PSFactoryBuffer object, just the vtableptr */
2238 static const IPSFactoryBufferVtbl *lppsfac = &psfacbufvtbl;
2239
2240 /***********************************************************************
2241  *           TMARSHAL_DllGetClassObject
2242  */
2243 HRESULT TMARSHAL_DllGetClassObject(REFCLSID rclsid, REFIID iid,LPVOID *ppv)
2244 {
2245     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)) {
2246         *ppv = &lppsfac;
2247         return S_OK;
2248     }
2249     return E_NOINTERFACE;
2250 }