reactos/dll/win32/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include "precomp.h"
  23
  24 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  25
  26 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  27 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  28 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  29 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  30
  31 static void dump_user_flags(const ULONG *pFlags)
  32 {
  33     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  34         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  35     else
  36         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  37     switch (LOWORD(*pFlags))
  38     {
  39         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  40         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  41         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  42         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  43         default: TRACE("%d)", LOWORD(*pFlags));
  44     }
  45 }
  46
  47 /* CLEANLOCALSTORAGE */
  48
  49 #define CLS_FUNCDESC  'f'
  50 #define CLS_LIBATTR   'l'
  51 #define CLS_TYPEATTR  't'
  52 #define CLS_VARDESC   'v'
  53
  54 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  55 {
  56     ALIGN_LENGTH(Start, 3);
  57     return Start + sizeof(DWORD);
  58 }
  59
  60 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  61 {
  62     ALIGN_POINTER(Buffer, 3);
  63     *(DWORD*)Buffer = pstg->flags;
  64     switch(pstg->flags)
  65     {
  66     case CLS_LIBATTR:
  67         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
  68         break;
  69     case CLS_TYPEATTR:
  70         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
  71         break;
  72     case CLS_FUNCDESC:
  73         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
  74         break;
  75     case CLS_VARDESC:
  76         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
  77         break;
  78
  79     default:
  80         ERR("Unknown type %x\n", pstg->flags);
  81     }
  82
  83     *(VOID**)pstg->pStorage = NULL;
  84     IUnknown_Release(pstg->pInterface);
  85     pstg->pInterface = NULL;
  86
  87     return Buffer + sizeof(DWORD);
  88 }
  89
  90 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
  91 {
  92     ALIGN_POINTER(Buffer, 3);
  93     pstr->flags = *(DWORD*)Buffer;
  94     return Buffer + sizeof(DWORD);
  95 }
  96
  97 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
  98 {
  99     /* Nothing to do */
 100 }
 101
 102 /* BSTR */
 103
 104 typedef struct
 105 {
 106     DWORD len;          /* No. of chars not including trailing '\0' */
 107     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 108     DWORD len2;         /* == len */
 109 } bstr_wire_t;
 110
 111 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 112 {
 113     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 114     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 115     ALIGN_LENGTH(Start, 3);
 116     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 117     TRACE("returning %d\n", Start);
 118     return Start;
 119 }
 120
 121 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 122 {
 123     bstr_wire_t *header;
 124     DWORD len = SysStringByteLen(*pstr);
 125
 126     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 127     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 128
 129     ALIGN_POINTER(Buffer, 3);
 130     header = (bstr_wire_t*)Buffer;
 131     header->len = header->len2 = (len + 1) / 2;
 132     if (*pstr)
 133     {
 134         header->byte_len = len;
 135         memcpy(header + 1, *pstr, header->len * 2);
 136     }
 137     else
 138         header->byte_len = 0xffffffff; /* special case for a null bstr */
 139
 140     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 141 }
 142
 143 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 144 {
 145     bstr_wire_t *header;
 146     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 147
 148     ALIGN_POINTER(Buffer, 3);
 149     header = (bstr_wire_t*)Buffer;
 150     if(header->len != header->len2)
 151         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 152
 153     if (header->byte_len == 0xffffffff)
 154     {
 155         SysFreeString(*pstr);
 156         *pstr = NULL;
 157     }
 158     else SysReAllocStringLen( pstr, (OLECHAR *)(header + 1), header->len );
 159
 160     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 161     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 162 }
 163
 164 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 165 {
 166     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 167     SysFreeString(*pstr);
 168     *pstr = NULL;
 169 }
 170
 171 /* VARIANT */
 172
 173 typedef struct
 174 {
 175     DWORD clSize;
 176     DWORD rpcReserved;
 177     USHORT vt;
 178     USHORT wReserved1;
 179     USHORT wReserved2;
 180     USHORT wReserved3;
 181     DWORD switch_is;
 182 } variant_wire_t;
 183
 184 unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 185 {
 186     if (vt & VT_ARRAY) return 4;
 187
 188     switch (vt & ~VT_BYREF) {
 189     case VT_EMPTY:
 190     case VT_NULL:
 191         return 0;
 192     case VT_I1:
 193     case VT_UI1:
 194         return sizeof(CHAR);
 195     case VT_I2:
 196     case VT_UI2:
 197         return sizeof(SHORT);
 198     case VT_I4:
 199     case VT_UI4:
 200     case VT_HRESULT:
 201         return sizeof(LONG);
 202     case VT_INT:
 203     case VT_UINT:
 204         return sizeof(INT);
 205     case VT_R4:
 206         return sizeof(FLOAT);
 207     case VT_R8:
 208         return sizeof(DOUBLE);
 209     case VT_BOOL:
 210         return sizeof(VARIANT_BOOL);
 211     case VT_ERROR:
 212         return sizeof(SCODE);
 213     case VT_DATE:
 214         return sizeof(DATE);
 215     case VT_CY:
 216         return sizeof(CY);
 217     case VT_DECIMAL:
 218         return sizeof(DECIMAL);
 219     case VT_BSTR:
 220         return sizeof(ULONG);
 221     case VT_VARIANT:
 222         return sizeof(VARIANT);
 223     case VT_UNKNOWN:
 224     case VT_DISPATCH:
 225     case VT_RECORD:
 226         return 0;
 227     default:
 228         FIXME("unhandled VT %d\n", vt);
 229         return 0;
 230     }
 231 }
 232
 233 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 234 {
 235     unsigned int size = get_type_size(pFlags, vt);
 236     if(vt & VT_BYREF) return 3;
 237     if(size == 0) return 0;
 238     if(size <= 4) return size - 1;
 239     return 7;
 240 }
 241
 242 static unsigned interface_variant_size(const ULONG *pFlags, REFIID riid, IUnknown *punk)
 243 {
 244     ULONG size = 0;
 245     HRESULT hr;
 246
 247     if (punk)
 248     {
 249         hr = CoGetMarshalSizeMax(&size, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 250         if (FAILED(hr))
 251         {
 252             ERR("interface variant buffer size calculation failed, HRESULT=0x%x\n", hr);
 253             return 0;
 254         }
 255     }
 256     size += sizeof(ULONG); /* we have to store the buffersize in the stream */
 257     TRACE("wire-size extra of interface variant is %d\n", size);
 258     return size;
 259 }
 260
 261 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 262 {
 263   if (V_ISARRAY(pvar))
 264   {
 265     if (V_ISBYREF(pvar))
 266       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 267     else
 268       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 269   }
 270
 271   switch (V_VT(pvar)) {
 272   case VT_BSTR:
 273     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 274   case VT_BSTR | VT_BYREF:
 275     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 276   case VT_VARIANT | VT_BYREF:
 277     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 278   case VT_UNKNOWN:
 279     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 280   case VT_UNKNOWN | VT_BYREF:
 281     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 282   case VT_DISPATCH:
 283     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 284   case VT_DISPATCH | VT_BYREF:
 285     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 286   case VT_RECORD:
 287     FIXME("wire-size record\n");
 288     return Start;
 289   case VT_SAFEARRAY:
 290   case VT_SAFEARRAY | VT_BYREF:
 291     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 292     return Start;
 293   default:
 294     return Start;
 295   }
 296 }
 297
 298 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer. returns Buffer on failure, new position otherwise */
 299 static unsigned char* interface_variant_marshal(const ULONG *pFlags, unsigned char *Buffer,
 300                                                 REFIID riid, IUnknown *punk)
 301 {
 302   IStream *working;
 303   HGLOBAL working_mem;
 304   void *working_memlocked;
 305   unsigned char *oldpos;
 306   ULONG size;
 307   HRESULT hr;
 308
 309   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 310
 311   if(!punk)
 312   {
 313       memset(Buffer, 0, sizeof(ULONG));
 314       return Buffer + sizeof(ULONG);
 315   }
 316
 317   oldpos = Buffer;
 318
 319   /* CoMarshalInterface needs a stream, whereas at this level we are operating in terms of buffers.
 320    * We create a stream on an HGLOBAL, so we can simply do a memcpy to move it to the buffer.
 321    * in rpcrt4/ndr_ole.c, a simple IStream implementation is wrapped around the buffer object,
 322    * but that would be overkill here, hence this implementation. We save the size because the unmarshal
 323    * code has no way to know how long the marshalled buffer is. */
 324
 325   size = interface_variant_size(pFlags, riid, punk);
 326
 327   working_mem = GlobalAlloc(0, size);
 328   if (!working_mem) return oldpos;
 329
 330   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 331   if (hr != S_OK) {
 332     GlobalFree(working_mem);
 333     return oldpos;
 334   }
 335
 336   hr = CoMarshalInterface(working, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 337   if (hr != S_OK) {
 338     IStream_Release(working); /* this also releases the hglobal */
 339     return oldpos;
 340   }
 341
 342   working_memlocked = GlobalLock(working_mem);
 343   memcpy(Buffer, &size, sizeof(ULONG)); /* copy the buffersize */
 344   memcpy(Buffer + sizeof(ULONG), working_memlocked, size - sizeof(ULONG));
 345   GlobalUnlock(working_mem);
 346
 347   IStream_Release(working);
 348
 349   /* size includes the ULONG for the size written above */
 350   TRACE("done, size=%d\n", size);
 351   return Buffer + size;
 352 }
 353
 354 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer. returns Buffer on failure, new position otherwise */
 355 static unsigned char *interface_variant_unmarshal(const ULONG *pFlags, unsigned char *Buffer,
 356                                                   REFIID riid, IUnknown **ppunk)
 357 {
 358   IStream *working;
 359   HGLOBAL working_mem;
 360   void *working_memlocked;
 361   unsigned char *oldpos;
 362   ULONG size;
 363   HRESULT hr;
 364
 365   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 366
 367   oldpos = Buffer;
 368
 369   /* get the buffersize */
 370   memcpy(&size, Buffer, sizeof(ULONG));
 371   TRACE("buffersize=%d\n", size);
 372
 373   if(!size)
 374   {
 375       *ppunk = NULL;
 376       return Buffer + sizeof(ULONG);
 377   }
 378
 379   working_mem = GlobalAlloc(0, size);
 380   if (!working_mem) return oldpos;
 381
 382   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 383   if (hr != S_OK) {
 384     GlobalFree(working_mem);
 385     return oldpos;
 386   }
 387
 388   working_memlocked = GlobalLock(working_mem);
 389
 390   /* now we copy the contents of the marshalling buffer to working_memlocked, unlock it, and demarshal the stream */
 391   memcpy(working_memlocked, Buffer + sizeof(ULONG), size);
 392   GlobalUnlock(working_mem);
 393
 394   hr = CoUnmarshalInterface(working, riid, (void**)ppunk);
 395   if (hr != S_OK) {
 396     IStream_Release(working);
 397     return oldpos;
 398   }
 399
 400   IStream_Release(working); /* this also frees the underlying hglobal */
 401
 402   /* size includes the ULONG for the size written above */
 403   TRACE("done, processed=%d bytes\n", size);
 404   return Buffer + size;
 405 }
 406
 407
 408 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 409 {
 410     int align;
 411     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 412     TRACE("vt=%04x\n", V_VT(pvar));
 413
 414     ALIGN_LENGTH(Start, 7);
 415     Start += sizeof(variant_wire_t);
 416     if(V_VT(pvar) & VT_BYREF)
 417         Start += 4;
 418
 419     align = get_type_alignment(pFlags, V_VT(pvar));
 420     ALIGN_LENGTH(Start, align);
 421     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 422         Start += 4;
 423     else
 424         Start += get_type_size(pFlags, V_VT(pvar));
 425     Start = wire_extra_user_size(pFlags, Start, pvar);
 426
 427     TRACE("returning %d\n", Start);
 428     return Start;
 429 }
 430
 431 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 432 {
 433     variant_wire_t *header;
 434     ULONG type_size;
 435     int align;
 436     unsigned char *Pos;
 437
 438     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 439     TRACE("vt=%04x\n", V_VT(pvar));
 440
 441     ALIGN_POINTER(Buffer, 7);
 442
 443     header = (variant_wire_t *)Buffer;
 444
 445     header->clSize = 0; /* fixed up at the end */
 446     header->rpcReserved = 0;
 447     header->vt = pvar->n1.n2.vt;
 448     header->wReserved1 = pvar->n1.n2.wReserved1;
 449     header->wReserved2 = pvar->n1.n2.wReserved2;
 450     header->wReserved3 = pvar->n1.n2.wReserved3;
 451     header->switch_is = pvar->n1.n2.vt;
 452     if(header->switch_is & VT_ARRAY)
 453         header->switch_is &= ~VT_TYPEMASK;
 454
 455     Pos = (unsigned char*)(header + 1);
 456     type_size = get_type_size(pFlags, V_VT(pvar));
 457     align = get_type_alignment(pFlags, V_VT(pvar));
 458     ALIGN_POINTER(Pos, align);
 459
 460     if(header->vt & VT_BYREF)
 461     {
 462         *(DWORD *)Pos = max(type_size, 4);
 463         Pos += 4;
 464         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 465         {
 466             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 467             Pos += type_size;
 468         }
 469         else
 470         {
 471             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 472             Pos += 4;
 473         }
 474     }
 475     else
 476     {
 477         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 478             memcpy(Pos, pvar, type_size);
 479         else
 480             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 481         Pos += type_size;
 482     }
 483
 484     if(header->vt & VT_ARRAY)
 485     {
 486         if(header->vt & VT_BYREF)
 487             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 488         else
 489             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 490     }
 491     else
 492     {
 493         switch (header->vt)
 494         {
 495         case VT_BSTR:
 496             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 497             break;
 498         case VT_BSTR | VT_BYREF:
 499             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 500             break;
 501         case VT_VARIANT | VT_BYREF:
 502             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 503             break;
 504         case VT_UNKNOWN:
 505             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 506             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 507             break;
 508         case VT_UNKNOWN | VT_BYREF:
 509             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 510             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 511             break;
 512         case VT_DISPATCH:
 513             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 514             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 515             break;
 516         case VT_DISPATCH | VT_BYREF:
 517             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 518             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 519             break;
 520         case VT_RECORD:
 521             FIXME("handle BRECORD by val\n");
 522             break;
 523         case VT_RECORD | VT_BYREF:
 524             FIXME("handle BRECORD by ref\n");
 525             break;
 526         }
 527     }
 528     header->clSize = ((Pos - Buffer) + 7) >> 3;
 529     TRACE("marshalled size=%d\n", header->clSize);
 530     return Pos;
 531 }
 532
 533 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 534 {
 535     variant_wire_t *header;
 536     ULONG type_size;
 537     int align;
 538     unsigned char *Pos;
 539
 540     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 541
 542     ALIGN_POINTER(Buffer, 7);
 543
 544     header = (variant_wire_t *)Buffer;
 545
 546     Pos = (unsigned char*)(header + 1);
 547     type_size = get_type_size(pFlags, header->vt);
 548     align = get_type_alignment(pFlags, header->vt);
 549     ALIGN_POINTER(Pos, align);
 550
 551     if(header->vt & VT_BYREF)
 552     {
 553         ULONG mem_size;
 554         Pos += 4;
 555
 556         switch (header->vt & ~VT_BYREF)
 557         {
 558         /* these types have a different memory size compared to wire size */
 559         case VT_UNKNOWN:
 560         case VT_DISPATCH:
 561         case VT_BSTR:
 562             mem_size = sizeof(void *);
 563             break;
 564         default:
 565             mem_size = type_size;
 566             break;
 567         }
 568
 569         if (V_VT(pvar) != header->vt)
 570         {
 571             VariantClear(pvar);
 572             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 573         }
 574         else if (!V_BYREF(pvar))
 575             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 576         memcpy(V_BYREF(pvar), Pos, type_size);
 577         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 578             Pos += type_size;
 579         else
 580             Pos += 4;
 581     }
 582     else
 583     {
 584         VariantClear(pvar);
 585         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 586             memcpy(pvar, Pos, type_size);
 587         else
 588             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 589         Pos += type_size;
 590     }
 591
 592     pvar->n1.n2.vt = header->vt;
 593     pvar->n1.n2.wReserved1 = header->wReserved1;
 594     pvar->n1.n2.wReserved2 = header->wReserved2;
 595     pvar->n1.n2.wReserved3 = header->wReserved3;
 596
 597     if(header->vt & VT_ARRAY)
 598     {
 599         if(header->vt & VT_BYREF)
 600             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 601         else
 602             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 603     }
 604     else
 605     {
 606         switch (header->vt)
 607         {
 608         case VT_BSTR:
 609             V_BSTR(pvar) = NULL;
 610             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 611             break;
 612         case VT_BSTR | VT_BYREF:
 613             *V_BSTRREF(pvar) = NULL;
 614             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 615             break;
 616         case VT_VARIANT | VT_BYREF:
 617             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 618             break;
 619         case VT_UNKNOWN:
 620             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 621             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 622             break;
 623         case VT_UNKNOWN | VT_BYREF:
 624             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 625             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 626             break;
 627         case VT_DISPATCH:
 628             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 629             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 630             break;
 631         case VT_DISPATCH | VT_BYREF:
 632             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 633             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 634             break;
 635         case VT_RECORD:
 636             FIXME("handle BRECORD by val\n");
 637             break;
 638         case VT_RECORD | VT_BYREF:
 639             FIXME("handle BRECORD by ref\n");
 640             break;
 641         }
 642     }
 643     return Pos;
 644 }
 645
 646 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 647 {
 648   VARTYPE vt = V_VT(pvar);
 649   PVOID ref = NULL;
 650
 651   TRACE("(%x,%p)\n", *pFlags, pvar);
 652   TRACE("vt=%04x\n", V_VT(pvar));
 653
 654   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 655
 656   VariantClear(pvar);
 657   if (!ref) return;
 658
 659   if(vt & VT_ARRAY)
 660   {
 661     if (vt & VT_BYREF)
 662       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 663     else
 664       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 665   }
 666   else
 667   {
 668     switch (vt)
 669     {
 670     case VT_BSTR | VT_BYREF:
 671       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 672       break;
 673     case VT_VARIANT | VT_BYREF:
 674       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 675       break;
 676     case VT_RECORD | VT_BYREF:
 677       FIXME("handle BRECORD by ref\n");
 678       break;
 679     case VT_UNKNOWN | VT_BYREF:
 680     case VT_DISPATCH | VT_BYREF:
 681       IUnknown_Release(*V_UNKNOWNREF(pvar));
 682       break;
 683     }
 684   }
 685
 686   CoTaskMemFree(ref);
 687 }
 688
 689 /* LPSAFEARRAY */
 690
 691 /* Get the number of cells in a SafeArray */
 692 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 693 {
 694     const SAFEARRAYBOUND* psab = psa->rgsabound;
 695     USHORT cCount = psa->cDims;
 696     ULONG ulNumCells = 1;
 697
 698     while (cCount--)
 699     {
 700         /* This is a valid bordercase. See testcases. -Marcus */
 701         if (!psab->cElements)
 702             return 0;
 703         ulNumCells *= psab->cElements;
 704         psab++;
 705     }
 706     return ulNumCells;
 707 }
 708
 709 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 710 {
 711     VARTYPE vt;
 712     HRESULT hr;
 713
 714     hr = SafeArrayGetVartype(psa, &vt);
 715     if (FAILED(hr))
 716     {
 717         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 718
 719         switch(psa->cbElements)
 720         {
 721         case 1: vt = VT_I1; break;
 722         case 2: vt = VT_I2; break;
 723         case 4: vt = VT_I4; break;
 724         case 8: vt = VT_I8; break;
 725         default:
 726             RpcRaiseException(hr);
 727         }
 728     }
 729
 730     if (psa->fFeatures & FADF_HAVEIID)
 731         return SF_HAVEIID;
 732
 733     switch (vt)
 734     {
 735     case VT_I1:
 736     case VT_UI1:      return SF_I1;
 737     case VT_BOOL:
 738     case VT_I2:
 739     case VT_UI2:      return SF_I2;
 740     case VT_INT:
 741     case VT_UINT:
 742     case VT_I4:
 743     case VT_UI4:
 744     case VT_R4:       return SF_I4;
 745     case VT_DATE:
 746     case VT_CY:
 747     case VT_R8:
 748     case VT_I8:
 749     case VT_UI8:      return SF_I8;
 750     case VT_INT_PTR:
 751     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 752     case VT_BSTR:     return SF_BSTR;
 753     case VT_DISPATCH: return SF_DISPATCH;
 754     case VT_VARIANT:  return SF_VARIANT;
 755     case VT_UNKNOWN:  return SF_UNKNOWN;
 756     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 757      * of a UDT is taken from the result of IRecordInfo_GetSize().
 758      */
 759     case VT_RECORD:   return SF_RECORD;
 760     default:          return SF_ERROR;
 761     }
 762 }
 763
 764 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 765 {
 766     if (sftype == SF_BSTR)
 767         return sizeof(DWORD);
 768     else if (sftype == SF_VARIANT)
 769         return sizeof(variant_wire_t) - sizeof(DWORD);
 770     else
 771         return lpsa->cbElements;
 772 }
 773
 774 static DWORD elem_mem_size(wireSAFEARRAY wiresa, SF_TYPE sftype)
 775 {
 776     if (sftype == SF_BSTR)
 777         return sizeof(BSTR);
 778     else if (sftype == SF_VARIANT)
 779         return sizeof(VARIANT);
 780     else
 781         return wiresa->cbElements;
 782 }
 783
 784 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 785 {
 786     ULONG size = StartingSize;
 787
 788     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 789
 790     ALIGN_LENGTH(size, 3);
 791     size += sizeof(ULONG);
 792     if (*ppsa)
 793     {
 794         SAFEARRAY *psa = *ppsa;
 795         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 796         SF_TYPE sftype;
 797         HRESULT hr;
 798
 799         size += sizeof(ULONG);
 800         size += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 801
 802         sftype = SAFEARRAY_GetUnionType(psa);
 803         size += sizeof(ULONG);
 804
 805         size += sizeof(ULONG);
 806         size += sizeof(ULONG);
 807         if (sftype == SF_HAVEIID)
 808             size += sizeof(IID);
 809
 810         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 811
 812         size += sizeof(ULONG);
 813
 814         switch (sftype)
 815         {
 816             case SF_BSTR:
 817             {
 818                 BSTR* lpBstr;
 819
 820                 for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 821                     size = BSTR_UserSize(pFlags, size, lpBstr);
 822
 823                 break;
 824             }
 825             case SF_DISPATCH:
 826             case SF_UNKNOWN:
 827             case SF_HAVEIID:
 828                 FIXME("size interfaces\n");
 829                 break;
 830             case SF_VARIANT:
 831             {
 832                 VARIANT* lpVariant;
 833
 834                 for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 835                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 836
 837                 break;
 838             }
 839             case SF_RECORD:
 840             {
 841                 IRecordInfo* pRecInfo = NULL;
 842
 843                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 844                 if (FAILED(hr))
 845                     RpcRaiseException(hr);
 846
 847                 if (pRecInfo)
 848                 {
 849                     FIXME("size record info %p\n", pRecInfo);
 850
 851                     IRecordInfo_Release(pRecInfo);
 852                 }
 853                 break;
 854             }
 855             case SF_I8:
 856                 ALIGN_LENGTH(size, 7);
 857                 /* fallthrough */
 858             case SF_I1:
 859             case SF_I2:
 860             case SF_I4:
 861                 size += ulCellCount * psa->cbElements;
 862                 break;
 863             default:
 864                 break;
 865         }
 866
 867     }
 868
 869     return size;
 870 }
 871
 872 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 873 {
 874     HRESULT hr;
 875
 876     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 877
 878     ALIGN_POINTER(Buffer, 3);
 879     *(ULONG *)Buffer = *ppsa ? 0x1 : 0x0;
 880     Buffer += sizeof(ULONG);
 881     if (*ppsa)
 882     {
 883         VARTYPE vt;
 884         SAFEARRAY *psa = *ppsa;
 885         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 886         SAFEARRAYBOUND *bound;
 887         SF_TYPE sftype;
 888         GUID guid;
 889         INT i;
 890
 891         sftype = SAFEARRAY_GetUnionType(psa);
 892
 893         *(ULONG *)Buffer = psa->cDims;
 894         Buffer += sizeof(ULONG);
 895         *(USHORT *)Buffer = psa->cDims;
 896         Buffer += sizeof(USHORT);
 897         *(USHORT *)Buffer = psa->fFeatures;
 898         Buffer += sizeof(USHORT);
 899         *(ULONG *)Buffer = elem_wire_size(psa, sftype);
 900         Buffer += sizeof(ULONG);
 901
 902         hr = SafeArrayGetVartype(psa, &vt);
 903         if (FAILED(hr)) vt = 0;
 904
 905         *(ULONG *)Buffer = (USHORT)psa->cLocks | (vt << 16);
 906         Buffer += sizeof(ULONG);
 907
 908         *(ULONG *)Buffer = sftype;
 909         Buffer += sizeof(ULONG);
 910
 911         *(ULONG *)Buffer = ulCellCount;
 912         Buffer += sizeof(ULONG);
 913         *(ULONG *)Buffer = psa->pvData ? 0x2 : 0x0;
 914         Buffer += sizeof(ULONG);
 915         if (sftype == SF_HAVEIID)
 916         {
 917             SafeArrayGetIID(psa, &guid);
 918             memcpy(Buffer, &guid, sizeof(guid));
 919             Buffer += sizeof(guid);
 920         }
 921
 922         /* bounds are marshaled in opposite order comparing to storage layout */
 923         bound = (SAFEARRAYBOUND*)Buffer;
 924         for (i = 0; i < psa->cDims; i++)
 925         {
 926             memcpy(bound++, &psa->rgsabound[psa->cDims-i-1], sizeof(psa->rgsabound[0]));
 927         }
 928         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 929
 930         *(ULONG *)Buffer = ulCellCount;
 931         Buffer += sizeof(ULONG);
 932
 933         if (psa->pvData)
 934         {
 935             switch (sftype)
 936             {
 937                 case SF_BSTR:
 938                 {
 939                     BSTR* lpBstr;
 940
 941                     for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 942                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 943
 944                     break;
 945                 }
 946                 case SF_DISPATCH:
 947                 case SF_UNKNOWN:
 948                 case SF_HAVEIID:
 949                     FIXME("marshal interfaces\n");
 950                     break;
 951                 case SF_VARIANT:
 952                 {
 953                     VARIANT* lpVariant;
 954
 955                     for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 956                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 957
 958                     break;
 959                 }
 960                 case SF_RECORD:
 961                 {
 962                     IRecordInfo* pRecInfo = NULL;
 963
 964                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 965                     if (FAILED(hr))
 966                         RpcRaiseException(hr);
 967
 968                     if (pRecInfo)
 969                     {
 970                         FIXME("write record info %p\n", pRecInfo);
 971
 972                         IRecordInfo_Release(pRecInfo);
 973                     }
 974                     break;
 975                 }
 976
 977                 case SF_I8:
 978                     ALIGN_POINTER(Buffer, 7);
 979                     /* fallthrough */
 980                 case SF_I1:
 981                 case SF_I2:
 982                 case SF_I4:
 983                     /* Just copy the data over */
 984                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
 985                     Buffer += ulCellCount * psa->cbElements;
 986                     break;
 987                 default:
 988                     break;
 989             }
 990         }
 991
 992     }
 993     return Buffer;
 994 }
 995
 996 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
 997                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
 998                            FADF_VARIANT | FADF_CREATEVECTOR)
 999
1000 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
1001 {
1002     ULONG ptr;
1003     wireSAFEARRAY wiresa;
1004     ULONG cDims;
1005     HRESULT hr;
1006     SF_TYPE sftype;
1007     ULONG cell_count;
1008     GUID guid;
1009     VARTYPE vt;
1010     SAFEARRAYBOUND *wiresab;
1011
1012     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
1013
1014     ALIGN_POINTER(Buffer, 3);
1015     ptr = *(ULONG *)Buffer;
1016     Buffer += sizeof(ULONG);
1017
1018     if (!ptr)
1019     {
1020         *ppsa = NULL;
1021
1022         TRACE("NULL safe array unmarshaled\n");
1023
1024         return Buffer;
1025     }
1026
1027     cDims = *(ULONG *)Buffer;
1028     Buffer += sizeof(ULONG);
1029
1030     wiresa = (wireSAFEARRAY)Buffer;
1031     Buffer += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
1032
1033     if (cDims != wiresa->cDims)
1034         RpcRaiseException(RPC_S_INVALID_BOUND);
1035
1036     /* FIXME: there should be a limit on how large cDims can be */
1037
1038     vt = HIWORD(wiresa->cLocks);
1039
1040     sftype = *(ULONG *)Buffer;
1041     Buffer += sizeof(ULONG);
1042
1043     cell_count = *(ULONG *)Buffer;
1044     Buffer += sizeof(ULONG);
1045     ptr = *(ULONG *)Buffer;
1046     Buffer += sizeof(ULONG);
1047     if (sftype == SF_HAVEIID)
1048     {
1049         memcpy(&guid, Buffer, sizeof(guid));
1050         Buffer += sizeof(guid);
1051     }
1052
1053     wiresab = (SAFEARRAYBOUND *)Buffer;
1054     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1055
1056     if(vt)
1057     {
1058         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1059         if (!*ppsa) RpcRaiseException(E_OUTOFMEMORY);
1060     }
1061     else
1062     {
1063         if (FAILED(SafeArrayAllocDescriptor(wiresa->cDims, ppsa)))
1064             RpcRaiseException(E_OUTOFMEMORY);
1065         memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1066     }
1067
1068     /* be careful about which flags we set since they could be a security
1069      * risk */
1070     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1071     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1072     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1073     (*ppsa)->cbElements = elem_mem_size(wiresa, sftype);
1074     (*ppsa)->cLocks = 0;
1075
1076     /* SafeArrayCreateEx allocates the data for us, but
1077      * SafeArrayAllocDescriptor doesn't */
1078     if(!vt)
1079     {
1080         hr = SafeArrayAllocData(*ppsa);
1081         if (FAILED(hr))
1082             RpcRaiseException(hr);
1083     }
1084
1085     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1086         RpcRaiseException(RPC_S_INVALID_BOUND);
1087     Buffer += sizeof(ULONG);
1088
1089     if (ptr)
1090     {
1091         switch (sftype)
1092         {
1093             case SF_BSTR:
1094             {
1095                 BSTR* lpBstr;
1096
1097                 for (lpBstr = (*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1098                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1099
1100                 break;
1101             }
1102             case SF_DISPATCH:
1103             case SF_UNKNOWN:
1104             case SF_HAVEIID:
1105                 FIXME("marshal interfaces\n");
1106                 break;
1107             case SF_VARIANT:
1108             {
1109                 VARIANT* lpVariant;
1110
1111                 for (lpVariant = (*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1112                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1113
1114                 break;
1115             }
1116             case SF_RECORD:
1117             {
1118                 FIXME("set record info\n");
1119
1120                 break;
1121             }
1122
1123             case SF_I8:
1124                 ALIGN_POINTER(Buffer, 7);
1125                 /* fallthrough */
1126             case SF_I1:
1127             case SF_I2:
1128             case SF_I4:
1129                 /* Just copy the data over */
1130                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1131                 Buffer += cell_count * (*ppsa)->cbElements;
1132                 break;
1133             default:
1134                 break;
1135         }
1136     }
1137
1138     TRACE("safe array unmarshaled: %p\n", *ppsa);
1139
1140     return Buffer;
1141 }
1142
1143 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1144 {
1145     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1146
1147     SafeArrayDestroy(*ppsa);
1148 }
1149
1150
1151 ULONG WINAPI HFONT_UserSize(ULONG *pFlags, ULONG Start, HFONT *phfont)
1152 {
1153     FIXME(":stub\n");
1154     return 0;
1155 }
1156
1157 unsigned char * WINAPI HFONT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1158 {
1159     FIXME(":stub\n");
1160     return NULL;
1161 }
1162
1163 unsigned char * WINAPI HFONT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1164 {
1165     FIXME(":stub\n");
1166     return NULL;
1167 }
1168
1169 void WINAPI HFONT_UserFree(ULONG *pFlags, HFONT *phfont)
1170 {
1171     FIXME(":stub\n");
1172     return;
1173 }
1174
1175
1176 /* IDispatch */
1177 /* exactly how Invoke is marshalled is not very clear to me yet,
1178  * but the way I've done it seems to work for me */
1179
1180 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1181     IDispatch* This,
1182     DISPID dispIdMember,
1183     REFIID riid,
1184     LCID lcid,
1185     WORD wFlags,
1186     DISPPARAMS* pDispParams,
1187     VARIANT* pVarResult,
1188     EXCEPINFO* pExcepInfo,
1189     UINT* puArgErr)
1190 {
1191   HRESULT hr;
1192   VARIANT VarResult;
1193   UINT* rgVarRefIdx = NULL;
1194   VARIANTARG* rgVarRef = NULL;
1195   UINT u, cVarRef;
1196   UINT uArgErr;
1197   EXCEPINFO ExcepInfo;
1198
1199   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1200         dispIdMember, debugstr_guid(riid),
1201         lcid, wFlags, pDispParams, pVarResult,
1202         pExcepInfo, puArgErr);
1203
1204   /* [out] args can't be null, use dummy vars if needed */
1205   if (!pVarResult) pVarResult = &VarResult;
1206   if (!puArgErr) puArgErr = &uArgErr;
1207   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1208
1209   /* count by-ref args */
1210   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1211     VARIANTARG* arg = &pDispParams->rgvarg[u];
1212     if (V_ISBYREF(arg)) {
1213       cVarRef++;
1214     }
1215   }
1216   if (cVarRef) {
1217     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1218     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1219     /* make list of by-ref args */
1220     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1221       VARIANTARG* arg = &pDispParams->rgvarg[u];
1222       if (V_ISBYREF(arg)) {
1223         rgVarRefIdx[cVarRef] = u;
1224         VariantInit(&rgVarRef[cVarRef]);
1225         VariantCopy(&rgVarRef[cVarRef], arg);
1226         VariantClear(arg);
1227         cVarRef++;
1228       }
1229     }
1230   } else {
1231     /* [out] args still can't be null,
1232      * but we can point these anywhere in this case,
1233      * since they won't be written to when cVarRef is 0 */
1234     rgVarRefIdx = puArgErr;
1235     rgVarRef = pVarResult;
1236   }
1237   TRACE("passed by ref: %d args\n", cVarRef);
1238   hr = IDispatch_RemoteInvoke_Proxy(This,
1239                                     dispIdMember,
1240                                     riid,
1241                                     lcid,
1242                                     wFlags,
1243                                     pDispParams,
1244                                     pVarResult,
1245                                     pExcepInfo,
1246                                     puArgErr,
1247                                     cVarRef,
1248                                     rgVarRefIdx,
1249                                     rgVarRef);
1250   if (cVarRef) {
1251     for (u=0; u<cVarRef; u++) {
1252       unsigned i = rgVarRefIdx[u];
1253       VariantCopy(&pDispParams->rgvarg[i],
1254                   &rgVarRef[u]);
1255       VariantClear(&rgVarRef[u]);
1256     }
1257     CoTaskMemFree(rgVarRef);
1258     CoTaskMemFree(rgVarRefIdx);
1259   }
1260
1261   if(pExcepInfo == &ExcepInfo)
1262   {
1263     SysFreeString(pExcepInfo->bstrSource);
1264     SysFreeString(pExcepInfo->bstrDescription);
1265     SysFreeString(pExcepInfo->bstrHelpFile);
1266   }
1267   return hr;
1268 }
1269
1270 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1271     IDispatch* This,
1272     DISPID dispIdMember,
1273     REFIID riid,
1274     LCID lcid,
1275     DWORD dwFlags,
1276     DISPPARAMS* pDispParams,
1277     VARIANT* pVarResult,
1278     EXCEPINFO* pExcepInfo,
1279     UINT* pArgErr,
1280     UINT cVarRef,
1281     UINT* rgVarRefIdx,
1282     VARIANTARG* rgVarRef)
1283 {
1284   HRESULT hr = S_OK;
1285   VARIANTARG *rgvarg, *arg;
1286   UINT u;
1287
1288   /* initialize out parameters, so that they can be marshalled
1289    * in case the real Invoke doesn't initialize them */
1290   VariantInit(pVarResult);
1291   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1292   *pArgErr = 0;
1293
1294   /* let the real Invoke operate on a copy of the in parameters,
1295    * so we don't risk losing pointers to allocated memory */
1296   rgvarg = pDispParams->rgvarg;
1297   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1298   if (!arg) return E_OUTOFMEMORY;
1299
1300   /* init all args so we can call VariantClear on all the args if the copy
1301    * below fails */
1302   for (u = 0; u < pDispParams->cArgs; u++)
1303     VariantInit(&arg[u]);
1304
1305   for (u = 0; u < pDispParams->cArgs; u++) {
1306     hr = VariantCopy(&arg[u], &rgvarg[u]);
1307     if (FAILED(hr))
1308         break;
1309   }
1310
1311   if (SUCCEEDED(hr)) {
1312     /* copy ref args to arg array */
1313     for (u=0; u<cVarRef; u++) {
1314       unsigned i = rgVarRefIdx[u];
1315       VariantCopy(&arg[i], &rgVarRef[u]);
1316     }
1317
1318     pDispParams->rgvarg = arg;
1319
1320     hr = IDispatch_Invoke(This,
1321                           dispIdMember,
1322                           riid,
1323                           lcid,
1324                           dwFlags,
1325                           pDispParams,
1326                           pVarResult,
1327                           pExcepInfo,
1328                           pArgErr);
1329
1330     /* copy ref args from arg array */
1331     for (u=0; u<cVarRef; u++) {
1332       unsigned i = rgVarRefIdx[u];
1333       VariantCopy(&rgVarRef[u], &arg[i]);
1334     }
1335   }
1336
1337   /* clear the duplicate argument list */
1338   for (u=0; u<pDispParams->cArgs; u++)
1339     VariantClear(&arg[u]);
1340
1341   pDispParams->rgvarg = rgvarg;
1342   CoTaskMemFree(arg);
1343
1344   return hr;
1345 }
1346
1347 /* IEnumVARIANT */
1348
1349 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1350     IEnumVARIANT* This,
1351     ULONG celt,
1352     VARIANT* rgVar,
1353     ULONG* pCeltFetched)
1354 {
1355   ULONG fetched;
1356   if (!pCeltFetched)
1357     pCeltFetched = &fetched;
1358   return IEnumVARIANT_RemoteNext_Proxy(This,
1359                                        celt,
1360                                        rgVar,
1361                                        pCeltFetched);
1362 }
1363
1364 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1365     IEnumVARIANT* This,
1366     ULONG celt,
1367     VARIANT* rgVar,
1368     ULONG* pCeltFetched)
1369 {
1370   HRESULT hr;
1371   *pCeltFetched = 0;
1372   hr = IEnumVARIANT_Next(This,
1373                          celt,
1374                          rgVar,
1375                          pCeltFetched);
1376   if (hr == S_OK) *pCeltFetched = celt;
1377   return hr;
1378 }
1379
1380 /* TypeInfo related freers */
1381
1382 static void free_embedded_typedesc(TYPEDESC *tdesc);
1383 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1384 {
1385     switch(adesc->tdescElem.vt)
1386     {
1387     case VT_PTR:
1388     case VT_SAFEARRAY:
1389         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1390         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1391         break;
1392     case VT_CARRAY:
1393         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1394         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1395         break;
1396     }
1397 }
1398
1399 static void free_embedded_typedesc(TYPEDESC *tdesc)
1400 {
1401     switch(tdesc->vt)
1402     {
1403     case VT_PTR:
1404     case VT_SAFEARRAY:
1405         free_embedded_typedesc(tdesc->u.lptdesc);
1406         CoTaskMemFree(tdesc->u.lptdesc);
1407         break;
1408     case VT_CARRAY:
1409         free_embedded_arraydesc(tdesc->u.lpadesc);
1410         CoTaskMemFree(tdesc->u.lpadesc);
1411         break;
1412     }
1413 }
1414
1415 static void free_embedded_elemdesc(ELEMDESC *edesc)
1416 {
1417     free_embedded_typedesc(&edesc->tdesc);
1418     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1419         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1420 }
1421
1422 /* ITypeComp */
1423
1424 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1425     ITypeComp* This,
1426     LPOLESTR szName,
1427     ULONG lHashVal,
1428     WORD wFlags,
1429     ITypeInfo** ppTInfo,
1430     DESCKIND* pDescKind,
1431     BINDPTR* pBindPtr)
1432 {
1433   FIXME("not implemented\n");
1434   return E_FAIL;
1435 }
1436
1437 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1438     ITypeComp* This,
1439     LPOLESTR szName,
1440     ULONG lHashVal,
1441     WORD wFlags,
1442     ITypeInfo** ppTInfo,
1443     DESCKIND* pDescKind,
1444     LPFUNCDESC* ppFuncDesc,
1445     LPVARDESC* ppVarDesc,
1446     ITypeComp** ppTypeComp,
1447     CLEANLOCALSTORAGE* pDummy)
1448 {
1449   FIXME("not implemented\n");
1450   return E_FAIL;
1451 }
1452
1453 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1454     ITypeComp* This,
1455     LPOLESTR szName,
1456     ULONG lHashVal,
1457     ITypeInfo** ppTInfo,
1458     ITypeComp** ppTComp)
1459 {
1460   FIXME("not implemented\n");
1461   return E_FAIL;
1462 }
1463
1464 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1465     ITypeComp* This,
1466     LPOLESTR szName,
1467     ULONG lHashVal,
1468     ITypeInfo** ppTInfo)
1469 {
1470   FIXME("not implemented\n");
1471   return E_FAIL;
1472 }
1473
1474 /* ITypeInfo */
1475
1476 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1477     ITypeInfo* This,
1478     TYPEATTR** ppTypeAttr)
1479
1480 {
1481     CLEANLOCALSTORAGE stg;
1482     TRACE("(%p, %p)\n", This, ppTypeAttr);
1483
1484     stg.flags = 0;
1485     stg.pStorage = NULL;
1486     stg.pInterface = NULL;
1487
1488     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1489 }
1490
1491 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1492     ITypeInfo* This,
1493     LPTYPEATTR* ppTypeAttr,
1494     CLEANLOCALSTORAGE* pDummy)
1495 {
1496     HRESULT hr;
1497     TRACE("(%p, %p)\n", This, ppTypeAttr);
1498
1499     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1500     if(hr != S_OK)
1501         return hr;
1502
1503     pDummy->flags = CLS_TYPEATTR;
1504     ITypeInfo_AddRef(This);
1505     pDummy->pInterface = (IUnknown*)This;
1506     pDummy->pStorage = ppTypeAttr;
1507     return hr;
1508 }
1509
1510 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1511     ITypeInfo* This,
1512     UINT index,
1513     FUNCDESC** ppFuncDesc)
1514 {
1515     CLEANLOCALSTORAGE stg;
1516     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1517
1518     stg.flags = 0;
1519     stg.pStorage = NULL;
1520     stg.pInterface = NULL;
1521
1522     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1523 }
1524
1525 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1526     ITypeInfo* This,
1527     UINT index,
1528     LPFUNCDESC* ppFuncDesc,
1529     CLEANLOCALSTORAGE* pDummy)
1530 {
1531     HRESULT hr;
1532     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1533
1534     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1535     if(hr != S_OK)
1536         return hr;
1537
1538     pDummy->flags = CLS_FUNCDESC;
1539     ITypeInfo_AddRef(This);
1540     pDummy->pInterface = (IUnknown*)This;
1541     pDummy->pStorage = ppFuncDesc;
1542     return hr;
1543 }
1544
1545 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1546     ITypeInfo* This,
1547     UINT index,
1548     VARDESC** ppVarDesc)
1549 {
1550     CLEANLOCALSTORAGE stg;
1551     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1552
1553     stg.flags = 0;
1554     stg.pStorage = NULL;
1555     stg.pInterface = NULL;
1556
1557     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1558 }
1559
1560 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1561     ITypeInfo* This,
1562     UINT index,
1563     LPVARDESC* ppVarDesc,
1564     CLEANLOCALSTORAGE* pDummy)
1565 {
1566     HRESULT hr;
1567     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1568
1569     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1570     if(hr != S_OK)
1571         return hr;
1572
1573     pDummy->flags = CLS_VARDESC;
1574     ITypeInfo_AddRef(This);
1575     pDummy->pInterface = (IUnknown*)This;
1576     pDummy->pStorage = ppVarDesc;
1577     return hr;
1578 }
1579
1580 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1581     ITypeInfo* This,
1582     MEMBERID memid,
1583     BSTR* rgBstrNames,
1584     UINT cMaxNames,
1585     UINT* pcNames)
1586 {
1587     TRACE("(%p, %08x, %p, %d, %p)\n", This, memid, rgBstrNames, cMaxNames, pcNames);
1588
1589     return ITypeInfo_RemoteGetNames_Proxy(This, memid, rgBstrNames, cMaxNames, pcNames);
1590 }
1591
1592 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1593     ITypeInfo* This,
1594     MEMBERID memid,
1595     BSTR* rgBstrNames,
1596     UINT cMaxNames,
1597     UINT* pcNames)
1598 {
1599     TRACE("(%p, %08x, %p, %d, %p)\n", This, memid, rgBstrNames, cMaxNames, pcNames);
1600
1601     return ITypeInfo_GetNames(This, memid, rgBstrNames, cMaxNames, pcNames);
1602 }
1603
1604 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1605     ITypeInfo* This,
1606     LPOLESTR* rgszNames,
1607     UINT cNames,
1608     MEMBERID* pMemId)
1609 {
1610   FIXME("not implemented\n");
1611   return E_FAIL;
1612 }
1613
1614 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1615     ITypeInfo* This)
1616 {
1617   FIXME("not implemented\n");
1618   return E_FAIL;
1619 }
1620
1621 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1622     ITypeInfo* This,
1623     PVOID pvInstance,
1624     MEMBERID memid,
1625     WORD wFlags,
1626     DISPPARAMS* pDispParams,
1627     VARIANT* pVarResult,
1628     EXCEPINFO* pExcepInfo,
1629     UINT* puArgErr)
1630 {
1631   FIXME("not implemented\n");
1632   return E_FAIL;
1633 }
1634
1635 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1636     ITypeInfo* This)
1637 {
1638   FIXME("not implemented\n");
1639   return E_FAIL;
1640 }
1641
1642 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(ITypeInfo *This, MEMBERID memid,
1643                                                   BSTR *name, BSTR *doc_string,
1644                                                   DWORD *help_context, BSTR *help_file)
1645 {
1646     DWORD dummy_help_context, flags = 0;
1647     BSTR dummy_name, dummy_doc_string, dummy_help_file;
1648     HRESULT hr;
1649     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, name, doc_string, help_context, help_file);
1650
1651     if(!name) name = &dummy_name;
1652     else flags = 1;
1653
1654     if(!doc_string) doc_string = &dummy_doc_string;
1655     else flags |= 2;
1656
1657     if(!help_context) help_context = &dummy_help_context;
1658     else flags |= 4;
1659
1660     if(!help_file) help_file = &dummy_help_file;
1661     else flags |= 8;
1662
1663     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, flags, name, doc_string, help_context, help_file);
1664
1665     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1666
1667     return hr;
1668 }
1669
1670 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(ITypeInfo *This, MEMBERID memid,
1671                                                    DWORD flags, BSTR *name, BSTR *doc_string,
1672                                                    DWORD *help_context, BSTR *help_file)
1673 {
1674     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, flags, name, doc_string, help_context, help_file);
1675
1676     *name = *doc_string = *help_file = NULL;
1677     *help_context = 0;
1678
1679     if(!(flags & 1)) name = NULL;
1680     if(!(flags & 2)) doc_string = NULL;
1681     if(!(flags & 4)) help_context = NULL;
1682     if(!(flags & 8)) help_file = NULL;
1683
1684     return ITypeInfo_GetDocumentation(This, memid, name, doc_string, help_context, help_file);
1685 }
1686
1687 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(ITypeInfo *This, MEMBERID memid,
1688                                              INVOKEKIND invkind, BSTR *dll_name,
1689                                              BSTR* name, WORD *ordinal)
1690 {
1691     DWORD flags = 0;
1692     BSTR dummy_dll_name, dummy_name;
1693     WORD dummy_ordinal;
1694     HRESULT hr;
1695     TRACE("(%p, %08x, %x, %p, %p, %p)\n", This, memid, invkind, dll_name, name, ordinal);
1696
1697     if(!dll_name) dll_name = &dummy_dll_name;
1698     else flags = 1;
1699
1700     if(!name) name = &dummy_name;
1701     else flags |= 2;
1702
1703     if(!ordinal) ordinal = &dummy_ordinal;
1704     else flags |= 4;
1705
1706     hr = ITypeInfo_RemoteGetDllEntry_Proxy(This, memid, invkind, flags, dll_name, name, ordinal);
1707
1708     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1709
1710     return hr;
1711 }
1712
1713 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(ITypeInfo *This, MEMBERID memid,
1714                                               INVOKEKIND invkind, DWORD flags,
1715                                               BSTR *dll_name, BSTR *name,
1716                                               WORD *ordinal)
1717 {
1718     TRACE("(%p, %08x, %x, %p, %p, %p)\n", This, memid, invkind, dll_name, name, ordinal);
1719
1720     *dll_name = *name = NULL;
1721     *ordinal = 0;
1722
1723     if(!(flags & 1)) dll_name = NULL;
1724     if(!(flags & 2)) name = NULL;
1725     if(!(flags & 4)) ordinal = NULL;
1726
1727     return ITypeInfo_GetDllEntry(This, memid, invkind, dll_name, name, ordinal);
1728 }
1729
1730 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1731     ITypeInfo* This,
1732     MEMBERID memid,
1733     INVOKEKIND invKind,
1734     PVOID* ppv)
1735 {
1736   FIXME("not implemented\n");
1737   return E_FAIL;
1738 }
1739
1740 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1741     ITypeInfo* This)
1742 {
1743   FIXME("not implemented\n");
1744   return E_FAIL;
1745 }
1746
1747 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1748     ITypeInfo* This,
1749     IUnknown* pUnkOuter,
1750     REFIID riid,
1751     PVOID* ppvObj)
1752 {
1753   FIXME("not implemented\n");
1754   return E_FAIL;
1755 }
1756
1757 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1758     ITypeInfo* This,
1759     REFIID riid,
1760     IUnknown** ppvObj)
1761 {
1762   FIXME("not implemented\n");
1763   return E_FAIL;
1764 }
1765
1766 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1767     ITypeInfo* This,
1768     ITypeLib** ppTLib,
1769     UINT* pIndex)
1770 {
1771     ITypeLib *pTL;
1772     UINT index;
1773     HRESULT hr;
1774
1775     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1776
1777     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1778     if(SUCCEEDED(hr))
1779     {
1780         if(pIndex)
1781             *pIndex = index;
1782
1783         if(ppTLib)
1784             *ppTLib = pTL;
1785         else
1786             ITypeLib_Release(pTL);
1787     }
1788     return hr;
1789 }
1790
1791 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1792     ITypeInfo* This,
1793     ITypeLib** ppTLib,
1794     UINT* pIndex)
1795 {
1796     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1797     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1798 }
1799
1800 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1801     ITypeInfo* This,
1802     TYPEATTR* pTypeAttr)
1803 {
1804     TRACE("(%p, %p)\n", This, pTypeAttr);
1805     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1806     CoTaskMemFree(pTypeAttr);
1807 }
1808
1809 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1810     ITypeInfo* This)
1811 {
1812     TRACE("nothing to do\n");
1813     return S_OK;
1814 }
1815
1816 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1817     ITypeInfo* This,
1818     FUNCDESC* pFuncDesc)
1819 {
1820     SHORT param;
1821     TRACE("(%p, %p)\n", This, pFuncDesc);
1822
1823     for(param = 0; param < pFuncDesc->cParams; param++)
1824         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1825     if(param)
1826         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1827
1828     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1829
1830     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1831         CoTaskMemFree(pFuncDesc->lprgscode);
1832
1833     CoTaskMemFree(pFuncDesc);
1834 }
1835
1836 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1837     ITypeInfo* This)
1838 {
1839     TRACE("nothing to do\n");
1840     return S_OK;
1841 }
1842
1843 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1844     ITypeInfo* This,
1845     VARDESC* pVarDesc)
1846 {
1847     TRACE("(%p, %p)\n", This, pVarDesc);
1848
1849     CoTaskMemFree(pVarDesc->lpstrSchema);
1850
1851     if(pVarDesc->varkind == VAR_CONST)
1852         CoTaskMemFree(pVarDesc->u.lpvarValue);
1853
1854     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1855     CoTaskMemFree(pVarDesc);
1856 }
1857
1858 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1859     ITypeInfo* This)
1860 {
1861     TRACE("nothing to do\n");
1862     return S_OK;
1863 }
1864
1865
1866 /* ITypeInfo2 */
1867
1868 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(ITypeInfo2 *This, MEMBERID memid,
1869                                                     LCID lcid, BSTR *help_string,
1870                                                     DWORD *help_context, BSTR *help_dll)
1871 {
1872     DWORD dummy_help_context, flags = 0;
1873     BSTR dummy_help_string, dummy_help_dll;
1874     HRESULT hr;
1875     TRACE("(%p, %08x, %08x, %p, %p, %p)\n", This, memid, lcid, help_string, help_context, help_dll);
1876
1877     if(!help_string) help_string = &dummy_help_string;
1878     else flags = 1;
1879
1880     if(!help_context) help_context = &dummy_help_context;
1881     else flags |= 2;
1882
1883     if(!help_dll) help_dll = &dummy_help_dll;
1884     else flags |= 4;
1885
1886     hr = ITypeInfo2_RemoteGetDocumentation2_Proxy(This, memid, lcid, flags, help_string, help_context, help_dll);
1887
1888     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1889
1890     return hr;
1891 }
1892
1893 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(ITypeInfo2 *This, MEMBERID memid,
1894                                                      LCID lcid, DWORD flags,
1895                                                      BSTR *help_string, DWORD *help_context,
1896                                                      BSTR *help_dll)
1897 {
1898     TRACE("(%p, %08x, %08x, %08x, %p, %p, %p)\n", This, memid, lcid, flags, help_string, help_context, help_dll);
1899
1900     *help_string = *help_dll = NULL;
1901     *help_context = 0;
1902
1903     if(!(flags & 1)) help_string = NULL;
1904     if(!(flags & 2)) help_context = NULL;
1905     if(!(flags & 4)) help_dll = NULL;
1906
1907     return ITypeInfo2_GetDocumentation2(This, memid, lcid, help_string, help_context, help_dll);
1908 }
1909
1910 /* ITypeLib */
1911
1912 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1913     ITypeLib* This)
1914 {
1915     UINT count = 0;
1916     TRACE("(%p)\n", This);
1917
1918     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1919
1920     return count;
1921 }
1922
1923 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1924     ITypeLib* This,
1925     UINT* pcTInfo)
1926 {
1927     TRACE("(%p, %p)\n", This, pcTInfo);
1928     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1929     return S_OK;
1930 }
1931
1932 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1933     ITypeLib* This,
1934     TLIBATTR** ppTLibAttr)
1935 {
1936     CLEANLOCALSTORAGE stg;
1937     TRACE("(%p, %p)\n", This, ppTLibAttr);
1938
1939     stg.flags = 0;
1940     stg.pStorage = NULL;
1941     stg.pInterface = NULL;
1942
1943     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1944 }
1945
1946 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1947     ITypeLib* This,
1948     LPTLIBATTR* ppTLibAttr,
1949     CLEANLOCALSTORAGE* pDummy)
1950 {
1951     HRESULT hr;
1952     TRACE("(%p, %p)\n", This, ppTLibAttr);
1953
1954     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1955     if(hr != S_OK)
1956         return hr;
1957
1958     pDummy->flags = CLS_LIBATTR;
1959     ITypeLib_AddRef(This);
1960     pDummy->pInterface = (IUnknown*)This;
1961     pDummy->pStorage = ppTLibAttr;
1962     return hr;
1963 }
1964
1965 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(ITypeLib *This, INT index, BSTR *name,
1966                                                  BSTR *doc_string, DWORD *help_context,
1967                                                  BSTR *help_file)
1968 {
1969     DWORD dummy_help_context, flags = 0;
1970     BSTR dummy_name, dummy_doc_string, dummy_help_file;
1971     HRESULT hr;
1972     TRACE("(%p, %d, %p, %p, %p, %p)\n", This, index, name, doc_string, help_context, help_file);
1973
1974     if(!name) name = &dummy_name;
1975     else flags = 1;
1976
1977     if(!doc_string) doc_string = &dummy_doc_string;
1978     else flags |= 2;
1979
1980     if(!help_context) help_context = &dummy_help_context;
1981     else flags |= 4;
1982
1983     if(!help_file) help_file = &dummy_help_file;
1984     else flags |= 8;
1985
1986     hr = ITypeLib_RemoteGetDocumentation_Proxy(This, index, flags, name, doc_string, help_context, help_file);
1987
1988     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
1989
1990     return hr;
1991 }
1992
1993 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(ITypeLib *This, INT index, DWORD flags,
1994                                                   BSTR *name, BSTR *doc_string,
1995                                                   DWORD *help_context, BSTR *help_file)
1996 {
1997     TRACE("(%p, %d, %08x, %p, %p, %p, %p)\n", This, index, flags, name, doc_string, help_context, help_file);
1998
1999     *name = *doc_string = *help_file = NULL;
2000     *help_context = 0;
2001
2002     if(!(flags & 1)) name = NULL;
2003     if(!(flags & 2)) doc_string = NULL;
2004     if(!(flags & 4)) help_context = NULL;
2005     if(!(flags & 8)) help_file = NULL;
2006
2007     return ITypeLib_GetDocumentation(This, index, name, doc_string, help_context, help_file);
2008 }
2009
2010 HRESULT CALLBACK ITypeLib_IsName_Proxy(
2011     ITypeLib* This,
2012     LPOLESTR szNameBuf,
2013     ULONG lHashVal,
2014     BOOL* pfName)
2015 {
2016   FIXME("not implemented\n");
2017   return E_FAIL;
2018 }
2019
2020 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
2021     ITypeLib* This,
2022     LPOLESTR szNameBuf,
2023     ULONG lHashVal,
2024     BOOL* pfName,
2025     BSTR* pBstrLibName)
2026 {
2027   FIXME("not implemented\n");
2028   return E_FAIL;
2029 }
2030
2031 HRESULT CALLBACK ITypeLib_FindName_Proxy(
2032     ITypeLib* This,
2033     LPOLESTR szNameBuf,
2034     ULONG lHashVal,
2035     ITypeInfo** ppTInfo,
2036     MEMBERID* rgMemId,
2037     USHORT* pcFound)
2038 {
2039   FIXME("not implemented\n");
2040   return E_FAIL;
2041 }
2042
2043 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
2044     ITypeLib* This,
2045     LPOLESTR szNameBuf,
2046     ULONG lHashVal,
2047     ITypeInfo** ppTInfo,
2048     MEMBERID* rgMemId,
2049     USHORT* pcFound,
2050     BSTR* pBstrLibName)
2051 {
2052   FIXME("not implemented\n");
2053   return E_FAIL;
2054 }
2055
2056 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
2057     ITypeLib* This,
2058     TLIBATTR* pTLibAttr)
2059 {
2060     TRACE("(%p, %p)\n", This, pTLibAttr);
2061     CoTaskMemFree(pTLibAttr);
2062 }
2063
2064 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
2065     ITypeLib* This)
2066 {
2067     TRACE("nothing to do\n");
2068     return S_OK;
2069 }
2070
2071
2072 /* ITypeLib2 */
2073
2074 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
2075     ITypeLib2* This,
2076     ULONG* pcUniqueNames,
2077     ULONG* pcchUniqueNames)
2078 {
2079   FIXME("not implemented\n");
2080   return E_FAIL;
2081 }
2082
2083 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
2084     ITypeLib2* This,
2085     ULONG* pcUniqueNames,
2086     ULONG* pcchUniqueNames)
2087 {
2088   FIXME("not implemented\n");
2089   return E_FAIL;
2090 }
2091
2092 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(ITypeLib2 *This, INT index,
2093                                                    LCID lcid, BSTR *help_string,
2094                                                    DWORD *help_context, BSTR *help_dll)
2095 {
2096     DWORD dummy_help_context, flags = 0;
2097     BSTR dummy_help_string, dummy_help_dll;
2098     HRESULT hr;
2099     TRACE("(%p, %d, %08x, %p, %p, %p)\n", This, index, lcid, help_string, help_context, help_dll);
2100
2101     if(!help_string) help_string = &dummy_help_string;
2102     else flags = 1;
2103
2104     if(!help_context) help_context = &dummy_help_context;
2105     else flags |= 2;
2106
2107     if(!help_dll) help_dll = &dummy_help_dll;
2108     else flags |= 4;
2109
2110     hr = ITypeLib2_RemoteGetDocumentation2_Proxy(This, index, lcid, flags, help_string, help_context, help_dll);
2111
2112     /* We don't need to free the dummy BSTRs since the stub ensures that these will be NULLs. */
2113
2114     return hr;
2115 }
2116
2117 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(ITypeLib2 *This, INT index, LCID lcid,
2118                                                     DWORD flags, BSTR *help_string,
2119                                                     DWORD *help_context, BSTR *help_dll)
2120 {
2121     TRACE("(%p, %d, %08x, %08x, %p, %p, %p)\n", This, index, lcid, flags, help_string, help_context, help_dll);
2122
2123     *help_string = *help_dll = NULL;
2124     *help_context = 0;
2125
2126     if(!(flags & 1)) help_string = NULL;
2127     if(!(flags & 2)) help_context = NULL;
2128     if(!(flags & 4)) help_dll = NULL;
2129
2130     return ITypeLib2_GetDocumentation2(This, index, lcid, help_string, help_context, help_dll);
2131 }
2132
2133 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2134     IPropertyBag* This,
2135     LPCOLESTR pszPropName,
2136     VARIANT *pVar,
2137     IErrorLog *pErrorLog)
2138 {
2139   IUnknown *pUnk = NULL;
2140   TRACE("(%p, %s, %p, %p)\n", This, debugstr_w(pszPropName), pVar, pErrorLog);
2141
2142   if(!pVar)
2143     return E_POINTER;
2144
2145   if(V_VT(pVar) & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2146   {
2147     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2148     return E_NOTIMPL;
2149   }
2150
2151   switch(V_VT(pVar))
2152   {
2153     case VT_DISPATCH:
2154       pUnk = (IUnknown*)V_DISPATCH(pVar);
2155       break;
2156     case VT_UNKNOWN:
2157       pUnk = V_UNKNOWN(pVar);
2158       break;
2159     case VT_SAFEARRAY:
2160       FIXME("Safearray support not yet implemented.\n");
2161       return E_NOTIMPL;
2162     default:
2163       FIXME("Unknown V_VT %d - support not yet implemented.\n", V_VT(pVar));
2164       return E_NOTIMPL;
2165   }
2166
2167   return IPropertyBag_RemoteRead_Proxy(This, pszPropName, pVar, pErrorLog,
2168                                        V_VT(pVar), pUnk);
2169 }
2170
2171 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2172     IPropertyBag* This,
2173     LPCOLESTR pszPropName,
2174     VARIANT *pVar,
2175     IErrorLog *pErrorLog,
2176     DWORD varType,
2177     IUnknown *pUnkObj)
2178 {
2179   static const WCHAR emptyWstr[] = {0};
2180   IDispatch *disp;
2181   HRESULT hr;
2182   TRACE("(%p, %s, %p, %p, %x, %p)\n", This, debugstr_w(pszPropName), pVar,
2183                                      pErrorLog, varType, pUnkObj);
2184
2185   if(varType & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2186   {
2187     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2188     return E_NOTIMPL;
2189   }
2190
2191   V_VT(pVar) = varType;
2192   switch(varType)
2193   {
2194     case VT_DISPATCH:
2195       hr = IUnknown_QueryInterface(pUnkObj, &IID_IDispatch, (LPVOID*)&disp);
2196       if(FAILED(hr))
2197         return hr;
2198       IUnknown_Release(pUnkObj);
2199       V_DISPATCH(pVar) = disp;
2200       break;
2201     case VT_UNKNOWN:
2202       V_UNKNOWN(pVar) = pUnkObj;
2203       break;
2204     case VT_BSTR:
2205       V_BSTR(pVar) = SysAllocString(emptyWstr);
2206       break;
2207     case VT_SAFEARRAY:
2208       FIXME("Safearray support not yet implemented.\n");
2209       return E_NOTIMPL;
2210     default:
2211       break;
2212   }
2213   hr = IPropertyBag_Read(This, pszPropName, pVar, pErrorLog);
2214   if(FAILED(hr))
2215     VariantClear(pVar);
2216
2217   return hr;
2218 }
2219
2220 /* call_as/local stubs for ocidl.idl */
2221
2222 HRESULT CALLBACK IClassFactory2_CreateInstanceLic_Proxy(
2223     IClassFactory2* This,
2224     IUnknown *pUnkOuter,
2225     IUnknown *pUnkReserved,
2226     REFIID riid,
2227     BSTR bstrKey,
2228     PVOID *ppvObj)
2229 {
2230     TRACE("(%p, %s, %p)\n", pUnkOuter, debugstr_guid(riid), ppvObj);
2231
2232     *ppvObj = NULL;
2233
2234     if (pUnkOuter)
2235     {
2236         ERR("aggregation is not allowed on remote objects\n");
2237         return CLASS_E_NOAGGREGATION;
2238     }
2239
2240     return IClassFactory2_RemoteCreateInstanceLic_Proxy(This, riid, bstrKey, (IUnknown**)ppvObj);
2241 }
2242
2243 HRESULT __RPC_STUB IClassFactory2_CreateInstanceLic_Stub(
2244     IClassFactory2* This,
2245     REFIID riid,
2246     BSTR bstrKey,
2247     IUnknown **ppvObj)
2248 {
2249     TRACE("(%s, %p)\n", debugstr_guid(riid), ppvObj);
2250     return IClassFactory2_CreateInstanceLic(This, NULL, NULL, riid, bstrKey, (void**)ppvObj);
2251 }
2252
2253 HRESULT CALLBACK IEnumConnections_Next_Proxy(
2254     IEnumConnections* This,
2255     ULONG cConnections,
2256     LPCONNECTDATA rgcd,
2257     ULONG *pcFetched)
2258 {
2259     FIXME("not implemented\n");
2260     return E_NOTIMPL;
2261 }
2262
2263 HRESULT __RPC_STUB IEnumConnections_Next_Stub(
2264     IEnumConnections* This,
2265     ULONG cConnections,
2266     LPCONNECTDATA rgcd,
2267     ULONG *pcFetched)
2268 {
2269     FIXME("not implemented\n");
2270     return E_NOTIMPL;
2271 }
2272
2273 HRESULT CALLBACK IEnumConnectionPoints_Next_Proxy(
2274     IEnumConnectionPoints* This,
2275     ULONG cConnections,
2276     LPCONNECTIONPOINT *ppCP,
2277     ULONG *pcFetched)
2278 {
2279     FIXME("not implemented\n");
2280     return E_NOTIMPL;
2281 }
2282
2283 HRESULT __RPC_STUB IEnumConnectionPoints_Next_Stub(
2284     IEnumConnectionPoints* This,
2285     ULONG cConnections,
2286     LPCONNECTIONPOINT *ppCP,
2287     ULONG *pcFetched)
2288 {
2289     FIXME("not implemented\n");
2290     return E_NOTIMPL;
2291 }
2292
2293 HRESULT CALLBACK IPersistMemory_Load_Proxy(
2294     IPersistMemory* This,
2295     LPVOID pMem,
2296     ULONG cbSize)
2297 {
2298     FIXME("not implemented\n");
2299     return E_NOTIMPL;
2300 }
2301
2302 HRESULT __RPC_STUB IPersistMemory_Load_Stub(
2303     IPersistMemory* This,
2304     BYTE *pMem,
2305     ULONG cbSize)
2306 {
2307     FIXME("not implemented\n");
2308     return E_NOTIMPL;
2309 }
2310
2311 HRESULT CALLBACK IPersistMemory_Save_Proxy(
2312     IPersistMemory* This,
2313     LPVOID pMem,
2314     BOOL fClearDirty,
2315     ULONG cbSize)
2316 {
2317     FIXME("not implemented\n");
2318     return E_NOTIMPL;
2319 }
2320
2321 HRESULT __RPC_STUB IPersistMemory_Save_Stub(
2322     IPersistMemory* This,
2323     BYTE *pMem,
2324     BOOL fClearDirty,
2325     ULONG cbSize)
2326 {
2327     FIXME("not implemented\n");
2328     return E_NOTIMPL;
2329 }
2330
2331 void CALLBACK IAdviseSinkEx_OnViewStatusChange_Proxy(
2332     IAdviseSinkEx* This,
2333     DWORD dwViewStatus)
2334 {
2335     FIXME("not implemented\n");
2336 }
2337
2338 HRESULT __RPC_STUB IAdviseSinkEx_OnViewStatusChange_Stub(
2339     IAdviseSinkEx* This,
2340     DWORD dwViewStatus)
2341 {
2342     FIXME("not implemented\n");
2343     return E_NOTIMPL;
2344 }
2345
2346 HRESULT CALLBACK IEnumOleUndoUnits_Next_Proxy(
2347     IEnumOleUndoUnits* This,
2348     ULONG cElt,
2349     IOleUndoUnit **rgElt,
2350     ULONG *pcEltFetched)
2351 {
2352     FIXME("not implemented\n");
2353     return E_NOTIMPL;
2354 }
2355
2356 HRESULT __RPC_STUB IEnumOleUndoUnits_Next_Stub(
2357     IEnumOleUndoUnits* This,
2358     ULONG cElt,
2359     IOleUndoUnit **rgElt,
2360     ULONG *pcEltFetched)
2361 {
2362     FIXME("not implemented\n");
2363     return E_NOTIMPL;
2364 }
2365
2366 HRESULT CALLBACK IQuickActivate_QuickActivate_Proxy(
2367     IQuickActivate* This,
2368     QACONTAINER *pQaContainer,
2369     QACONTROL *pQaControl)
2370 {
2371     FIXME("not implemented\n");
2372     return E_NOTIMPL;
2373 }
2374
2375 HRESULT __RPC_STUB IQuickActivate_QuickActivate_Stub(
2376     IQuickActivate* This,
2377     QACONTAINER *pQaContainer,
2378     QACONTROL *pQaControl)
2379 {
2380     FIXME("not implemented\n");
2381     return E_NOTIMPL;
2382 }