dlls/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #define COBJMACROS
  26 #define NONAMELESSUNION
  27 #define NONAMELESSSTRUCT
  28
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "wingdi.h"
  32 #include "winuser.h"
  33 #include "winerror.h"
  34
  35 #include "ole2.h"
  36 #include "oleauto.h"
  37 #include "typelib.h"
  38 #include "ocidl.h"
  39 #include "wine/debug.h"
  40
  41 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  42
  43 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  44 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  45 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  46 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  47
  48 static void dump_user_flags(const ULONG *pFlags)
  49 {
  50     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  51         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  52     else
  53         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  54     switch (LOWORD(*pFlags))
  55     {
  56         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  57         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  58         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  59         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  60         default: TRACE("%d)", LOWORD(*pFlags));
  61     }
  62 }
  63
  64 /* CLEANLOCALSTORAGE */
  65
  66 #define CLS_FUNCDESC  'f'
  67 #define CLS_LIBATTR   'l'
  68 #define CLS_TYPEATTR  't'
  69 #define CLS_VARDESC   'v'
  70
  71 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  72 {
  73     ALIGN_LENGTH(Start, 3);
  74     return Start + sizeof(DWORD);
  75 }
  76
  77 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  78 {
  79     ALIGN_POINTER(Buffer, 3);
  80     *(DWORD*)Buffer = pstg->flags;
  81     switch(pstg->flags)
  82     {
  83     case CLS_LIBATTR:
  84         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
  85         break;
  86     case CLS_TYPEATTR:
  87         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
  88         break;
  89     case CLS_FUNCDESC:
  90         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
  91         break;
  92     case CLS_VARDESC:
  93         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
  94         break;
  95
  96     default:
  97         ERR("Unknown type %x\n", pstg->flags);
  98     }
  99
 100     *(VOID**)pstg->pStorage = NULL;
 101     IUnknown_Release(pstg->pInterface);
 102     pstg->pInterface = NULL;
 103
 104     return Buffer + sizeof(DWORD);
 105 }
 106
 107 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
 108 {
 109     ALIGN_POINTER(Buffer, 3);
 110     pstr->flags = *(DWORD*)Buffer;
 111     return Buffer + sizeof(DWORD);
 112 }
 113
 114 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
 115 {
 116     /* Nothing to do */
 117 }
 118
 119 /* BSTR */
 120
 121 typedef struct
 122 {
 123     DWORD len;          /* No. of chars not including trailing '\0' */
 124     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 125     DWORD len2;         /* == len */
 126 } bstr_wire_t;
 127
 128 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 129 {
 130     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 131     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 132     ALIGN_LENGTH(Start, 3);
 133     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 134     TRACE("returning %d\n", Start);
 135     return Start;
 136 }
 137
 138 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 139 {
 140     bstr_wire_t *header;
 141     DWORD len = SysStringByteLen(*pstr);
 142
 143     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 144     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 145
 146     ALIGN_POINTER(Buffer, 3);
 147     header = (bstr_wire_t*)Buffer;
 148     header->len = header->len2 = (len + 1) / 2;
 149     if (*pstr)
 150     {
 151         header->byte_len = len;
 152         memcpy(header + 1, *pstr, header->len * 2);
 153     }
 154     else
 155         header->byte_len = 0xffffffff; /* special case for a null bstr */
 156
 157     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 158 }
 159
 160 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 161 {
 162     bstr_wire_t *header;
 163     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 164
 165     ALIGN_POINTER(Buffer, 3);
 166     header = (bstr_wire_t*)Buffer;
 167     if(header->len != header->len2)
 168         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 169
 170     SysFreeString(*pstr);
 171     *pstr = NULL;
 172
 173     if(header->byte_len != 0xffffffff)
 174         *pstr = SysAllocStringByteLen((char*)(header + 1), header->byte_len);
 175
 176     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 177     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 178 }
 179
 180 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 181 {
 182     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 183     SysFreeString(*pstr);
 184     *pstr = NULL;
 185 }
 186
 187 /* VARIANT */
 188
 189 typedef struct
 190 {
 191     DWORD clSize;
 192     DWORD rpcReserverd;
 193     USHORT vt;
 194     USHORT wReserved1;
 195     USHORT wReserved2;
 196     USHORT wReserved3;
 197     DWORD switch_is;
 198 } variant_wire_t;
 199
 200 static unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 201 {
 202     if (vt & VT_ARRAY) return 4;
 203
 204     switch (vt & ~VT_BYREF) {
 205     case VT_EMPTY:
 206     case VT_NULL:
 207         return 0;
 208     case VT_I1:
 209     case VT_UI1:
 210         return sizeof(CHAR);
 211     case VT_I2:
 212     case VT_UI2:
 213         return sizeof(SHORT);
 214     case VT_I4:
 215     case VT_UI4:
 216         return sizeof(LONG);
 217     case VT_INT:
 218     case VT_UINT:
 219         return sizeof(INT);
 220     case VT_R4:
 221         return sizeof(FLOAT);
 222     case VT_R8:
 223         return sizeof(DOUBLE);
 224     case VT_BOOL:
 225         return sizeof(VARIANT_BOOL);
 226     case VT_ERROR:
 227         return sizeof(SCODE);
 228     case VT_DATE:
 229         return sizeof(DATE);
 230     case VT_CY:
 231         return sizeof(CY);
 232     case VT_DECIMAL:
 233         return sizeof(DECIMAL);
 234     case VT_BSTR:
 235         return sizeof(ULONG);
 236     case VT_VARIANT:
 237         return sizeof(VARIANT);
 238     case VT_UNKNOWN:
 239     case VT_DISPATCH:
 240     case VT_RECORD:
 241         return 0;
 242     default:
 243         FIXME("unhandled VT %d\n", vt);
 244         return 0;
 245     }
 246 }
 247
 248 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 249 {
 250     unsigned int size = get_type_size(pFlags, vt);
 251     if(vt & VT_BYREF) return 3;
 252     if(size == 0) return 0;
 253     if(size <= 4) return size - 1;
 254     return 7;
 255 }
 256
 257 static unsigned interface_variant_size(const ULONG *pFlags, REFIID riid, IUnknown *punk)
 258 {
 259   ULONG size;
 260   HRESULT hr;
 261   /* find the buffer size of the marshalled dispatch interface */
 262   hr = CoGetMarshalSizeMax(&size, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 263   if (FAILED(hr)) {
 264     if (!punk)
 265       WARN("NULL dispatch pointer\n");
 266     else
 267       ERR("Dispatch variant buffer size calculation failed, HRESULT=0x%x\n", hr);
 268     return 0;
 269   }
 270   size += sizeof(ULONG); /* we have to store the buffersize in the stream */
 271   TRACE("wire-size extra of dispatch variant is %d\n", size);
 272   return size;
 273 }
 274
 275 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 276 {
 277   if (V_ISARRAY(pvar))
 278   {
 279     if (V_ISBYREF(pvar))
 280       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 281     else
 282       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 283   }
 284
 285   switch (V_VT(pvar)) {
 286   case VT_BSTR:
 287     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 288   case VT_BSTR | VT_BYREF:
 289     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 290   case VT_VARIANT | VT_BYREF:
 291     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 292   case VT_UNKNOWN:
 293     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 294   case VT_UNKNOWN | VT_BYREF:
 295     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 296   case VT_DISPATCH:
 297     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 298   case VT_DISPATCH | VT_BYREF:
 299     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 300   case VT_RECORD:
 301     FIXME("wire-size record\n");
 302     return Start;
 303   case VT_SAFEARRAY:
 304   case VT_SAFEARRAY | VT_BYREF:
 305     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 306     return Start;
 307   default:
 308     return Start;
 309   }
 310 }
 311
 312 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer. returns Buffer on failure, new position otherwise */
 313 static unsigned char* interface_variant_marshal(const ULONG *pFlags, unsigned char *Buffer,
 314                                                 REFIID riid, IUnknown *punk)
 315 {
 316   IStream *working;
 317   HGLOBAL working_mem;
 318   void *working_memlocked;
 319   unsigned char *oldpos;
 320   ULONG size;
 321   HRESULT hr;
 322
 323   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 324
 325   oldpos = Buffer;
 326
 327   /* CoMarshalInterface needs a stream, whereas at this level we are operating in terms of buffers.
 328    * We create a stream on an HGLOBAL, so we can simply do a memcpy to move it to the buffer.
 329    * in rpcrt4/ndr_ole.c, a simple IStream implementation is wrapped around the buffer object,
 330    * but that would be overkill here, hence this implementation. We save the size because the unmarshal
 331    * code has no way to know how long the marshalled buffer is. */
 332
 333   size = interface_variant_size(pFlags, riid, punk);
 334
 335   working_mem = GlobalAlloc(0, size);
 336   if (!working_mem) return oldpos;
 337
 338   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 339   if (hr != S_OK) {
 340     GlobalFree(working_mem);
 341     return oldpos;
 342   }
 343
 344   hr = CoMarshalInterface(working, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 345   if (hr != S_OK) {
 346     IStream_Release(working); /* this also releases the hglobal */
 347     return oldpos;
 348   }
 349
 350   working_memlocked = GlobalLock(working_mem);
 351   memcpy(Buffer, &size, sizeof(ULONG)); /* copy the buffersize */
 352   memcpy(Buffer + sizeof(ULONG), working_memlocked, size - sizeof(ULONG));
 353   GlobalUnlock(working_mem);
 354
 355   IStream_Release(working);
 356
 357   /* size includes the ULONG for the size written above */
 358   TRACE("done, size=%d\n", size);
 359   return Buffer + size;
 360 }
 361
 362 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer. returns Buffer on failure, new position otherwise */
 363 static unsigned char *interface_variant_unmarshal(const ULONG *pFlags, unsigned char *Buffer,
 364                                                   REFIID riid, IUnknown **ppunk)
 365 {
 366   IStream *working;
 367   HGLOBAL working_mem;
 368   void *working_memlocked;
 369   unsigned char *oldpos;
 370   ULONG size;
 371   HRESULT hr;
 372
 373   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 374
 375   oldpos = Buffer;
 376
 377   /* get the buffersize */
 378   memcpy(&size, Buffer, sizeof(ULONG));
 379   TRACE("buffersize=%d\n", size);
 380
 381   working_mem = GlobalAlloc(0, size);
 382   if (!working_mem) return oldpos;
 383
 384   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 385   if (hr != S_OK) {
 386     GlobalFree(working_mem);
 387     return oldpos;
 388   }
 389
 390   working_memlocked = GlobalLock(working_mem);
 391
 392   /* now we copy the contents of the marshalling buffer to working_memlocked, unlock it, and demarshal the stream */
 393   memcpy(working_memlocked, Buffer + sizeof(ULONG), size);
 394   GlobalUnlock(working_mem);
 395
 396   hr = CoUnmarshalInterface(working, riid, (void**)ppunk);
 397   if (hr != S_OK) {
 398     IStream_Release(working);
 399     return oldpos;
 400   }
 401
 402   IStream_Release(working); /* this also frees the underlying hglobal */
 403
 404   /* size includes the ULONG for the size written above */
 405   TRACE("done, processed=%d bytes\n", size);
 406   return Buffer + size;
 407 }
 408
 409
 410 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 411 {
 412     int align;
 413     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 414     TRACE("vt=%04x\n", V_VT(pvar));
 415
 416     ALIGN_LENGTH(Start, 7);
 417     Start += sizeof(variant_wire_t);
 418     if(V_VT(pvar) & VT_BYREF)
 419         Start += 4;
 420
 421     align = get_type_alignment(pFlags, V_VT(pvar));
 422     ALIGN_LENGTH(Start, align);
 423     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 424         Start += 4;
 425     else
 426         Start += get_type_size(pFlags, V_VT(pvar));
 427     Start = wire_extra_user_size(pFlags, Start, pvar);
 428
 429     TRACE("returning %d\n", Start);
 430     return Start;
 431 }
 432
 433 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 434 {
 435     variant_wire_t *header;
 436     ULONG type_size;
 437     int align;
 438     unsigned char *Pos;
 439
 440     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 441     TRACE("vt=%04x\n", V_VT(pvar));
 442
 443     ALIGN_POINTER(Buffer, 7);
 444
 445     header = (variant_wire_t *)Buffer;
 446
 447     header->clSize = 0; /* fixed up at the end */
 448     header->rpcReserverd = 0;
 449     header->vt = pvar->n1.n2.vt;
 450     header->wReserved1 = pvar->n1.n2.wReserved1;
 451     header->wReserved2 = pvar->n1.n2.wReserved2;
 452     header->wReserved3 = pvar->n1.n2.wReserved3;
 453     header->switch_is = pvar->n1.n2.vt;
 454     if(header->switch_is & VT_ARRAY)
 455         header->switch_is &= ~VT_TYPEMASK;
 456
 457     Pos = (unsigned char*)(header + 1);
 458     type_size = get_type_size(pFlags, V_VT(pvar));
 459     align = get_type_alignment(pFlags, V_VT(pvar));
 460     ALIGN_POINTER(Pos, align);
 461
 462     if(header->vt & VT_BYREF)
 463     {
 464         *(DWORD *)Pos = max(type_size, 4);
 465         Pos += 4;
 466         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 467         {
 468             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 469             Pos += type_size;
 470         }
 471         else
 472         {
 473             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 474             Pos += 4;
 475         }
 476     }
 477     else
 478     {
 479         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 480             memcpy(Pos, pvar, type_size);
 481         else
 482             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 483         Pos += type_size;
 484     }
 485
 486     if(header->vt & VT_ARRAY)
 487     {
 488         if(header->vt & VT_BYREF)
 489             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 490         else
 491             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 492     }
 493     else
 494     {
 495         switch (header->vt)
 496         {
 497         case VT_BSTR:
 498             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 499             break;
 500         case VT_BSTR | VT_BYREF:
 501             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 502             break;
 503         case VT_VARIANT | VT_BYREF:
 504             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 505             break;
 506         case VT_UNKNOWN:
 507             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 508             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 509             break;
 510         case VT_UNKNOWN | VT_BYREF:
 511             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 512             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 513             break;
 514         case VT_DISPATCH:
 515             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 516             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 517             break;
 518         case VT_DISPATCH | VT_BYREF:
 519             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 520             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 521             break;
 522         case VT_RECORD:
 523             FIXME("handle BRECORD by val\n");
 524             break;
 525         case VT_RECORD | VT_BYREF:
 526             FIXME("handle BRECORD by ref\n");
 527             break;
 528         }
 529     }
 530     header->clSize = ((Pos - Buffer) + 7) >> 3;
 531     TRACE("marshalled size=%d\n", header->clSize);
 532     return Pos;
 533 }
 534
 535 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 536 {
 537     variant_wire_t *header;
 538     ULONG type_size;
 539     int align;
 540     unsigned char *Pos;
 541
 542     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 543
 544     ALIGN_POINTER(Buffer, 7);
 545
 546     header = (variant_wire_t *)Buffer;
 547
 548     Pos = (unsigned char*)(header + 1);
 549     type_size = get_type_size(pFlags, header->vt);
 550     align = get_type_alignment(pFlags, header->vt);
 551     ALIGN_POINTER(Pos, align);
 552
 553     if(header->vt & VT_BYREF)
 554     {
 555         ULONG mem_size;
 556         Pos += 4;
 557
 558         switch (header->vt & ~VT_BYREF)
 559         {
 560         /* these types have a different memory size compared to wire size */
 561         case VT_UNKNOWN:
 562         case VT_DISPATCH:
 563         case VT_BSTR:
 564             mem_size = sizeof(void *);
 565             break;
 566         default:
 567             mem_size = type_size;
 568             break;
 569         }
 570
 571         if (V_VT(pvar) != header->vt)
 572         {
 573             VariantClear(pvar);
 574             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 575         }
 576         else if (!V_BYREF(pvar))
 577             V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
 578         memcpy(V_BYREF(pvar), Pos, type_size);
 579         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 580             Pos += type_size;
 581         else
 582             Pos += 4;
 583     }
 584     else
 585     {
 586         VariantClear(pvar);
 587         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 588             memcpy(pvar, Pos, type_size);
 589         else
 590             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 591         Pos += type_size;
 592     }
 593
 594     pvar->n1.n2.vt = header->vt;
 595     pvar->n1.n2.wReserved1 = header->wReserved1;
 596     pvar->n1.n2.wReserved2 = header->wReserved2;
 597     pvar->n1.n2.wReserved3 = header->wReserved3;
 598
 599     if(header->vt & VT_ARRAY)
 600     {
 601         if(header->vt & VT_BYREF)
 602             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 603         else
 604             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 605     }
 606     else
 607     {
 608         switch (header->vt)
 609         {
 610         case VT_BSTR:
 611             V_BSTR(pvar) = NULL;
 612             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 613             break;
 614         case VT_BSTR | VT_BYREF:
 615             *V_BSTRREF(pvar) = NULL;
 616             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 617             break;
 618         case VT_VARIANT | VT_BYREF:
 619             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 620             break;
 621         case VT_UNKNOWN:
 622             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 623             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 624             break;
 625         case VT_UNKNOWN | VT_BYREF:
 626             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 627             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 628             break;
 629         case VT_DISPATCH:
 630             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 631             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 632             break;
 633         case VT_DISPATCH | VT_BYREF:
 634             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 635             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 636             break;
 637         case VT_RECORD:
 638             FIXME("handle BRECORD by val\n");
 639             break;
 640         case VT_RECORD | VT_BYREF:
 641             FIXME("handle BRECORD by ref\n");
 642             break;
 643         }
 644     }
 645     return Pos;
 646 }
 647
 648 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 649 {
 650   VARTYPE vt = V_VT(pvar);
 651   PVOID ref = NULL;
 652
 653   TRACE("(%x,%p)\n", *pFlags, pvar);
 654   TRACE("vt=%04x\n", V_VT(pvar));
 655
 656   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 657
 658   VariantClear(pvar);
 659   if (!ref) return;
 660
 661   if(vt & VT_ARRAY)
 662   {
 663     if (vt & VT_BYREF)
 664       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 665     else
 666       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 667   }
 668   else
 669   {
 670     switch (vt)
 671     {
 672     case VT_BSTR | VT_BYREF:
 673       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 674       break;
 675     case VT_VARIANT | VT_BYREF:
 676       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 677       break;
 678     case VT_RECORD | VT_BYREF:
 679       FIXME("handle BRECORD by ref\n");
 680       break;
 681     case VT_UNKNOWN | VT_BYREF:
 682     case VT_DISPATCH | VT_BYREF:
 683       IUnknown_Release(*V_UNKNOWNREF(pvar));
 684       break;
 685     }
 686   }
 687
 688   CoTaskMemFree(ref);
 689 }
 690
 691 /* LPSAFEARRAY */
 692
 693 /* Get the number of cells in a SafeArray */
 694 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 695 {
 696     const SAFEARRAYBOUND* psab = psa->rgsabound;
 697     USHORT cCount = psa->cDims;
 698     ULONG ulNumCells = 1;
 699
 700     while (cCount--)
 701     {
 702         /* This is a valid bordercase. See testcases. -Marcus */
 703         if (!psab->cElements)
 704             return 0;
 705         ulNumCells *= psab->cElements;
 706         psab++;
 707     }
 708     return ulNumCells;
 709 }
 710
 711 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 712 {
 713     VARTYPE vt;
 714     HRESULT hr;
 715
 716     hr = SafeArrayGetVartype(psa, &vt);
 717     if (FAILED(hr))
 718     {
 719         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 720
 721         switch(psa->cbElements)
 722         {
 723         case 1: vt = VT_I1; break;
 724         case 2: vt = VT_I2; break;
 725         case 4: vt = VT_I4; break;
 726         case 8: vt = VT_I8; break;
 727         default:
 728             RpcRaiseException(hr);
 729         }
 730     }
 731
 732     if (psa->fFeatures & FADF_HAVEIID)
 733         return SF_HAVEIID;
 734
 735     switch (vt)
 736     {
 737     case VT_I1:
 738     case VT_UI1:      return SF_I1;
 739     case VT_BOOL:
 740     case VT_I2:
 741     case VT_UI2:      return SF_I2;
 742     case VT_INT:
 743     case VT_UINT:
 744     case VT_I4:
 745     case VT_UI4:
 746     case VT_R4:       return SF_I4;
 747     case VT_DATE:
 748     case VT_CY:
 749     case VT_R8:
 750     case VT_I8:
 751     case VT_UI8:      return SF_I8;
 752     case VT_INT_PTR:
 753     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 754     case VT_BSTR:     return SF_BSTR;
 755     case VT_DISPATCH: return SF_DISPATCH;
 756     case VT_VARIANT:  return SF_VARIANT;
 757     case VT_UNKNOWN:  return SF_UNKNOWN;
 758     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 759      * of a UDT is taken from the result of IRecordInfo_GetSize().
 760      */
 761     case VT_RECORD:   return SF_RECORD;
 762     default:          return SF_ERROR;
 763     }
 764 }
 765
 766 static DWORD elem_wire_size(LPSAFEARRAY lpsa, SF_TYPE sftype)
 767 {
 768     if (sftype == SF_BSTR)
 769         return sizeof(DWORD);
 770     else if (sftype == SF_VARIANT)
 771         return sizeof(variant_wire_t) - sizeof(DWORD);
 772     else
 773         return lpsa->cbElements;
 774 }
 775
 776 static DWORD elem_mem_size(wireSAFEARRAY wiresa, SF_TYPE sftype)
 777 {
 778     if (sftype == SF_BSTR)
 779         return sizeof(BSTR);
 780     else if (sftype == SF_VARIANT)
 781         return sizeof(VARIANT);
 782     else
 783         return wiresa->cbElements;
 784 }
 785
 786 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 787 {
 788     ULONG size = StartingSize;
 789
 790     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 791
 792     ALIGN_LENGTH(size, 3);
 793     size += sizeof(ULONG);
 794     if (*ppsa)
 795     {
 796         SAFEARRAY *psa = *ppsa;
 797         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 798         SF_TYPE sftype;
 799         HRESULT hr;
 800
 801         size += sizeof(ULONG);
 802         size += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
 803
 804         sftype = SAFEARRAY_GetUnionType(psa);
 805         size += sizeof(ULONG);
 806
 807         size += sizeof(ULONG);
 808         size += sizeof(ULONG);
 809         if (sftype == SF_HAVEIID)
 810             size += sizeof(IID);
 811
 812         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 813
 814         size += sizeof(ULONG);
 815
 816         switch (sftype)
 817         {
 818             case SF_BSTR:
 819             {
 820                 BSTR* lpBstr;
 821
 822                 for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 823                     size = BSTR_UserSize(pFlags, size, lpBstr);
 824
 825                 break;
 826             }
 827             case SF_DISPATCH:
 828             case SF_UNKNOWN:
 829             case SF_HAVEIID:
 830                 FIXME("size interfaces\n");
 831                 break;
 832             case SF_VARIANT:
 833             {
 834                 VARIANT* lpVariant;
 835
 836                 for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 837                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 838
 839                 break;
 840             }
 841             case SF_RECORD:
 842             {
 843                 IRecordInfo* pRecInfo = NULL;
 844
 845                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 846                 if (FAILED(hr))
 847                     RpcRaiseException(hr);
 848
 849                 if (pRecInfo)
 850                 {
 851                     FIXME("size record info %p\n", pRecInfo);
 852
 853                     IRecordInfo_Release(pRecInfo);
 854                 }
 855                 break;
 856             }
 857             case SF_I8:
 858                 ALIGN_LENGTH(size, 7);
 859                 /* fallthrough */
 860             case SF_I1:
 861             case SF_I2:
 862             case SF_I4:
 863                 size += ulCellCount * psa->cbElements;
 864                 break;
 865             default:
 866                 break;
 867         }
 868
 869     }
 870
 871     return size;
 872 }
 873
 874 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 875 {
 876     HRESULT hr;
 877
 878     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 879
 880     ALIGN_POINTER(Buffer, 3);
 881     *(ULONG *)Buffer = *ppsa ? 0x1 : 0x0;
 882     Buffer += sizeof(ULONG);
 883     if (*ppsa)
 884     {
 885         VARTYPE vt;
 886         SAFEARRAY *psa = *ppsa;
 887         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 888         SF_TYPE sftype;
 889         GUID guid;
 890
 891         sftype = SAFEARRAY_GetUnionType(psa);
 892
 893         *(ULONG *)Buffer = psa->cDims;
 894         Buffer += sizeof(ULONG);
 895         *(USHORT *)Buffer = psa->cDims;
 896         Buffer += sizeof(USHORT);
 897         *(USHORT *)Buffer = psa->fFeatures;
 898         Buffer += sizeof(USHORT);
 899         *(ULONG *)Buffer = elem_wire_size(psa, sftype);
 900         Buffer += sizeof(ULONG);
 901
 902         hr = SafeArrayGetVartype(psa, &vt);
 903         if (FAILED(hr)) vt = 0;
 904
 905         *(ULONG *)Buffer = (USHORT)psa->cLocks | (vt << 16);
 906         Buffer += sizeof(ULONG);
 907
 908         *(ULONG *)Buffer = sftype;
 909         Buffer += sizeof(ULONG);
 910
 911         *(ULONG *)Buffer = ulCellCount;
 912         Buffer += sizeof(ULONG);
 913         *(ULONG *)Buffer = psa->pvData ? 0x2 : 0x0;
 914         Buffer += sizeof(ULONG);
 915         if (sftype == SF_HAVEIID)
 916         {
 917             SafeArrayGetIID(psa, &guid);
 918             memcpy(Buffer, &guid, sizeof(guid));
 919             Buffer += sizeof(guid);
 920         }
 921
 922         memcpy(Buffer, psa->rgsabound, sizeof(psa->rgsabound[0]) * psa->cDims);
 923         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 924
 925         *(ULONG *)Buffer = ulCellCount;
 926         Buffer += sizeof(ULONG);
 927
 928         if (psa->pvData)
 929         {
 930             switch (sftype)
 931             {
 932                 case SF_BSTR:
 933                 {
 934                     BSTR* lpBstr;
 935
 936                     for (lpBstr = psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 937                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 938
 939                     break;
 940                 }
 941                 case SF_DISPATCH:
 942                 case SF_UNKNOWN:
 943                 case SF_HAVEIID:
 944                     FIXME("marshal interfaces\n");
 945                     break;
 946                 case SF_VARIANT:
 947                 {
 948                     VARIANT* lpVariant;
 949
 950                     for (lpVariant = psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 951                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 952
 953                     break;
 954                 }
 955                 case SF_RECORD:
 956                 {
 957                     IRecordInfo* pRecInfo = NULL;
 958
 959                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 960                     if (FAILED(hr))
 961                         RpcRaiseException(hr);
 962
 963                     if (pRecInfo)
 964                     {
 965                         FIXME("write record info %p\n", pRecInfo);
 966
 967                         IRecordInfo_Release(pRecInfo);
 968                     }
 969                     break;
 970                 }
 971
 972                 case SF_I8:
 973                     ALIGN_POINTER(Buffer, 7);
 974                     /* fallthrough */
 975                 case SF_I1:
 976                 case SF_I2:
 977                 case SF_I4:
 978                     /* Just copy the data over */
 979                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
 980                     Buffer += ulCellCount * psa->cbElements;
 981                     break;
 982                 default:
 983                     break;
 984             }
 985         }
 986
 987     }
 988     return Buffer;
 989 }
 990
 991 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
 992                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
 993                            FADF_VARIANT | FADF_CREATEVECTOR)
 994
 995 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 996 {
 997     ULONG ptr;
 998     wireSAFEARRAY wiresa;
 999     ULONG cDims;
1000     HRESULT hr;
1001     SF_TYPE sftype;
1002     ULONG cell_count;
1003     GUID guid;
1004     VARTYPE vt;
1005     SAFEARRAYBOUND *wiresab;
1006
1007     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
1008
1009     ALIGN_POINTER(Buffer, 3);
1010     ptr = *(ULONG *)Buffer;
1011     Buffer += sizeof(ULONG);
1012
1013     if (!ptr)
1014     {
1015         *ppsa = NULL;
1016
1017         TRACE("NULL safe array unmarshaled\n");
1018
1019         return Buffer;
1020     }
1021
1022     cDims = *(ULONG *)Buffer;
1023     Buffer += sizeof(ULONG);
1024
1025     wiresa = (wireSAFEARRAY)Buffer;
1026     Buffer += 2 * sizeof(USHORT) + 2 * sizeof(ULONG);
1027
1028     if (cDims != wiresa->cDims)
1029         RpcRaiseException(RPC_S_INVALID_BOUND);
1030
1031     /* FIXME: there should be a limit on how large cDims can be */
1032
1033     vt = HIWORD(wiresa->cLocks);
1034
1035     sftype = *(ULONG *)Buffer;
1036     Buffer += sizeof(ULONG);
1037
1038     cell_count = *(ULONG *)Buffer;
1039     Buffer += sizeof(ULONG);
1040     ptr = *(ULONG *)Buffer;
1041     Buffer += sizeof(ULONG);
1042     if (sftype == SF_HAVEIID)
1043     {
1044         memcpy(&guid, Buffer, sizeof(guid));
1045         Buffer += sizeof(guid);
1046     }
1047
1048     wiresab = (SAFEARRAYBOUND *)Buffer;
1049     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1050
1051     if(vt)
1052         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1053     else
1054     {
1055         SafeArrayAllocDescriptor(wiresa->cDims, ppsa);
1056         if(*ppsa)
1057             memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1058     }
1059     if (!*ppsa)
1060         RpcRaiseException(E_OUTOFMEMORY);
1061
1062     /* be careful about which flags we set since they could be a security
1063      * risk */
1064     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1065     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1066     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1067     (*ppsa)->cbElements = elem_mem_size(wiresa, sftype);
1068     (*ppsa)->cLocks = LOWORD(wiresa->cLocks);
1069
1070     /* SafeArrayCreateEx allocates the data for us, but
1071      * SafeArrayAllocDescriptor doesn't */
1072     if(!vt)
1073     {
1074         hr = SafeArrayAllocData(*ppsa);
1075         if (FAILED(hr))
1076             RpcRaiseException(hr);
1077     }
1078
1079     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1080         RpcRaiseException(RPC_S_INVALID_BOUND);
1081     Buffer += sizeof(ULONG);
1082
1083     if (ptr)
1084     {
1085         switch (sftype)
1086         {
1087             case SF_BSTR:
1088             {
1089                 BSTR* lpBstr;
1090
1091                 for (lpBstr = (*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1092                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1093
1094                 break;
1095             }
1096             case SF_DISPATCH:
1097             case SF_UNKNOWN:
1098             case SF_HAVEIID:
1099                 FIXME("marshal interfaces\n");
1100                 break;
1101             case SF_VARIANT:
1102             {
1103                 VARIANT* lpVariant;
1104
1105                 for (lpVariant = (*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1106                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1107
1108                 break;
1109             }
1110             case SF_RECORD:
1111             {
1112                 FIXME("set record info\n");
1113
1114                 break;
1115             }
1116
1117             case SF_I8:
1118                 ALIGN_POINTER(Buffer, 7);
1119                 /* fallthrough */
1120             case SF_I1:
1121             case SF_I2:
1122             case SF_I4:
1123                 /* Just copy the data over */
1124                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1125                 Buffer += cell_count * (*ppsa)->cbElements;
1126                 break;
1127             default:
1128                 break;
1129         }
1130     }
1131
1132     TRACE("safe array unmarshaled: %p\n", *ppsa);
1133
1134     return Buffer;
1135 }
1136
1137 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1138 {
1139     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1140
1141     SafeArrayDestroy(*ppsa);
1142 }
1143
1144
1145 ULONG WINAPI HFONT_UserSize(ULONG *pFlags, ULONG Start, HFONT *phfont)
1146 {
1147     FIXME(":stub\n");
1148     return 0;
1149 }
1150
1151 unsigned char * WINAPI HFONT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1152 {
1153     FIXME(":stub\n");
1154     return NULL;
1155 }
1156
1157 unsigned char * WINAPI HFONT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, HFONT *phfont)
1158 {
1159     FIXME(":stub\n");
1160     return NULL;
1161 }
1162
1163 void WINAPI HFONT_UserFree(ULONG *pFlags, HFONT *phfont)
1164 {
1165     FIXME(":stub\n");
1166     return;
1167 }
1168
1169
1170 /* IDispatch */
1171 /* exactly how Invoke is marshalled is not very clear to me yet,
1172  * but the way I've done it seems to work for me */
1173
1174 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1175     IDispatch* This,
1176     DISPID dispIdMember,
1177     REFIID riid,
1178     LCID lcid,
1179     WORD wFlags,
1180     DISPPARAMS* pDispParams,
1181     VARIANT* pVarResult,
1182     EXCEPINFO* pExcepInfo,
1183     UINT* puArgErr)
1184 {
1185   HRESULT hr;
1186   VARIANT VarResult;
1187   UINT* rgVarRefIdx = NULL;
1188   VARIANTARG* rgVarRef = NULL;
1189   UINT u, cVarRef;
1190   UINT uArgErr;
1191   EXCEPINFO ExcepInfo;
1192
1193   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1194         dispIdMember, debugstr_guid(riid),
1195         lcid, wFlags, pDispParams, pVarResult,
1196         pExcepInfo, puArgErr);
1197
1198   /* [out] args can't be null, use dummy vars if needed */
1199   if (!pVarResult) pVarResult = &VarResult;
1200   if (!puArgErr) puArgErr = &uArgErr;
1201   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1202
1203   /* count by-ref args */
1204   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1205     VARIANTARG* arg = &pDispParams->rgvarg[u];
1206     if (V_ISBYREF(arg)) {
1207       cVarRef++;
1208     }
1209   }
1210   if (cVarRef) {
1211     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1212     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1213     /* make list of by-ref args */
1214     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1215       VARIANTARG* arg = &pDispParams->rgvarg[u];
1216       if (V_ISBYREF(arg)) {
1217         rgVarRefIdx[cVarRef] = u;
1218         VariantInit(&rgVarRef[cVarRef]);
1219         VariantCopy(&rgVarRef[cVarRef], arg);
1220         VariantClear(arg);
1221         cVarRef++;
1222       }
1223     }
1224   } else {
1225     /* [out] args still can't be null,
1226      * but we can point these anywhere in this case,
1227      * since they won't be written to when cVarRef is 0 */
1228     rgVarRefIdx = puArgErr;
1229     rgVarRef = pVarResult;
1230   }
1231   TRACE("passed by ref: %d args\n", cVarRef);
1232   hr = IDispatch_RemoteInvoke_Proxy(This,
1233                                     dispIdMember,
1234                                     riid,
1235                                     lcid,
1236                                     wFlags,
1237                                     pDispParams,
1238                                     pVarResult,
1239                                     pExcepInfo,
1240                                     puArgErr,
1241                                     cVarRef,
1242                                     rgVarRefIdx,
1243                                     rgVarRef);
1244   if (cVarRef) {
1245     for (u=0; u<cVarRef; u++) {
1246       unsigned i = rgVarRefIdx[u];
1247       VariantCopy(&pDispParams->rgvarg[i],
1248                   &rgVarRef[u]);
1249       VariantClear(&rgVarRef[u]);
1250     }
1251     CoTaskMemFree(rgVarRef);
1252     CoTaskMemFree(rgVarRefIdx);
1253   }
1254
1255   if(pExcepInfo == &ExcepInfo)
1256   {
1257     SysFreeString(pExcepInfo->bstrSource);
1258     SysFreeString(pExcepInfo->bstrDescription);
1259     SysFreeString(pExcepInfo->bstrHelpFile);
1260   }
1261   return hr;
1262 }
1263
1264 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1265     IDispatch* This,
1266     DISPID dispIdMember,
1267     REFIID riid,
1268     LCID lcid,
1269     DWORD dwFlags,
1270     DISPPARAMS* pDispParams,
1271     VARIANT* pVarResult,
1272     EXCEPINFO* pExcepInfo,
1273     UINT* pArgErr,
1274     UINT cVarRef,
1275     UINT* rgVarRefIdx,
1276     VARIANTARG* rgVarRef)
1277 {
1278   HRESULT hr = S_OK;
1279   VARIANTARG *rgvarg, *arg;
1280   UINT u;
1281
1282   /* initialize out parameters, so that they can be marshalled
1283    * in case the real Invoke doesn't initialize them */
1284   VariantInit(pVarResult);
1285   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1286   *pArgErr = 0;
1287
1288   /* let the real Invoke operate on a copy of the in parameters,
1289    * so we don't risk losing pointers to allocated memory */
1290   rgvarg = pDispParams->rgvarg;
1291   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1292   if (!arg) return E_OUTOFMEMORY;
1293
1294   /* init all args so we can call VariantClear on all the args if the copy
1295    * below fails */
1296   for (u = 0; u < pDispParams->cArgs; u++)
1297     VariantInit(&arg[u]);
1298
1299   for (u = 0; u < pDispParams->cArgs; u++) {
1300     hr = VariantCopy(&arg[u], &rgvarg[u]);
1301     if (FAILED(hr))
1302         break;
1303   }
1304
1305   if (SUCCEEDED(hr)) {
1306     /* copy ref args to arg array */
1307     for (u=0; u<cVarRef; u++) {
1308       unsigned i = rgVarRefIdx[u];
1309       VariantCopy(&arg[i], &rgVarRef[u]);
1310     }
1311
1312     pDispParams->rgvarg = arg;
1313
1314     hr = IDispatch_Invoke(This,
1315                           dispIdMember,
1316                           riid,
1317                           lcid,
1318                           dwFlags,
1319                           pDispParams,
1320                           pVarResult,
1321                           pExcepInfo,
1322                           pArgErr);
1323
1324     /* copy ref args from arg array */
1325     for (u=0; u<cVarRef; u++) {
1326       unsigned i = rgVarRefIdx[u];
1327       VariantCopy(&rgVarRef[u], &arg[i]);
1328     }
1329   }
1330
1331   /* clear the duplicate argument list */
1332   for (u=0; u<pDispParams->cArgs; u++)
1333     VariantClear(&arg[u]);
1334
1335   pDispParams->rgvarg = rgvarg;
1336   CoTaskMemFree(arg);
1337
1338   return hr;
1339 }
1340
1341 /* IEnumVARIANT */
1342
1343 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1344     IEnumVARIANT* This,
1345     ULONG celt,
1346     VARIANT* rgVar,
1347     ULONG* pCeltFetched)
1348 {
1349   ULONG fetched;
1350   if (!pCeltFetched)
1351     pCeltFetched = &fetched;
1352   return IEnumVARIANT_RemoteNext_Proxy(This,
1353                                        celt,
1354                                        rgVar,
1355                                        pCeltFetched);
1356 }
1357
1358 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1359     IEnumVARIANT* This,
1360     ULONG celt,
1361     VARIANT* rgVar,
1362     ULONG* pCeltFetched)
1363 {
1364   HRESULT hr;
1365   *pCeltFetched = 0;
1366   hr = IEnumVARIANT_Next(This,
1367                          celt,
1368                          rgVar,
1369                          pCeltFetched);
1370   if (hr == S_OK) *pCeltFetched = celt;
1371   return hr;
1372 }
1373
1374 /* TypeInfo related freers */
1375
1376 static void free_embedded_typedesc(TYPEDESC *tdesc);
1377 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1378 {
1379     switch(adesc->tdescElem.vt)
1380     {
1381     case VT_PTR:
1382     case VT_SAFEARRAY:
1383         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1384         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1385         break;
1386     case VT_CARRAY:
1387         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1388         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1389         break;
1390     }
1391 }
1392
1393 static void free_embedded_typedesc(TYPEDESC *tdesc)
1394 {
1395     switch(tdesc->vt)
1396     {
1397     case VT_PTR:
1398     case VT_SAFEARRAY:
1399         free_embedded_typedesc(tdesc->u.lptdesc);
1400         CoTaskMemFree(tdesc->u.lptdesc);
1401         break;
1402     case VT_CARRAY:
1403         free_embedded_arraydesc(tdesc->u.lpadesc);
1404         CoTaskMemFree(tdesc->u.lpadesc);
1405         break;
1406     }
1407 }
1408
1409 static void free_embedded_elemdesc(ELEMDESC *edesc)
1410 {
1411     free_embedded_typedesc(&edesc->tdesc);
1412     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1413         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1414 }
1415
1416 /* ITypeComp */
1417
1418 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1419     ITypeComp* This,
1420     LPOLESTR szName,
1421     ULONG lHashVal,
1422     WORD wFlags,
1423     ITypeInfo** ppTInfo,
1424     DESCKIND* pDescKind,
1425     BINDPTR* pBindPtr)
1426 {
1427   FIXME("not implemented\n");
1428   return E_FAIL;
1429 }
1430
1431 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1432     ITypeComp* This,
1433     LPOLESTR szName,
1434     ULONG lHashVal,
1435     WORD wFlags,
1436     ITypeInfo** ppTInfo,
1437     DESCKIND* pDescKind,
1438     LPFUNCDESC* ppFuncDesc,
1439     LPVARDESC* ppVarDesc,
1440     ITypeComp** ppTypeComp,
1441     CLEANLOCALSTORAGE* pDummy)
1442 {
1443   FIXME("not implemented\n");
1444   return E_FAIL;
1445 }
1446
1447 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1448     ITypeComp* This,
1449     LPOLESTR szName,
1450     ULONG lHashVal,
1451     ITypeInfo** ppTInfo,
1452     ITypeComp** ppTComp)
1453 {
1454   FIXME("not implemented\n");
1455   return E_FAIL;
1456 }
1457
1458 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1459     ITypeComp* This,
1460     LPOLESTR szName,
1461     ULONG lHashVal,
1462     ITypeInfo** ppTInfo)
1463 {
1464   FIXME("not implemented\n");
1465   return E_FAIL;
1466 }
1467
1468 /* ITypeInfo */
1469
1470 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1471     ITypeInfo* This,
1472     TYPEATTR** ppTypeAttr)
1473
1474 {
1475     CLEANLOCALSTORAGE stg;
1476     TRACE("(%p, %p)\n", This, ppTypeAttr);
1477
1478     stg.flags = 0;
1479     stg.pStorage = NULL;
1480     stg.pInterface = NULL;
1481
1482     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1483 }
1484
1485 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1486     ITypeInfo* This,
1487     LPTYPEATTR* ppTypeAttr,
1488     CLEANLOCALSTORAGE* pDummy)
1489 {
1490     HRESULT hr;
1491     TRACE("(%p, %p)\n", This, ppTypeAttr);
1492
1493     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1494     if(hr != S_OK)
1495         return hr;
1496
1497     pDummy->flags = CLS_TYPEATTR;
1498     ITypeInfo_AddRef(This);
1499     pDummy->pInterface = (IUnknown*)This;
1500     pDummy->pStorage = ppTypeAttr;
1501     return hr;
1502 }
1503
1504 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1505     ITypeInfo* This,
1506     UINT index,
1507     FUNCDESC** ppFuncDesc)
1508 {
1509     CLEANLOCALSTORAGE stg;
1510     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1511
1512     stg.flags = 0;
1513     stg.pStorage = NULL;
1514     stg.pInterface = NULL;
1515
1516     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1517 }
1518
1519 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1520     ITypeInfo* This,
1521     UINT index,
1522     LPFUNCDESC* ppFuncDesc,
1523     CLEANLOCALSTORAGE* pDummy)
1524 {
1525     HRESULT hr;
1526     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1527
1528     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1529     if(hr != S_OK)
1530         return hr;
1531
1532     pDummy->flags = CLS_FUNCDESC;
1533     ITypeInfo_AddRef(This);
1534     pDummy->pInterface = (IUnknown*)This;
1535     pDummy->pStorage = ppFuncDesc;
1536     return hr;
1537 }
1538
1539 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1540     ITypeInfo* This,
1541     UINT index,
1542     VARDESC** ppVarDesc)
1543 {
1544     CLEANLOCALSTORAGE stg;
1545     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1546
1547     stg.flags = 0;
1548     stg.pStorage = NULL;
1549     stg.pInterface = NULL;
1550
1551     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1552 }
1553
1554 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1555     ITypeInfo* This,
1556     UINT index,
1557     LPVARDESC* ppVarDesc,
1558     CLEANLOCALSTORAGE* pDummy)
1559 {
1560     HRESULT hr;
1561     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1562
1563     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1564     if(hr != S_OK)
1565         return hr;
1566
1567     pDummy->flags = CLS_VARDESC;
1568     ITypeInfo_AddRef(This);
1569     pDummy->pInterface = (IUnknown*)This;
1570     pDummy->pStorage = ppVarDesc;
1571     return hr;
1572 }
1573
1574 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1575     ITypeInfo* This,
1576     MEMBERID memid,
1577     BSTR* rgBstrNames,
1578     UINT cMaxNames,
1579     UINT* pcNames)
1580 {
1581   FIXME("not implemented\n");
1582   return E_FAIL;
1583 }
1584
1585 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1586     ITypeInfo* This,
1587     MEMBERID memid,
1588     BSTR* rgBstrNames,
1589     UINT cMaxNames,
1590     UINT* pcNames)
1591 {
1592   FIXME("not implemented\n");
1593   return E_FAIL;
1594 }
1595
1596 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1597     ITypeInfo* This,
1598     LPOLESTR* rgszNames,
1599     UINT cNames,
1600     MEMBERID* pMemId)
1601 {
1602   FIXME("not implemented\n");
1603   return E_FAIL;
1604 }
1605
1606 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1607     ITypeInfo* This)
1608 {
1609   FIXME("not implemented\n");
1610   return E_FAIL;
1611 }
1612
1613 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1614     ITypeInfo* This,
1615     PVOID pvInstance,
1616     MEMBERID memid,
1617     WORD wFlags,
1618     DISPPARAMS* pDispParams,
1619     VARIANT* pVarResult,
1620     EXCEPINFO* pExcepInfo,
1621     UINT* puArgErr)
1622 {
1623   FIXME("not implemented\n");
1624   return E_FAIL;
1625 }
1626
1627 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1628     ITypeInfo* This)
1629 {
1630   FIXME("not implemented\n");
1631   return E_FAIL;
1632 }
1633
1634 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(
1635     ITypeInfo* This,
1636     MEMBERID memid,
1637     BSTR* pBstrName,
1638     BSTR* pBstrDocString,
1639     DWORD* pdwHelpContext,
1640     BSTR* pBstrHelpFile)
1641 {
1642     DWORD help_context;
1643     BSTR name, doc_string, help_file;
1644     HRESULT hr;
1645     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1646
1647     /* FIXME: presumably refPtrFlags is supposed to be a bitmask of which ptrs we actually want? */
1648     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, 0, &name, &doc_string, &help_context, &help_file);
1649     if(SUCCEEDED(hr))
1650     {
1651         if(pBstrName) *pBstrName = name;
1652         else SysFreeString(name);
1653
1654         if(pBstrDocString) *pBstrDocString = doc_string;
1655         else SysFreeString(doc_string);
1656
1657         if(pBstrHelpFile) *pBstrHelpFile = help_file;
1658         else SysFreeString(help_file);
1659
1660         if(pdwHelpContext) *pdwHelpContext = help_context;
1661     }
1662     return hr;
1663 }
1664
1665 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(
1666     ITypeInfo* This,
1667     MEMBERID memid,
1668     DWORD refPtrFlags,
1669     BSTR* pBstrName,
1670     BSTR* pBstrDocString,
1671     DWORD* pdwHelpContext,
1672     BSTR* pBstrHelpFile)
1673 {
1674     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, refPtrFlags, pBstrName, pBstrDocString,
1675           pdwHelpContext, pBstrHelpFile);
1676     return ITypeInfo_GetDocumentation(This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1677 }
1678
1679 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(
1680     ITypeInfo* This,
1681     MEMBERID memid,
1682     INVOKEKIND invKind,
1683     BSTR* pBstrDllName,
1684     BSTR* pBstrName,
1685     WORD* pwOrdinal)
1686 {
1687   FIXME("not implemented\n");
1688   return E_FAIL;
1689 }
1690
1691 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(
1692     ITypeInfo* This,
1693     MEMBERID memid,
1694     INVOKEKIND invKind,
1695     DWORD refPtrFlags,
1696     BSTR* pBstrDllName,
1697     BSTR* pBstrName,
1698     WORD* pwOrdinal)
1699 {
1700   FIXME("not implemented\n");
1701   return E_FAIL;
1702 }
1703
1704 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1705     ITypeInfo* This,
1706     MEMBERID memid,
1707     INVOKEKIND invKind,
1708     PVOID* ppv)
1709 {
1710   FIXME("not implemented\n");
1711   return E_FAIL;
1712 }
1713
1714 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1715     ITypeInfo* This)
1716 {
1717   FIXME("not implemented\n");
1718   return E_FAIL;
1719 }
1720
1721 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1722     ITypeInfo* This,
1723     IUnknown* pUnkOuter,
1724     REFIID riid,
1725     PVOID* ppvObj)
1726 {
1727   FIXME("not implemented\n");
1728   return E_FAIL;
1729 }
1730
1731 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1732     ITypeInfo* This,
1733     REFIID riid,
1734     IUnknown** ppvObj)
1735 {
1736   FIXME("not implemented\n");
1737   return E_FAIL;
1738 }
1739
1740 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1741     ITypeInfo* This,
1742     ITypeLib** ppTLib,
1743     UINT* pIndex)
1744 {
1745     ITypeLib *pTL;
1746     UINT index;
1747     HRESULT hr;
1748
1749     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1750
1751     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1752     if(SUCCEEDED(hr))
1753     {
1754         if(pIndex)
1755             *pIndex = index;
1756
1757         if(ppTLib)
1758             *ppTLib = pTL;
1759         else
1760             ITypeLib_Release(pTL);
1761     }
1762     return hr;
1763 }
1764
1765 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1766     ITypeInfo* This,
1767     ITypeLib** ppTLib,
1768     UINT* pIndex)
1769 {
1770     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1771     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1772 }
1773
1774 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1775     ITypeInfo* This,
1776     TYPEATTR* pTypeAttr)
1777 {
1778     TRACE("(%p, %p)\n", This, pTypeAttr);
1779     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1780     CoTaskMemFree(pTypeAttr);
1781 }
1782
1783 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1784     ITypeInfo* This)
1785 {
1786     TRACE("nothing to do\n");
1787     return S_OK;
1788 }
1789
1790 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1791     ITypeInfo* This,
1792     FUNCDESC* pFuncDesc)
1793 {
1794     SHORT param;
1795     TRACE("(%p, %p)\n", This, pFuncDesc);
1796
1797     for(param = 0; param < pFuncDesc->cParams; param++)
1798         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1799     if(param)
1800         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1801
1802     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1803
1804     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1805         CoTaskMemFree(pFuncDesc->lprgscode);
1806
1807     CoTaskMemFree(pFuncDesc);
1808 }
1809
1810 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1811     ITypeInfo* This)
1812 {
1813     TRACE("nothing to do\n");
1814     return S_OK;
1815 }
1816
1817 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1818     ITypeInfo* This,
1819     VARDESC* pVarDesc)
1820 {
1821     TRACE("(%p, %p)\n", This, pVarDesc);
1822
1823     CoTaskMemFree(pVarDesc->lpstrSchema);
1824
1825     if(pVarDesc->varkind == VAR_CONST)
1826         CoTaskMemFree(pVarDesc->u.lpvarValue);
1827
1828     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1829     CoTaskMemFree(pVarDesc);
1830 }
1831
1832 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1833     ITypeInfo* This)
1834 {
1835     TRACE("nothing to do\n");
1836     return S_OK;
1837 }
1838
1839
1840 /* ITypeInfo2 */
1841
1842 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(
1843     ITypeInfo2* This,
1844     MEMBERID memid,
1845     LCID lcid,
1846     BSTR* pbstrHelpString,
1847     DWORD* pdwHelpStringContext,
1848     BSTR* pbstrHelpStringDll)
1849 {
1850   FIXME("not implemented\n");
1851   return E_FAIL;
1852 }
1853
1854 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(
1855     ITypeInfo2* This,
1856     MEMBERID memid,
1857     LCID lcid,
1858     DWORD refPtrFlags,
1859     BSTR* pbstrHelpString,
1860     DWORD* pdwHelpStringContext,
1861     BSTR* pbstrHelpStringDll)
1862 {
1863   FIXME("not implemented\n");
1864   return E_FAIL;
1865 }
1866
1867 /* ITypeLib */
1868
1869 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1870     ITypeLib* This)
1871 {
1872     UINT count = 0;
1873     TRACE("(%p)\n", This);
1874
1875     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1876
1877     return count;
1878 }
1879
1880 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1881     ITypeLib* This,
1882     UINT* pcTInfo)
1883 {
1884     TRACE("(%p, %p)\n", This, pcTInfo);
1885     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1886     return S_OK;
1887 }
1888
1889 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1890     ITypeLib* This,
1891     TLIBATTR** ppTLibAttr)
1892 {
1893     CLEANLOCALSTORAGE stg;
1894     TRACE("(%p, %p)\n", This, ppTLibAttr);
1895
1896     stg.flags = 0;
1897     stg.pStorage = NULL;
1898     stg.pInterface = NULL;
1899
1900     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1901 }
1902
1903 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1904     ITypeLib* This,
1905     LPTLIBATTR* ppTLibAttr,
1906     CLEANLOCALSTORAGE* pDummy)
1907 {
1908     HRESULT hr;
1909     TRACE("(%p, %p)\n", This, ppTLibAttr);
1910
1911     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1912     if(hr != S_OK)
1913         return hr;
1914
1915     pDummy->flags = CLS_LIBATTR;
1916     ITypeLib_AddRef(This);
1917     pDummy->pInterface = (IUnknown*)This;
1918     pDummy->pStorage = ppTLibAttr;
1919     return hr;
1920 }
1921
1922 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(
1923     ITypeLib* This,
1924     INT index,
1925     BSTR* pBstrName,
1926     BSTR* pBstrDocString,
1927     DWORD* pdwHelpContext,
1928     BSTR* pBstrHelpFile)
1929 {
1930   FIXME("not implemented\n");
1931   return E_FAIL;
1932 }
1933
1934 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(
1935     ITypeLib* This,
1936     INT index,
1937     DWORD refPtrFlags,
1938     BSTR* pBstrName,
1939     BSTR* pBstrDocString,
1940     DWORD* pdwHelpContext,
1941     BSTR* pBstrHelpFile)
1942 {
1943   FIXME("not implemented\n");
1944   return E_FAIL;
1945 }
1946
1947 HRESULT CALLBACK ITypeLib_IsName_Proxy(
1948     ITypeLib* This,
1949     LPOLESTR szNameBuf,
1950     ULONG lHashVal,
1951     BOOL* pfName)
1952 {
1953   FIXME("not implemented\n");
1954   return E_FAIL;
1955 }
1956
1957 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
1958     ITypeLib* This,
1959     LPOLESTR szNameBuf,
1960     ULONG lHashVal,
1961     BOOL* pfName,
1962     BSTR* pBstrLibName)
1963 {
1964   FIXME("not implemented\n");
1965   return E_FAIL;
1966 }
1967
1968 HRESULT CALLBACK ITypeLib_FindName_Proxy(
1969     ITypeLib* This,
1970     LPOLESTR szNameBuf,
1971     ULONG lHashVal,
1972     ITypeInfo** ppTInfo,
1973     MEMBERID* rgMemId,
1974     USHORT* pcFound)
1975 {
1976   FIXME("not implemented\n");
1977   return E_FAIL;
1978 }
1979
1980 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
1981     ITypeLib* This,
1982     LPOLESTR szNameBuf,
1983     ULONG lHashVal,
1984     ITypeInfo** ppTInfo,
1985     MEMBERID* rgMemId,
1986     USHORT* pcFound,
1987     BSTR* pBstrLibName)
1988 {
1989   FIXME("not implemented\n");
1990   return E_FAIL;
1991 }
1992
1993 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
1994     ITypeLib* This,
1995     TLIBATTR* pTLibAttr)
1996 {
1997     TRACE("(%p, %p)\n", This, pTLibAttr);
1998     CoTaskMemFree(pTLibAttr);
1999 }
2000
2001 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
2002     ITypeLib* This)
2003 {
2004     TRACE("nothing to do\n");
2005     return S_OK;
2006 }
2007
2008
2009 /* ITypeLib2 */
2010
2011 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
2012     ITypeLib2* This,
2013     ULONG* pcUniqueNames,
2014     ULONG* pcchUniqueNames)
2015 {
2016   FIXME("not implemented\n");
2017   return E_FAIL;
2018 }
2019
2020 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
2021     ITypeLib2* This,
2022     ULONG* pcUniqueNames,
2023     ULONG* pcchUniqueNames)
2024 {
2025   FIXME("not implemented\n");
2026   return E_FAIL;
2027 }
2028
2029 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(
2030     ITypeLib2* This,
2031     INT index,
2032     LCID lcid,
2033     BSTR* pbstrHelpString,
2034     DWORD* pdwHelpStringContext,
2035     BSTR* pbstrHelpStringDll)
2036 {
2037   FIXME("not implemented\n");
2038   return E_FAIL;
2039 }
2040
2041 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(
2042     ITypeLib2* This,
2043     INT index,
2044     LCID lcid,
2045     DWORD refPtrFlags,
2046     BSTR* pbstrHelpString,
2047     DWORD* pdwHelpStringContext,
2048     BSTR* pbstrHelpStringDll)
2049 {
2050   FIXME("not implemented\n");
2051   return E_FAIL;
2052 }
2053
2054 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2055     IPropertyBag* This,
2056     LPCOLESTR pszPropName,
2057     VARIANT *pVar,
2058     IErrorLog *pErrorLog)
2059 {
2060   IUnknown *pUnk = NULL;
2061   TRACE("(%p, %s, %p, %p)\n", This, debugstr_w(pszPropName), pVar, pErrorLog);
2062
2063   if(!pVar)
2064     return E_POINTER;
2065
2066   if(V_VT(pVar) & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2067   {
2068     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2069     return E_NOTIMPL;
2070   }
2071
2072   switch(V_VT(pVar))
2073   {
2074     case VT_DISPATCH:
2075       pUnk = (IUnknown*)V_DISPATCH(pVar);
2076       break;
2077     case VT_UNKNOWN:
2078       pUnk = V_UNKNOWN(pVar);
2079       break;
2080     case VT_SAFEARRAY:
2081       FIXME("Safearray support not yet implemented.\n");
2082       return E_NOTIMPL;
2083     default:
2084       FIXME("Unknown V_VT %d - support not yet implemented.\n", V_VT(pVar));
2085       return E_NOTIMPL;
2086   }
2087
2088   return IPropertyBag_RemoteRead_Proxy(This, pszPropName, pVar, pErrorLog,
2089                                        V_VT(pVar), pUnk);
2090 }
2091
2092 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2093     IPropertyBag* This,
2094     LPCOLESTR pszPropName,
2095     VARIANT *pVar,
2096     IErrorLog *pErrorLog,
2097     DWORD varType,
2098     IUnknown *pUnkObj)
2099 {
2100   static const WCHAR emptyWstr[1] = {0};
2101   IDispatch *disp;
2102   HRESULT hr;
2103   TRACE("(%p, %s, %p, %p, %x, %p)\n", This, debugstr_w(pszPropName), pVar,
2104                                      pErrorLog, varType, pUnkObj);
2105
2106   if(varType & (VT_BYREF | VT_ARRAY | VT_VECTOR))
2107   {
2108     FIXME("Variant type %x is byref, array or vector. Not implemented.\n", V_VT(pVar));
2109     return E_NOTIMPL;
2110   }
2111
2112   V_VT(pVar) = varType;
2113   switch(varType)
2114   {
2115     case VT_DISPATCH:
2116       hr = IUnknown_QueryInterface(pUnkObj, &IID_IDispatch, (LPVOID*)&disp);
2117       if(FAILED(hr))
2118         return hr;
2119       IUnknown_Release(pUnkObj);
2120       V_DISPATCH(pVar) = disp;
2121       break;
2122     case VT_UNKNOWN:
2123       V_UNKNOWN(pVar) = pUnkObj;
2124       break;
2125     case VT_BSTR:
2126       V_BSTR(pVar) = SysAllocString(emptyWstr);
2127       break;
2128     case VT_SAFEARRAY:
2129       FIXME("Safearray support not yet implemented.\n");
2130       return E_NOTIMPL;
2131     default:
2132       break;
2133   }
2134   hr = IPropertyBag_Read(This, pszPropName, pVar, pErrorLog);
2135   if(FAILED(hr))
2136     VariantClear(pVar);
2137
2138   return hr;
2139 }
2140
2141 /* call_as/local stubs for ocidl.idl */
2142
2143 HRESULT CALLBACK IClassFactory2_CreateInstanceLic_Proxy(
2144     IClassFactory2* This,
2145     IUnknown *pUnkOuter,
2146     IUnknown *pUnkReserved,
2147     REFIID riid,
2148     BSTR bstrKey,
2149     PVOID *ppvObj)
2150 {
2151     FIXME("not implemented\n");
2152     return E_NOTIMPL;
2153 }
2154
2155 HRESULT __RPC_STUB IClassFactory2_CreateInstanceLic_Stub(
2156     IClassFactory2* This,
2157     REFIID riid,
2158     BSTR bstrKey,
2159     IUnknown **ppvObj)
2160 {
2161     FIXME("not implemented\n");
2162     return E_NOTIMPL;
2163 }
2164
2165 HRESULT CALLBACK IEnumConnections_Next_Proxy(
2166     IEnumConnections* This,
2167     ULONG cConnections,
2168     LPCONNECTDATA rgcd,
2169     ULONG *pcFetched)
2170 {
2171     FIXME("not implemented\n");
2172     return E_NOTIMPL;
2173 }
2174
2175 HRESULT __RPC_STUB IEnumConnections_Next_Stub(
2176     IEnumConnections* This,
2177     ULONG cConnections,
2178     LPCONNECTDATA rgcd,
2179     ULONG *pcFetched)
2180 {
2181     FIXME("not implemented\n");
2182     return E_NOTIMPL;
2183 }
2184
2185 HRESULT CALLBACK IEnumConnectionPoints_Next_Proxy(
2186     IEnumConnectionPoints* This,
2187     ULONG cConnections,
2188     LPCONNECTIONPOINT *ppCP,
2189     ULONG *pcFetched)
2190 {
2191     FIXME("not implemented\n");
2192     return E_NOTIMPL;
2193 }
2194
2195 HRESULT __RPC_STUB IEnumConnectionPoints_Next_Stub(
2196     IEnumConnectionPoints* This,
2197     ULONG cConnections,
2198     LPCONNECTIONPOINT *ppCP,
2199     ULONG *pcFetched)
2200 {
2201     FIXME("not implemented\n");
2202     return E_NOTIMPL;
2203 }
2204
2205 HRESULT CALLBACK IPersistMemory_Load_Proxy(
2206     IPersistMemory* This,
2207     LPVOID pMem,
2208     ULONG cbSize)
2209 {
2210     FIXME("not implemented\n");
2211     return E_NOTIMPL;
2212 }
2213
2214 HRESULT __RPC_STUB IPersistMemory_Load_Stub(
2215     IPersistMemory* This,
2216     BYTE *pMem,
2217     ULONG cbSize)
2218 {
2219     FIXME("not implemented\n");
2220     return E_NOTIMPL;
2221 }
2222
2223 HRESULT CALLBACK IPersistMemory_Save_Proxy(
2224     IPersistMemory* This,
2225     LPVOID pMem,
2226     BOOL fClearDirty,
2227     ULONG cbSize)
2228 {
2229     FIXME("not implemented\n");
2230     return E_NOTIMPL;
2231 }
2232
2233 HRESULT __RPC_STUB IPersistMemory_Save_Stub(
2234     IPersistMemory* This,
2235     BYTE *pMem,
2236     BOOL fClearDirty,
2237     ULONG cbSize)
2238 {
2239     FIXME("not implemented\n");
2240     return E_NOTIMPL;
2241 }
2242
2243 void CALLBACK IAdviseSinkEx_OnViewStatusChange_Proxy(
2244     IAdviseSinkEx* This,
2245     DWORD dwViewStatus)
2246 {
2247     FIXME("not implemented\n");
2248 }
2249
2250 HRESULT __RPC_STUB IAdviseSinkEx_OnViewStatusChange_Stub(
2251     IAdviseSinkEx* This,
2252     DWORD dwViewStatus)
2253 {
2254     FIXME("not implemented\n");
2255     return E_NOTIMPL;
2256 }
2257
2258 HRESULT CALLBACK IEnumOleUndoUnits_Next_Proxy(
2259     IEnumOleUndoUnits* This,
2260     ULONG cElt,
2261     IOleUndoUnit **rgElt,
2262     ULONG *pcEltFetched)
2263 {
2264     FIXME("not implemented\n");
2265     return E_NOTIMPL;
2266 }
2267
2268 HRESULT __RPC_STUB IEnumOleUndoUnits_Next_Stub(
2269     IEnumOleUndoUnits* This,
2270     ULONG cElt,
2271     IOleUndoUnit **rgElt,
2272     ULONG *pcEltFetched)
2273 {
2274     FIXME("not implemented\n");
2275     return E_NOTIMPL;
2276 }
2277
2278 HRESULT CALLBACK IQuickActivate_QuickActivate_Proxy(
2279     IQuickActivate* This,
2280     QACONTAINER *pQaContainer,
2281     QACONTROL *pQaControl)
2282 {
2283     FIXME("not implemented\n");
2284     return E_NOTIMPL;
2285 }
2286
2287 HRESULT __RPC_STUB IQuickActivate_QuickActivate_Stub(
2288     IQuickActivate* This,
2289     QACONTAINER *pQaContainer,
2290     QACONTROL *pQaControl)
2291 {
2292     FIXME("not implemented\n");
2293     return E_NOTIMPL;
2294 }