git.oblomov.eu Git - wine/blob - dlls/oleaut32/usrmarshal.c

   1 /*
   2  * Misc marshalling routines
   3  *
   4  * Copyright 2002 Ove Kaaven
   5  * Copyright 2003 Mike Hearn
   6  *
   7  * This library is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU Lesser General Public
   9  * License as published by the Free Software Foundation; either
  10  * version 2.1 of the License, or (at your option) any later version.
  11  *
  12  * This library is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * Lesser General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Lesser General Public
  18  * License along with this library; if not, write to the Free Software
  19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
  20  */
  21
  22 #include <stdarg.h>
  23 #include <string.h>
  24
  25 #define COBJMACROS
  26 #define NONAMELESSUNION
  27 #define NONAMELESSSTRUCT
  28
  29 #include "windef.h"
  30 #include "winbase.h"
  31 #include "wingdi.h"
  32 #include "winuser.h"
  33 #include "winerror.h"
  34
  35 #include "ole2.h"
  36 #include "oleauto.h"
  37 #include "rpcproxy.h"
  38 #include "typelib.h"
  39 #include "wine/debug.h"
  40
  41 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  42
  43 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
  44 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
  45 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
  46 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
  47
  48 static CStdPSFactoryBuffer PSFactoryBuffer;
  49
  50 CSTDSTUBBUFFERRELEASE(&PSFactoryBuffer)
  51
  52 extern const ExtendedProxyFileInfo oleaut32_oaidl_ProxyFileInfo;
  53
  54 static const ProxyFileInfo *OLEAUT32_ProxyFileList[] = {
  55   &oleaut32_oaidl_ProxyFileInfo,
  56   NULL
  57 };
  58
  59 HRESULT OLEAUTPS_DllGetClassObject(REFCLSID rclsid, REFIID riid, LPVOID *ppv)
  60 {
  61   return NdrDllGetClassObject(rclsid, riid, ppv, OLEAUT32_ProxyFileList,
  62                               &CLSID_PSDispatch, &PSFactoryBuffer);
  63 }
  64
  65 static void dump_user_flags(const ULONG *pFlags)
  66 {
  67     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
  68         TRACE("MAKELONG(NDR_LOCAL_REPRESENTATION, ");
  69     else
  70         TRACE("MAKELONG(0x%04x, ", HIWORD(*pFlags));
  71     switch (LOWORD(*pFlags))
  72     {
  73         case MSHCTX_LOCAL: TRACE("MSHCTX_LOCAL)"); break;
  74         case MSHCTX_NOSHAREDMEM: TRACE("MSHCTX_NOSHAREDMEM)"); break;
  75         case MSHCTX_DIFFERENTMACHINE: TRACE("MSHCTX_DIFFERENTMACHINE)"); break;
  76         case MSHCTX_INPROC: TRACE("MSHCTX_INPROC)"); break;
  77         default: TRACE("%d)", LOWORD(*pFlags));
  78     }
  79 }
  80
  81 /* CLEANLOCALSTORAGE */
  82
  83 #define CLS_FUNCDESC  'f'
  84 #define CLS_LIBATTR   'l'
  85 #define CLS_TYPEATTR  't'
  86 #define CLS_VARDESC   'v'
  87
  88 ULONG WINAPI CLEANLOCALSTORAGE_UserSize(ULONG *pFlags, ULONG Start, CLEANLOCALSTORAGE *pstg)
  89 {
  90     ALIGN_LENGTH(Start, 3);
  91     return Start + sizeof(DWORD);
  92 }
  93
  94 unsigned char * WINAPI CLEANLOCALSTORAGE_UserMarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstg)
  95 {
  96     ALIGN_POINTER(Buffer, 3);
  97     *(DWORD*)Buffer = pstg->flags;
  98     switch(pstg->flags)
  99     {
 100     case CLS_LIBATTR:
 101         ITypeLib_ReleaseTLibAttr((ITypeLib*)pstg->pInterface, *(TLIBATTR**)pstg->pStorage);
 102         break;
 103     case CLS_TYPEATTR:
 104         ITypeInfo_ReleaseTypeAttr((ITypeInfo*)pstg->pInterface, *(TYPEATTR**)pstg->pStorage);
 105         break;
 106     case CLS_FUNCDESC:
 107         ITypeInfo_ReleaseFuncDesc((ITypeInfo*)pstg->pInterface, *(FUNCDESC**)pstg->pStorage);
 108         break;
 109     case CLS_VARDESC:
 110         ITypeInfo_ReleaseVarDesc((ITypeInfo*)pstg->pInterface, *(VARDESC**)pstg->pStorage);
 111         break;
 112
 113     default:
 114         ERR("Unknown type %x\n", pstg->flags);
 115     }
 116
 117     *(VOID**)pstg->pStorage = NULL;
 118     IUnknown_Release(pstg->pInterface);
 119     pstg->pInterface = NULL;
 120
 121     return Buffer + sizeof(DWORD);
 122 }
 123
 124 unsigned char * WINAPI CLEANLOCALSTORAGE_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, CLEANLOCALSTORAGE *pstr)
 125 {
 126     ALIGN_POINTER(Buffer, 3);
 127     pstr->flags = *(DWORD*)Buffer;
 128     return Buffer + sizeof(DWORD);
 129 }
 130
 131 void WINAPI CLEANLOCALSTORAGE_UserFree(ULONG *pFlags, CLEANLOCALSTORAGE *pstr)
 132 {
 133     /* Nothing to do */
 134 }
 135
 136 /* BSTR */
 137
 138 typedef struct
 139 {
 140     DWORD len;          /* No. of chars not including trailing '\0' */
 141     DWORD byte_len;     /* len * 2 or 0xffffffff if len == 0 */
 142     DWORD len2;         /* == len */
 143 } bstr_wire_t;
 144
 145 ULONG WINAPI BSTR_UserSize(ULONG *pFlags, ULONG Start, BSTR *pstr)
 146 {
 147     TRACE("(%x,%d,%p) => %p\n", *pFlags, Start, pstr, *pstr);
 148     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 149     ALIGN_LENGTH(Start, 3);
 150     Start += sizeof(bstr_wire_t) + ((SysStringByteLen(*pstr) + 1) & ~1);
 151     TRACE("returning %d\n", Start);
 152     return Start;
 153 }
 154
 155 unsigned char * WINAPI BSTR_UserMarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 156 {
 157     bstr_wire_t *header;
 158     DWORD len = SysStringByteLen(*pstr);
 159
 160     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 161     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 162
 163     ALIGN_POINTER(Buffer, 3);
 164     header = (bstr_wire_t*)Buffer;
 165     header->len = header->len2 = (len + 1) / 2;
 166     if (*pstr)
 167     {
 168         header->byte_len = len;
 169         memcpy(header + 1, *pstr, header->len * 2);
 170     }
 171     else
 172         header->byte_len = 0xffffffff; /* special case for a null bstr */
 173
 174     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 175 }
 176
 177 unsigned char * WINAPI BSTR_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, BSTR *pstr)
 178 {
 179     bstr_wire_t *header;
 180     TRACE("(%x,%p,%p) => %p\n", *pFlags, Buffer, pstr, *pstr);
 181
 182     ALIGN_POINTER(Buffer, 3);
 183     header = (bstr_wire_t*)Buffer;
 184     if(header->len != header->len2)
 185         FIXME("len %08x != len2 %08x\n", header->len, header->len2);
 186
 187     if(*pstr)
 188     {
 189         SysFreeString(*pstr);
 190         *pstr = NULL;
 191     }
 192
 193     if(header->byte_len != 0xffffffff)
 194         *pstr = SysAllocStringByteLen((char*)(header + 1), header->byte_len);
 195
 196     if (*pstr) TRACE("string=%s\n", debugstr_w(*pstr));
 197     return Buffer + sizeof(*header) + sizeof(OLECHAR) * header->len;
 198 }
 199
 200 void WINAPI BSTR_UserFree(ULONG *pFlags, BSTR *pstr)
 201 {
 202     TRACE("(%x,%p) => %p\n", *pFlags, pstr, *pstr);
 203     if (*pstr)
 204     {
 205         SysFreeString(*pstr);
 206         *pstr = NULL;
 207     }
 208 }
 209
 210 /* VARIANT */
 211
 212 typedef struct
 213 {
 214     DWORD clSize;
 215     DWORD rpcReserverd;
 216     USHORT vt;
 217     USHORT wReserved1;
 218     USHORT wReserved2;
 219     USHORT wReserved3;
 220     DWORD switch_is;
 221 } variant_wire_t;
 222
 223 static unsigned int get_type_size(ULONG *pFlags, VARTYPE vt)
 224 {
 225     if (vt & VT_ARRAY) return 4;
 226
 227     switch (vt & ~VT_BYREF) {
 228     case VT_EMPTY:
 229     case VT_NULL:
 230         return 0;
 231     case VT_I1:
 232     case VT_UI1:
 233         return sizeof(CHAR);
 234     case VT_I2:
 235     case VT_UI2:
 236         return sizeof(SHORT);
 237     case VT_I4:
 238     case VT_UI4:
 239         return sizeof(LONG);
 240     case VT_INT:
 241     case VT_UINT:
 242         return sizeof(INT);
 243     case VT_R4:
 244         return sizeof(FLOAT);
 245     case VT_R8:
 246         return sizeof(DOUBLE);
 247     case VT_BOOL:
 248         return sizeof(VARIANT_BOOL);
 249     case VT_ERROR:
 250         return sizeof(SCODE);
 251     case VT_DATE:
 252         return sizeof(DATE);
 253     case VT_CY:
 254         return sizeof(CY);
 255     case VT_DECIMAL:
 256         return sizeof(DECIMAL);
 257     case VT_BSTR:
 258         return sizeof(BSTR);
 259     case VT_VARIANT:
 260         return sizeof(VARIANT);
 261     case VT_UNKNOWN:
 262     case VT_DISPATCH:
 263     case VT_RECORD:
 264         return 0;
 265     default:
 266         FIXME("unhandled VT %d\n", vt);
 267         return 0;
 268     }
 269 }
 270
 271 static unsigned int get_type_alignment(ULONG *pFlags, VARTYPE vt)
 272 {
 273     unsigned int size = get_type_size(pFlags, vt);
 274     if(vt & VT_BYREF) return 3;
 275     if(size == 0) return 0;
 276     if(size <= 4) return size - 1;
 277     return 7;
 278 }
 279
 280 static unsigned interface_variant_size(const ULONG *pFlags, REFIID riid, IUnknown *punk)
 281 {
 282   ULONG size;
 283   HRESULT hr;
 284   /* find the buffer size of the marshalled dispatch interface */
 285   hr = CoGetMarshalSizeMax(&size, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 286   if (FAILED(hr)) {
 287     if (!punk)
 288       WARN("NULL dispatch pointer\n");
 289     else
 290       ERR("Dispatch variant buffer size calculation failed, HRESULT=0x%x\n", hr);
 291     return 0;
 292   }
 293   size += sizeof(ULONG); /* we have to store the buffersize in the stream */
 294   TRACE("wire-size extra of dispatch variant is %d\n", size);
 295   return size;
 296 }
 297
 298 static ULONG wire_extra_user_size(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 299 {
 300   if (V_ISARRAY(pvar))
 301   {
 302     if (V_ISBYREF(pvar))
 303       return LPSAFEARRAY_UserSize(pFlags, Start, V_ARRAYREF(pvar));
 304     else
 305       return LPSAFEARRAY_UserSize(pFlags, Start, &V_ARRAY(pvar));
 306   }
 307
 308   switch (V_VT(pvar)) {
 309   case VT_BSTR:
 310     return BSTR_UserSize(pFlags, Start, &V_BSTR(pvar));
 311   case VT_BSTR | VT_BYREF:
 312     return BSTR_UserSize(pFlags, Start, V_BSTRREF(pvar));
 313   case VT_VARIANT | VT_BYREF:
 314     return VARIANT_UserSize(pFlags, Start, V_VARIANTREF(pvar));
 315   case VT_UNKNOWN:
 316     return Start + interface_variant_size(pFlags, &IID_IUnknown, V_UNKNOWN(pvar));
 317   case VT_UNKNOWN | VT_BYREF:
 318     return Start + interface_variant_size(pFlags, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 319   case VT_DISPATCH:
 320     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 321   case VT_DISPATCH | VT_BYREF:
 322     return Start + interface_variant_size(pFlags, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 323   case VT_RECORD:
 324     FIXME("wire-size record\n");
 325     return Start;
 326   case VT_SAFEARRAY:
 327   case VT_SAFEARRAY | VT_BYREF:
 328     FIXME("wire-size safearray: shouldn't be marshaling this\n");
 329     return Start;
 330   default:
 331     return Start;
 332   }
 333 }
 334
 335 /* helper: called for VT_DISPATCH variants to marshal the IDispatch* into the buffer. returns Buffer on failure, new position otherwise */
 336 static unsigned char* interface_variant_marshal(const ULONG *pFlags, unsigned char *Buffer,
 337                                                 REFIID riid, IUnknown *punk)
 338 {
 339   IStream *working;
 340   HGLOBAL working_mem;
 341   void *working_memlocked;
 342   unsigned char *oldpos;
 343   ULONG size;
 344   HRESULT hr;
 345
 346   TRACE("pFlags=%d, Buffer=%p, pUnk=%p\n", *pFlags, Buffer, punk);
 347
 348   oldpos = Buffer;
 349
 350   /* CoMarshalInterface needs a stream, whereas at this level we are operating in terms of buffers.
 351    * We create a stream on an HGLOBAL, so we can simply do a memcpy to move it to the buffer.
 352    * in rpcrt4/ndr_ole.c, a simple IStream implementation is wrapped around the buffer object,
 353    * but that would be overkill here, hence this implementation. We save the size because the unmarshal
 354    * code has no way to know how long the marshalled buffer is. */
 355
 356   size = interface_variant_size(pFlags, riid, punk);
 357
 358   working_mem = GlobalAlloc(0, size);
 359   if (!working_mem) return oldpos;
 360
 361   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 362   if (hr != S_OK) {
 363     GlobalFree(working_mem);
 364     return oldpos;
 365   }
 366
 367   hr = CoMarshalInterface(working, riid, punk, LOWORD(*pFlags), NULL, MSHLFLAGS_NORMAL);
 368   if (hr != S_OK) {
 369     IStream_Release(working); /* this also releases the hglobal */
 370     return oldpos;
 371   }
 372
 373   working_memlocked = GlobalLock(working_mem);
 374   memcpy(Buffer, &size, sizeof(ULONG)); /* copy the buffersize */
 375   memcpy(Buffer + sizeof(ULONG), working_memlocked, size - sizeof(ULONG));
 376   GlobalUnlock(working_mem);
 377
 378   IStream_Release(working);
 379
 380   /* size includes the ULONG for the size written above */
 381   TRACE("done, size=%d\n", size);
 382   return Buffer + size;
 383 }
 384
 385 /* helper: called for VT_DISPATCH / VT_UNKNOWN variants to unmarshal the buffer. returns Buffer on failure, new position otherwise */
 386 static unsigned char *interface_variant_unmarshal(const ULONG *pFlags, unsigned char *Buffer,
 387                                                   REFIID riid, IUnknown **ppunk)
 388 {
 389   IStream *working;
 390   HGLOBAL working_mem;
 391   void *working_memlocked;
 392   unsigned char *oldpos;
 393   ULONG size;
 394   HRESULT hr;
 395
 396   TRACE("pFlags=%d, Buffer=%p, ppUnk=%p\n", *pFlags, Buffer, ppunk);
 397
 398   oldpos = Buffer;
 399
 400   /* get the buffersize */
 401   memcpy(&size, Buffer, sizeof(ULONG));
 402   TRACE("buffersize=%d\n", size);
 403
 404   working_mem = GlobalAlloc(0, size);
 405   if (!working_mem) return oldpos;
 406
 407   hr = CreateStreamOnHGlobal(working_mem, TRUE, &working);
 408   if (hr != S_OK) {
 409     GlobalFree(working_mem);
 410     return oldpos;
 411   }
 412
 413   working_memlocked = GlobalLock(working_mem);
 414
 415   /* now we copy the contents of the marshalling buffer to working_memlocked, unlock it, and demarshal the stream */
 416   memcpy(working_memlocked, Buffer + sizeof(ULONG), size);
 417   GlobalUnlock(working_mem);
 418
 419   hr = CoUnmarshalInterface(working, riid, (void**)ppunk);
 420   if (hr != S_OK) {
 421     IStream_Release(working);
 422     return oldpos;
 423   }
 424
 425   IStream_Release(working); /* this also frees the underlying hglobal */
 426
 427   /* size includes the ULONG for the size written above */
 428   TRACE("done, processed=%d bytes\n", size);
 429   return Buffer + size;
 430 }
 431
 432
 433 ULONG WINAPI VARIANT_UserSize(ULONG *pFlags, ULONG Start, VARIANT *pvar)
 434 {
 435     int align;
 436     TRACE("(%x,%d,%p)\n", *pFlags, Start, pvar);
 437     TRACE("vt=%04x\n", V_VT(pvar));
 438
 439     ALIGN_LENGTH(Start, 7);
 440     Start += sizeof(variant_wire_t);
 441     if(V_VT(pvar) & VT_BYREF)
 442         Start += 4;
 443
 444     align = get_type_alignment(pFlags, V_VT(pvar));
 445     ALIGN_LENGTH(Start, align);
 446     if(V_VT(pvar) == (VT_VARIANT | VT_BYREF))
 447         Start += 4;
 448     else
 449         Start += get_type_size(pFlags, V_VT(pvar));
 450     Start = wire_extra_user_size(pFlags, Start, pvar);
 451
 452     TRACE("returning %d\n", Start);
 453     return Start;
 454 }
 455
 456 unsigned char * WINAPI VARIANT_UserMarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 457 {
 458     variant_wire_t *header;
 459     ULONG type_size;
 460     int align;
 461     unsigned char *Pos;
 462
 463     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 464     TRACE("vt=%04x\n", V_VT(pvar));
 465
 466     ALIGN_POINTER(Buffer, 7);
 467
 468     header = (variant_wire_t *)Buffer;
 469
 470     header->clSize = 0; /* fixed up at the end */
 471     header->rpcReserverd = 0;
 472     header->vt = pvar->n1.n2.vt;
 473     header->wReserved1 = pvar->n1.n2.wReserved1;
 474     header->wReserved2 = pvar->n1.n2.wReserved2;
 475     header->wReserved3 = pvar->n1.n2.wReserved3;
 476     header->switch_is = pvar->n1.n2.vt;
 477     if(header->switch_is & VT_ARRAY)
 478         header->switch_is &= ~VT_TYPEMASK;
 479
 480     Pos = (unsigned char*)(header + 1);
 481     type_size = get_type_size(pFlags, V_VT(pvar));
 482     align = get_type_alignment(pFlags, V_VT(pvar));
 483     ALIGN_POINTER(Pos, align);
 484
 485     if(header->vt & VT_BYREF)
 486     {
 487         *(DWORD *)Pos = max(type_size, 4);
 488         Pos += 4;
 489         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 490         {
 491             memcpy(Pos, pvar->n1.n2.n3.byref, type_size);
 492             Pos += type_size;
 493         }
 494         else
 495         {
 496             *(DWORD*)Pos = 'U' | 's' << 8 | 'e' << 16 | 'r' << 24;
 497             Pos += 4;
 498         }
 499     }
 500     else
 501     {
 502         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 503             memcpy(Pos, pvar, type_size);
 504         else
 505             memcpy(Pos, &pvar->n1.n2.n3, type_size);
 506         Pos += type_size;
 507     }
 508
 509     if(header->vt & VT_ARRAY)
 510     {
 511         if(header->vt & VT_BYREF)
 512             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, V_ARRAYREF(pvar));
 513         else
 514             Pos = LPSAFEARRAY_UserMarshal(pFlags, Pos, &V_ARRAY(pvar));
 515     }
 516     else
 517     {
 518         switch (header->vt)
 519         {
 520         case VT_BSTR:
 521             Pos = BSTR_UserMarshal(pFlags, Pos, &V_BSTR(pvar));
 522             break;
 523         case VT_BSTR | VT_BYREF:
 524             Pos = BSTR_UserMarshal(pFlags, Pos, V_BSTRREF(pvar));
 525             break;
 526         case VT_VARIANT | VT_BYREF:
 527             Pos = VARIANT_UserMarshal(pFlags, Pos, V_VARIANTREF(pvar));
 528             break;
 529         case VT_UNKNOWN:
 530             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 531             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWN(pvar));
 532             break;
 533         case VT_UNKNOWN | VT_BYREF:
 534             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 535             Pos = interface_variant_marshal(pFlags, Pos, &IID_IUnknown, *V_UNKNOWNREF(pvar));
 536             break;
 537         case VT_DISPATCH:
 538             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 539             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)V_DISPATCH(pvar));
 540             break;
 541         case VT_DISPATCH | VT_BYREF:
 542             /* this should probably call WdtpInterfacePointer_UserMarshal in ole32.dll */
 543             Pos = interface_variant_marshal(pFlags, Pos, &IID_IDispatch, (IUnknown*)*V_DISPATCHREF(pvar));
 544             break;
 545         case VT_RECORD:
 546             FIXME("handle BRECORD by val\n");
 547             break;
 548         case VT_RECORD | VT_BYREF:
 549             FIXME("handle BRECORD by ref\n");
 550             break;
 551         }
 552     }
 553     header->clSize = ((Pos - Buffer) + 7) >> 3;
 554     TRACE("marshalled size=%d\n", header->clSize);
 555     return Pos;
 556 }
 557
 558 unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, VARIANT *pvar)
 559 {
 560     variant_wire_t *header;
 561     ULONG type_size;
 562     int align;
 563     unsigned char *Pos;
 564
 565     TRACE("(%x,%p,%p)\n", *pFlags, Buffer, pvar);
 566
 567     ALIGN_POINTER(Buffer, 7);
 568
 569     header = (variant_wire_t *)Buffer;
 570
 571     Pos = (unsigned char*)(header + 1);
 572     type_size = get_type_size(pFlags, header->vt);
 573     align = get_type_alignment(pFlags, header->vt);
 574     ALIGN_POINTER(Pos, align);
 575
 576     if(header->vt & VT_BYREF)
 577     {
 578         Pos += 4;
 579         if (V_VT(pvar) != header->vt)
 580         {
 581             VariantClear(pvar);
 582             V_BYREF(pvar) = CoTaskMemAlloc(type_size);
 583         }
 584         else if (!V_BYREF(pvar))
 585             V_BYREF(pvar) = CoTaskMemAlloc(type_size);
 586         memcpy(V_BYREF(pvar), Pos, type_size);
 587         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
 588             Pos += type_size;
 589         else
 590             Pos += 4;
 591     }
 592     else
 593     {
 594         VariantClear(pvar);
 595         if((header->vt & VT_TYPEMASK) == VT_DECIMAL)
 596             memcpy(pvar, Pos, type_size);
 597         else
 598             memcpy(&pvar->n1.n2.n3, Pos, type_size);
 599         Pos += type_size;
 600     }
 601
 602     pvar->n1.n2.vt = header->vt;
 603     pvar->n1.n2.wReserved1 = header->wReserved1;
 604     pvar->n1.n2.wReserved2 = header->wReserved2;
 605     pvar->n1.n2.wReserved3 = header->wReserved3;
 606
 607     if(header->vt & VT_ARRAY)
 608     {
 609         if(header->vt & VT_BYREF)
 610             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, V_ARRAYREF(pvar));
 611         else
 612             Pos = LPSAFEARRAY_UserUnmarshal(pFlags, Pos, &V_ARRAY(pvar));
 613     }
 614     else
 615     {
 616         switch (header->vt)
 617         {
 618         case VT_BSTR:
 619             V_BSTR(pvar) = NULL;
 620             Pos = BSTR_UserUnmarshal(pFlags, Pos, &V_BSTR(pvar));
 621             break;
 622         case VT_BSTR | VT_BYREF:
 623             *V_BSTRREF(pvar) = NULL;
 624             Pos = BSTR_UserUnmarshal(pFlags, Pos, V_BSTRREF(pvar));
 625             break;
 626         case VT_VARIANT | VT_BYREF:
 627             Pos = VARIANT_UserUnmarshal(pFlags, Pos, V_VARIANTREF(pvar));
 628             break;
 629         case VT_UNKNOWN:
 630             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 631             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, &V_UNKNOWN(pvar));
 632             break;
 633         case VT_UNKNOWN | VT_BYREF:
 634             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 635             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IUnknown, V_UNKNOWNREF(pvar));
 636             break;
 637         case VT_DISPATCH:
 638             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 639             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)&V_DISPATCH(pvar));
 640             break;
 641         case VT_DISPATCH | VT_BYREF:
 642             /* this should probably call WdtpInterfacePointer_UserUnmarshal in ole32.dll */
 643             Pos = interface_variant_unmarshal(pFlags, Pos, &IID_IDispatch, (IUnknown**)V_DISPATCHREF(pvar));
 644             break;
 645         case VT_RECORD:
 646             FIXME("handle BRECORD by val\n");
 647             break;
 648         case VT_RECORD | VT_BYREF:
 649             FIXME("handle BRECORD by ref\n");
 650             break;
 651         }
 652     }
 653     return Pos;
 654 }
 655
 656 void WINAPI VARIANT_UserFree(ULONG *pFlags, VARIANT *pvar)
 657 {
 658   VARTYPE vt = V_VT(pvar);
 659   PVOID ref = NULL;
 660
 661   TRACE("(%x,%p)\n", *pFlags, pvar);
 662   TRACE("vt=%04x\n", V_VT(pvar));
 663
 664   if (vt & VT_BYREF) ref = pvar->n1.n2.n3.byref;
 665
 666   VariantClear(pvar);
 667   if (!ref) return;
 668
 669   if(vt & VT_ARRAY)
 670   {
 671     if (vt & VT_BYREF)
 672       LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
 673     else
 674       LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
 675   }
 676   else
 677   {
 678     switch (vt)
 679     {
 680     case VT_BSTR | VT_BYREF:
 681       BSTR_UserFree(pFlags, V_BSTRREF(pvar));
 682       break;
 683     case VT_VARIANT | VT_BYREF:
 684       VARIANT_UserFree(pFlags, V_VARIANTREF(pvar));
 685       break;
 686     case VT_RECORD | VT_BYREF:
 687       FIXME("handle BRECORD by ref\n");
 688       break;
 689     case VT_UNKNOWN | VT_BYREF:
 690     case VT_DISPATCH | VT_BYREF:
 691       IUnknown_Release(*V_UNKNOWNREF(pvar));
 692       break;
 693     }
 694   }
 695
 696   CoTaskMemFree(ref);
 697 }
 698
 699 /* LPSAFEARRAY */
 700
 701 /* Get the number of cells in a SafeArray */
 702 static ULONG SAFEARRAY_GetCellCount(const SAFEARRAY *psa)
 703 {
 704     const SAFEARRAYBOUND* psab = psa->rgsabound;
 705     USHORT cCount = psa->cDims;
 706     ULONG ulNumCells = 1;
 707
 708     while (cCount--)
 709     {
 710         /* This is a valid bordercase. See testcases. -Marcus */
 711         if (!psab->cElements)
 712             return 0;
 713         ulNumCells *= psab->cElements;
 714         psab++;
 715     }
 716     return ulNumCells;
 717 }
 718
 719 static inline SF_TYPE SAFEARRAY_GetUnionType(SAFEARRAY *psa)
 720 {
 721     VARTYPE vt;
 722     HRESULT hr;
 723
 724     hr = SafeArrayGetVartype(psa, &vt);
 725     if (FAILED(hr))
 726     {
 727         if(psa->fFeatures & FADF_VARIANT) return SF_VARIANT;
 728
 729         switch(psa->cbElements)
 730         {
 731         case 1: vt = VT_I1; break;
 732         case 2: vt = VT_I2; break;
 733         case 4: vt = VT_I4; break;
 734         case 8: vt = VT_I8; break;
 735         default:
 736             RpcRaiseException(hr);
 737         }
 738     }
 739
 740     if (psa->fFeatures & FADF_HAVEIID)
 741         return SF_HAVEIID;
 742
 743     switch (vt)
 744     {
 745     case VT_I1:
 746     case VT_UI1:      return SF_I1;
 747     case VT_BOOL:
 748     case VT_I2:
 749     case VT_UI2:      return SF_I2;
 750     case VT_INT:
 751     case VT_UINT:
 752     case VT_I4:
 753     case VT_UI4:
 754     case VT_R4:       return SF_I4;
 755     case VT_DATE:
 756     case VT_CY:
 757     case VT_R8:
 758     case VT_I8:
 759     case VT_UI8:      return SF_I8;
 760     case VT_INT_PTR:
 761     case VT_UINT_PTR: return (sizeof(UINT_PTR) == 4 ? SF_I4 : SF_I8);
 762     case VT_BSTR:     return SF_BSTR;
 763     case VT_DISPATCH: return SF_DISPATCH;
 764     case VT_VARIANT:  return SF_VARIANT;
 765     case VT_UNKNOWN:  return SF_UNKNOWN;
 766     /* Note: Return a non-zero size to indicate vt is valid. The actual size
 767      * of a UDT is taken from the result of IRecordInfo_GetSize().
 768      */
 769     case VT_RECORD:   return SF_RECORD;
 770     default:          return SF_ERROR;
 771     }
 772 }
 773
 774 ULONG WINAPI LPSAFEARRAY_UserSize(ULONG *pFlags, ULONG StartingSize, LPSAFEARRAY *ppsa)
 775 {
 776     ULONG size = StartingSize;
 777
 778     TRACE("("); dump_user_flags(pFlags); TRACE(", %d, %p\n", StartingSize, *ppsa);
 779
 780     ALIGN_LENGTH(size, 3);
 781     size += sizeof(ULONG_PTR);
 782     if (*ppsa)
 783     {
 784         SAFEARRAY *psa = *ppsa;
 785         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 786         SF_TYPE sftype;
 787         HRESULT hr;
 788
 789         size += sizeof(ULONG);
 790         size += FIELD_OFFSET(struct _wireSAFEARRAY, uArrayStructs);
 791
 792         sftype = SAFEARRAY_GetUnionType(psa);
 793         size += sizeof(ULONG);
 794
 795         size += sizeof(ULONG);
 796         size += sizeof(ULONG_PTR);
 797         if (sftype == SF_HAVEIID)
 798             size += sizeof(IID);
 799
 800         size += sizeof(psa->rgsabound[0]) * psa->cDims;
 801
 802         size += sizeof(ULONG);
 803
 804         switch (sftype)
 805         {
 806             case SF_BSTR:
 807             {
 808                 BSTR* lpBstr;
 809
 810                 for (lpBstr = (BSTR*)psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 811                     size = BSTR_UserSize(pFlags, size, lpBstr);
 812
 813                 break;
 814             }
 815             case SF_DISPATCH:
 816             case SF_UNKNOWN:
 817             case SF_HAVEIID:
 818                 FIXME("size interfaces\n");
 819                 break;
 820             case SF_VARIANT:
 821             {
 822                 VARIANT* lpVariant;
 823
 824                 for (lpVariant = (VARIANT*)psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 825                     size = VARIANT_UserSize(pFlags, size, lpVariant);
 826
 827                 break;
 828             }
 829             case SF_RECORD:
 830             {
 831                 IRecordInfo* pRecInfo = NULL;
 832
 833                 hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 834                 if (FAILED(hr))
 835                     RpcRaiseException(hr);
 836
 837                 if (pRecInfo)
 838                 {
 839                     FIXME("size record info %p\n", pRecInfo);
 840
 841                     IRecordInfo_Release(pRecInfo);
 842                 }
 843                 break;
 844             }
 845             case SF_I8:
 846                 ALIGN_LENGTH(size, 7);
 847                 /* fallthrough */
 848             case SF_I1:
 849             case SF_I2:
 850             case SF_I4:
 851                 size += ulCellCount * psa->cbElements;
 852                 break;
 853             default:
 854                 break;
 855         }
 856
 857     }
 858
 859     return size;
 860 }
 861
 862 unsigned char * WINAPI LPSAFEARRAY_UserMarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 863 {
 864     HRESULT hr;
 865
 866     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, &%p\n", Buffer, *ppsa);
 867
 868     ALIGN_POINTER(Buffer, 3);
 869     *(ULONG_PTR *)Buffer = *ppsa ? TRUE : FALSE;
 870     Buffer += sizeof(ULONG_PTR);
 871     if (*ppsa)
 872     {
 873         VARTYPE vt;
 874         SAFEARRAY *psa = *ppsa;
 875         ULONG ulCellCount = SAFEARRAY_GetCellCount(psa);
 876         wireSAFEARRAY wiresa;
 877         SF_TYPE sftype;
 878         GUID guid;
 879
 880         *(ULONG *)Buffer = psa->cDims;
 881         Buffer += sizeof(ULONG);
 882         wiresa = (wireSAFEARRAY)Buffer;
 883         wiresa->cDims = psa->cDims;
 884         wiresa->fFeatures = psa->fFeatures;
 885         wiresa->cbElements = psa->cbElements;
 886
 887         hr = SafeArrayGetVartype(psa, &vt);
 888         if (FAILED(hr)) vt = 0;
 889
 890         wiresa->cLocks = (USHORT)psa->cLocks | (vt << 16);
 891
 892         Buffer += FIELD_OFFSET(struct _wireSAFEARRAY, uArrayStructs);
 893
 894         sftype = SAFEARRAY_GetUnionType(psa);
 895         *(ULONG *)Buffer = sftype;
 896         Buffer += sizeof(ULONG);
 897
 898         *(ULONG *)Buffer = ulCellCount;
 899         Buffer += sizeof(ULONG);
 900         *(ULONG_PTR *)Buffer = (ULONG_PTR)psa->pvData;
 901         Buffer += sizeof(ULONG_PTR);
 902         if (sftype == SF_HAVEIID)
 903         {
 904             SafeArrayGetIID(psa, &guid);
 905             memcpy(Buffer, &guid, sizeof(guid));
 906             Buffer += sizeof(guid);
 907         }
 908
 909         memcpy(Buffer, psa->rgsabound, sizeof(psa->rgsabound[0]) * psa->cDims);
 910         Buffer += sizeof(psa->rgsabound[0]) * psa->cDims;
 911
 912         *(ULONG *)Buffer = ulCellCount;
 913         Buffer += sizeof(ULONG);
 914
 915         if (psa->pvData)
 916         {
 917             switch (sftype)
 918             {
 919                 case SF_BSTR:
 920                 {
 921                     BSTR* lpBstr;
 922
 923                     for (lpBstr = (BSTR*)psa->pvData; ulCellCount; ulCellCount--, lpBstr++)
 924                         Buffer = BSTR_UserMarshal(pFlags, Buffer, lpBstr);
 925
 926                     break;
 927                 }
 928                 case SF_DISPATCH:
 929                 case SF_UNKNOWN:
 930                 case SF_HAVEIID:
 931                     FIXME("marshal interfaces\n");
 932                     break;
 933                 case SF_VARIANT:
 934                 {
 935                     VARIANT* lpVariant;
 936
 937                     for (lpVariant = (VARIANT*)psa->pvData; ulCellCount; ulCellCount--, lpVariant++)
 938                         Buffer = VARIANT_UserMarshal(pFlags, Buffer, lpVariant);
 939
 940                     break;
 941                 }
 942                 case SF_RECORD:
 943                 {
 944                     IRecordInfo* pRecInfo = NULL;
 945
 946                     hr = SafeArrayGetRecordInfo(psa, &pRecInfo);
 947                     if (FAILED(hr))
 948                         RpcRaiseException(hr);
 949
 950                     if (pRecInfo)
 951                     {
 952                         FIXME("write record info %p\n", pRecInfo);
 953
 954                         IRecordInfo_Release(pRecInfo);
 955                     }
 956                     break;
 957                 }
 958
 959                 case SF_I8:
 960                     ALIGN_POINTER(Buffer, 7);
 961                     /* fallthrough */
 962                 case SF_I1:
 963                 case SF_I2:
 964                 case SF_I4:
 965                     /* Just copy the data over */
 966                     memcpy(Buffer, psa->pvData, ulCellCount * psa->cbElements);
 967                     Buffer += ulCellCount * psa->cbElements;
 968                     break;
 969                 default:
 970                     break;
 971             }
 972         }
 973
 974     }
 975     return Buffer;
 976 }
 977
 978 #define FADF_AUTOSETFLAGS (FADF_HAVEIID | FADF_RECORD | FADF_HAVEVARTYPE | \
 979                            FADF_BSTR | FADF_UNKNOWN | FADF_DISPATCH | \
 980                            FADF_VARIANT | FADF_CREATEVECTOR)
 981
 982 unsigned char * WINAPI LPSAFEARRAY_UserUnmarshal(ULONG *pFlags, unsigned char *Buffer, LPSAFEARRAY *ppsa)
 983 {
 984     ULONG_PTR ptr;
 985     wireSAFEARRAY wiresa;
 986     ULONG cDims;
 987     HRESULT hr;
 988     SF_TYPE sftype;
 989     ULONG cell_count;
 990     GUID guid;
 991     VARTYPE vt;
 992     SAFEARRAYBOUND *wiresab;
 993
 994     TRACE("("); dump_user_flags(pFlags); TRACE(", %p, %p\n", Buffer, ppsa);
 995
 996     ALIGN_POINTER(Buffer, 3);
 997     ptr = *(ULONG_PTR *)Buffer;
 998     Buffer += sizeof(ULONG_PTR);
 999
1000     if (!ptr)
1001     {
1002         *ppsa = NULL;
1003
1004         TRACE("NULL safe array unmarshaled\n");
1005
1006         return Buffer;
1007     }
1008
1009     cDims = *(ULONG *)Buffer;
1010     Buffer += sizeof(ULONG);
1011
1012     wiresa = (wireSAFEARRAY)Buffer;
1013     Buffer += FIELD_OFFSET(struct _wireSAFEARRAY, uArrayStructs);
1014
1015     if (cDims != wiresa->cDims)
1016         RpcRaiseException(RPC_S_INVALID_BOUND);
1017
1018     /* FIXME: there should be a limit on how large cDims can be */
1019
1020     vt = HIWORD(wiresa->cLocks);
1021
1022     sftype = *(ULONG *)Buffer;
1023     Buffer += sizeof(ULONG);
1024
1025     cell_count = *(ULONG *)Buffer;
1026     Buffer += sizeof(ULONG);
1027     ptr = *(ULONG_PTR *)Buffer;
1028     Buffer += sizeof(ULONG_PTR);
1029     if (sftype == SF_HAVEIID)
1030     {
1031         memcpy(&guid, Buffer, sizeof(guid));
1032         Buffer += sizeof(guid);
1033     }
1034
1035     wiresab = (SAFEARRAYBOUND *)Buffer;
1036     Buffer += sizeof(wiresab[0]) * wiresa->cDims;
1037
1038     if(vt)
1039         *ppsa = SafeArrayCreateEx(vt, wiresa->cDims, wiresab, NULL);
1040     else
1041     {
1042         SafeArrayAllocDescriptor(wiresa->cDims, ppsa);
1043         if(*ppsa)
1044             memcpy((*ppsa)->rgsabound, wiresab, sizeof(SAFEARRAYBOUND) * wiresa->cDims);
1045     }
1046     if (!*ppsa)
1047         RpcRaiseException(E_OUTOFMEMORY);
1048
1049     /* be careful about which flags we set since they could be a security
1050      * risk */
1051     (*ppsa)->fFeatures &= FADF_AUTOSETFLAGS;
1052     (*ppsa)->fFeatures |= (wiresa->fFeatures & ~(FADF_AUTOSETFLAGS));
1053     /* FIXME: there should be a limit on how large wiresa->cbElements can be */
1054     (*ppsa)->cbElements = wiresa->cbElements;
1055     (*ppsa)->cLocks = LOWORD(wiresa->cLocks);
1056
1057     /* SafeArrayCreateEx allocates the data for us, but
1058      * SafeArrayAllocDescriptor doesn't */
1059     if(!vt)
1060     {
1061         hr = SafeArrayAllocData(*ppsa);
1062         if (FAILED(hr))
1063             RpcRaiseException(hr);
1064     }
1065
1066     if ((*(ULONG *)Buffer != cell_count) || (SAFEARRAY_GetCellCount(*ppsa) != cell_count))
1067         RpcRaiseException(RPC_S_INVALID_BOUND);
1068     Buffer += sizeof(ULONG);
1069
1070     if (ptr)
1071     {
1072         switch (sftype)
1073         {
1074             case SF_BSTR:
1075             {
1076                 BSTR* lpBstr;
1077
1078                 for (lpBstr = (BSTR*)(*ppsa)->pvData; cell_count; cell_count--, lpBstr++)
1079                     Buffer = BSTR_UserUnmarshal(pFlags, Buffer, lpBstr);
1080
1081                 break;
1082             }
1083             case SF_DISPATCH:
1084             case SF_UNKNOWN:
1085             case SF_HAVEIID:
1086                 FIXME("marshal interfaces\n");
1087                 break;
1088             case SF_VARIANT:
1089             {
1090                 VARIANT* lpVariant;
1091
1092                 for (lpVariant = (VARIANT*)(*ppsa)->pvData; cell_count; cell_count--, lpVariant++)
1093                     Buffer = VARIANT_UserUnmarshal(pFlags, Buffer, lpVariant);
1094
1095                 break;
1096             }
1097             case SF_RECORD:
1098             {
1099                 FIXME("set record info\n");
1100
1101                 break;
1102             }
1103
1104             case SF_I8:
1105                 ALIGN_POINTER(Buffer, 7);
1106                 /* fallthrough */
1107             case SF_I1:
1108             case SF_I2:
1109             case SF_I4:
1110                 /* Just copy the data over */
1111                 memcpy((*ppsa)->pvData, Buffer, cell_count * (*ppsa)->cbElements);
1112                 Buffer += cell_count * (*ppsa)->cbElements;
1113                 break;
1114             default:
1115                 break;
1116         }
1117     }
1118
1119     TRACE("safe array unmarshaled: %p\n", *ppsa);
1120
1121     return Buffer;
1122 }
1123
1124 void WINAPI LPSAFEARRAY_UserFree(ULONG *pFlags, LPSAFEARRAY *ppsa)
1125 {
1126     TRACE("("); dump_user_flags(pFlags); TRACE(", &%p\n", *ppsa);
1127
1128     SafeArrayDestroy(*ppsa);
1129 }
1130
1131 /* IDispatch */
1132 /* exactly how Invoke is marshalled is not very clear to me yet,
1133  * but the way I've done it seems to work for me */
1134
1135 HRESULT CALLBACK IDispatch_Invoke_Proxy(
1136     IDispatch* This,
1137     DISPID dispIdMember,
1138     REFIID riid,
1139     LCID lcid,
1140     WORD wFlags,
1141     DISPPARAMS* pDispParams,
1142     VARIANT* pVarResult,
1143     EXCEPINFO* pExcepInfo,
1144     UINT* puArgErr)
1145 {
1146   HRESULT hr;
1147   VARIANT VarResult;
1148   UINT* rgVarRefIdx = NULL;
1149   VARIANTARG* rgVarRef = NULL;
1150   UINT u, cVarRef;
1151   UINT uArgErr;
1152   EXCEPINFO ExcepInfo;
1153
1154   TRACE("(%p)->(%d,%s,%x,%x,%p,%p,%p,%p)\n", This,
1155         dispIdMember, debugstr_guid(riid),
1156         lcid, wFlags, pDispParams, pVarResult,
1157         pExcepInfo, puArgErr);
1158
1159   /* [out] args can't be null, use dummy vars if needed */
1160   if (!pVarResult) pVarResult = &VarResult;
1161   if (!puArgErr) puArgErr = &uArgErr;
1162   if (!pExcepInfo) pExcepInfo = &ExcepInfo;
1163
1164   /* count by-ref args */
1165   for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1166     VARIANTARG* arg = &pDispParams->rgvarg[u];
1167     if (V_ISBYREF(arg)) {
1168       cVarRef++;
1169     }
1170   }
1171   if (cVarRef) {
1172     rgVarRefIdx = CoTaskMemAlloc(sizeof(UINT)*cVarRef);
1173     rgVarRef = CoTaskMemAlloc(sizeof(VARIANTARG)*cVarRef);
1174     /* make list of by-ref args */
1175     for (cVarRef=0,u=0; u<pDispParams->cArgs; u++) {
1176       VARIANTARG* arg = &pDispParams->rgvarg[u];
1177       if (V_ISBYREF(arg)) {
1178         rgVarRefIdx[cVarRef] = u;
1179         VariantInit(&rgVarRef[cVarRef]);
1180         cVarRef++;
1181       }
1182     }
1183   } else {
1184     /* [out] args still can't be null,
1185      * but we can point these anywhere in this case,
1186      * since they won't be written to when cVarRef is 0 */
1187     rgVarRefIdx = puArgErr;
1188     rgVarRef = pVarResult;
1189   }
1190   TRACE("passed by ref: %d args\n", cVarRef);
1191   hr = IDispatch_RemoteInvoke_Proxy(This,
1192                                     dispIdMember,
1193                                     riid,
1194                                     lcid,
1195                                     wFlags,
1196                                     pDispParams,
1197                                     pVarResult,
1198                                     pExcepInfo,
1199                                     puArgErr,
1200                                     cVarRef,
1201                                     rgVarRefIdx,
1202                                     rgVarRef);
1203   if (cVarRef) {
1204     for (u=0; u<cVarRef; u++) {
1205       unsigned i = rgVarRefIdx[u];
1206       VariantCopy(&pDispParams->rgvarg[i],
1207                   &rgVarRef[u]);
1208       VariantClear(&rgVarRef[u]);
1209     }
1210     CoTaskMemFree(rgVarRef);
1211     CoTaskMemFree(rgVarRefIdx);
1212   }
1213
1214   if(pExcepInfo == &ExcepInfo)
1215   {
1216     SysFreeString(pExcepInfo->bstrSource);
1217     SysFreeString(pExcepInfo->bstrDescription);
1218     SysFreeString(pExcepInfo->bstrHelpFile);
1219   }
1220   return hr;
1221 }
1222
1223 HRESULT __RPC_STUB IDispatch_Invoke_Stub(
1224     IDispatch* This,
1225     DISPID dispIdMember,
1226     REFIID riid,
1227     LCID lcid,
1228     DWORD dwFlags,
1229     DISPPARAMS* pDispParams,
1230     VARIANT* pVarResult,
1231     EXCEPINFO* pExcepInfo,
1232     UINT* pArgErr,
1233     UINT cVarRef,
1234     UINT* rgVarRefIdx,
1235     VARIANTARG* rgVarRef)
1236 {
1237   HRESULT hr = S_OK;
1238   VARIANTARG *rgvarg, *arg;
1239   UINT u;
1240
1241   /* initialize out parameters, so that they can be marshalled
1242    * in case the real Invoke doesn't initialize them */
1243   VariantInit(pVarResult);
1244   memset(pExcepInfo, 0, sizeof(*pExcepInfo));
1245   *pArgErr = 0;
1246
1247   /* let the real Invoke operate on a copy of the in parameters,
1248    * so we don't risk losing pointers to allocated memory */
1249   rgvarg = pDispParams->rgvarg;
1250   arg = CoTaskMemAlloc(sizeof(VARIANTARG)*pDispParams->cArgs);
1251   if (!arg) return E_OUTOFMEMORY;
1252
1253   /* init all args so we can call VariantClear on all the args if the copy
1254    * below fails */
1255   for (u = 0; u < pDispParams->cArgs; u++)
1256     VariantInit(&arg[u]);
1257
1258   for (u = 0; u < pDispParams->cArgs; u++) {
1259     hr = VariantCopy(&arg[u], &rgvarg[u]);
1260     if (FAILED(hr))
1261         break;
1262   }
1263
1264   if (SUCCEEDED(hr)) {
1265     pDispParams->rgvarg = arg;
1266
1267     hr = IDispatch_Invoke(This,
1268                           dispIdMember,
1269                           riid,
1270                           lcid,
1271                           dwFlags,
1272                           pDispParams,
1273                           pVarResult,
1274                           pExcepInfo,
1275                           pArgErr);
1276
1277     /* copy ref args to out list */
1278     for (u=0; u<cVarRef; u++) {
1279       unsigned i = rgVarRefIdx[u];
1280       VariantInit(&rgVarRef[u]);
1281       VariantCopy(&rgVarRef[u], &arg[i]);
1282       /* clear original if equal, to avoid double-free */
1283       if (V_BYREF(&rgVarRef[u]) == V_BYREF(&rgvarg[i]))
1284         VariantClear(&rgvarg[i]);
1285     }
1286   }
1287
1288   /* clear the duplicate argument list */
1289   for (u=0; u<pDispParams->cArgs; u++)
1290     VariantClear(&arg[u]);
1291
1292   pDispParams->rgvarg = rgvarg;
1293   CoTaskMemFree(arg);
1294
1295   return hr;
1296 }
1297
1298 /* IEnumVARIANT */
1299
1300 HRESULT CALLBACK IEnumVARIANT_Next_Proxy(
1301     IEnumVARIANT* This,
1302     ULONG celt,
1303     VARIANT* rgVar,
1304     ULONG* pCeltFetched)
1305 {
1306   ULONG fetched;
1307   if (!pCeltFetched)
1308     pCeltFetched = &fetched;
1309   return IEnumVARIANT_RemoteNext_Proxy(This,
1310                                        celt,
1311                                        rgVar,
1312                                        pCeltFetched);
1313 }
1314
1315 HRESULT __RPC_STUB IEnumVARIANT_Next_Stub(
1316     IEnumVARIANT* This,
1317     ULONG celt,
1318     VARIANT* rgVar,
1319     ULONG* pCeltFetched)
1320 {
1321   HRESULT hr;
1322   *pCeltFetched = 0;
1323   hr = IEnumVARIANT_Next(This,
1324                          celt,
1325                          rgVar,
1326                          pCeltFetched);
1327   if (hr == S_OK) *pCeltFetched = celt;
1328   return hr;
1329 }
1330
1331 /* TypeInfo related freers */
1332
1333 static void free_embedded_typedesc(TYPEDESC *tdesc);
1334 static void free_embedded_arraydesc(ARRAYDESC *adesc)
1335 {
1336     switch(adesc->tdescElem.vt)
1337     {
1338     case VT_PTR:
1339     case VT_SAFEARRAY:
1340         free_embedded_typedesc(adesc->tdescElem.u.lptdesc);
1341         CoTaskMemFree(adesc->tdescElem.u.lptdesc);
1342         break;
1343     case VT_CARRAY:
1344         free_embedded_arraydesc(adesc->tdescElem.u.lpadesc);
1345         CoTaskMemFree(adesc->tdescElem.u.lpadesc);
1346         break;
1347     }
1348 }
1349
1350 static void free_embedded_typedesc(TYPEDESC *tdesc)
1351 {
1352     switch(tdesc->vt)
1353     {
1354     case VT_PTR:
1355     case VT_SAFEARRAY:
1356         free_embedded_typedesc(tdesc->u.lptdesc);
1357         CoTaskMemFree(tdesc->u.lptdesc);
1358         break;
1359     case VT_CARRAY:
1360         free_embedded_arraydesc(tdesc->u.lpadesc);
1361         CoTaskMemFree(tdesc->u.lpadesc);
1362         break;
1363     }
1364 }
1365
1366 static void free_embedded_elemdesc(ELEMDESC *edesc)
1367 {
1368     free_embedded_typedesc(&edesc->tdesc);
1369     if(edesc->u.paramdesc.wParamFlags & PARAMFLAG_FHASDEFAULT)
1370         CoTaskMemFree(edesc->u.paramdesc.pparamdescex);
1371 }
1372
1373 /* ITypeComp */
1374
1375 HRESULT CALLBACK ITypeComp_Bind_Proxy(
1376     ITypeComp* This,
1377     LPOLESTR szName,
1378     ULONG lHashVal,
1379     WORD wFlags,
1380     ITypeInfo** ppTInfo,
1381     DESCKIND* pDescKind,
1382     BINDPTR* pBindPtr)
1383 {
1384   FIXME("not implemented\n");
1385   return E_FAIL;
1386 }
1387
1388 HRESULT __RPC_STUB ITypeComp_Bind_Stub(
1389     ITypeComp* This,
1390     LPOLESTR szName,
1391     ULONG lHashVal,
1392     WORD wFlags,
1393     ITypeInfo** ppTInfo,
1394     DESCKIND* pDescKind,
1395     LPFUNCDESC* ppFuncDesc,
1396     LPVARDESC* ppVarDesc,
1397     ITypeComp** ppTypeComp,
1398     CLEANLOCALSTORAGE* pDummy)
1399 {
1400   FIXME("not implemented\n");
1401   return E_FAIL;
1402 }
1403
1404 HRESULT CALLBACK ITypeComp_BindType_Proxy(
1405     ITypeComp* This,
1406     LPOLESTR szName,
1407     ULONG lHashVal,
1408     ITypeInfo** ppTInfo,
1409     ITypeComp** ppTComp)
1410 {
1411   FIXME("not implemented\n");
1412   return E_FAIL;
1413 }
1414
1415 HRESULT __RPC_STUB ITypeComp_BindType_Stub(
1416     ITypeComp* This,
1417     LPOLESTR szName,
1418     ULONG lHashVal,
1419     ITypeInfo** ppTInfo)
1420 {
1421   FIXME("not implemented\n");
1422   return E_FAIL;
1423 }
1424
1425 /* ITypeInfo */
1426
1427 HRESULT CALLBACK ITypeInfo_GetTypeAttr_Proxy(
1428     ITypeInfo* This,
1429     TYPEATTR** ppTypeAttr)
1430
1431 {
1432     CLEANLOCALSTORAGE stg;
1433     TRACE("(%p, %p)\n", This, ppTypeAttr);
1434
1435     stg.flags = 0;
1436     stg.pStorage = NULL;
1437     stg.pInterface = NULL;
1438
1439     return ITypeInfo_RemoteGetTypeAttr_Proxy(This, ppTypeAttr, &stg);
1440 }
1441
1442 HRESULT __RPC_STUB ITypeInfo_GetTypeAttr_Stub(
1443     ITypeInfo* This,
1444     LPTYPEATTR* ppTypeAttr,
1445     CLEANLOCALSTORAGE* pDummy)
1446 {
1447     HRESULT hr;
1448     TRACE("(%p, %p)\n", This, ppTypeAttr);
1449
1450     hr = ITypeInfo_GetTypeAttr(This, ppTypeAttr);
1451     if(hr != S_OK)
1452         return hr;
1453
1454     pDummy->flags = CLS_TYPEATTR;
1455     ITypeInfo_AddRef(This);
1456     pDummy->pInterface = (IUnknown*)This;
1457     pDummy->pStorage = ppTypeAttr;
1458     return hr;
1459 }
1460
1461 HRESULT CALLBACK ITypeInfo_GetFuncDesc_Proxy(
1462     ITypeInfo* This,
1463     UINT index,
1464     FUNCDESC** ppFuncDesc)
1465 {
1466     CLEANLOCALSTORAGE stg;
1467     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1468
1469     stg.flags = 0;
1470     stg.pStorage = NULL;
1471     stg.pInterface = NULL;
1472
1473     return ITypeInfo_RemoteGetFuncDesc_Proxy(This, index, ppFuncDesc, &stg);
1474 }
1475
1476 HRESULT __RPC_STUB ITypeInfo_GetFuncDesc_Stub(
1477     ITypeInfo* This,
1478     UINT index,
1479     LPFUNCDESC* ppFuncDesc,
1480     CLEANLOCALSTORAGE* pDummy)
1481 {
1482     HRESULT hr;
1483     TRACE("(%p, %d, %p)\n", This, index, ppFuncDesc);
1484
1485     hr = ITypeInfo_GetFuncDesc(This, index, ppFuncDesc);
1486     if(hr != S_OK)
1487         return hr;
1488
1489     pDummy->flags = CLS_FUNCDESC;
1490     ITypeInfo_AddRef(This);
1491     pDummy->pInterface = (IUnknown*)This;
1492     pDummy->pStorage = ppFuncDesc;
1493     return hr;
1494 }
1495
1496 HRESULT CALLBACK ITypeInfo_GetVarDesc_Proxy(
1497     ITypeInfo* This,
1498     UINT index,
1499     VARDESC** ppVarDesc)
1500 {
1501     CLEANLOCALSTORAGE stg;
1502     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1503
1504     stg.flags = 0;
1505     stg.pStorage = NULL;
1506     stg.pInterface = NULL;
1507
1508     return ITypeInfo_RemoteGetVarDesc_Proxy(This, index, ppVarDesc, &stg);
1509 }
1510
1511 HRESULT __RPC_STUB ITypeInfo_GetVarDesc_Stub(
1512     ITypeInfo* This,
1513     UINT index,
1514     LPVARDESC* ppVarDesc,
1515     CLEANLOCALSTORAGE* pDummy)
1516 {
1517     HRESULT hr;
1518     TRACE("(%p, %d, %p)\n", This, index, ppVarDesc);
1519
1520     hr = ITypeInfo_GetVarDesc(This, index, ppVarDesc);
1521     if(hr != S_OK)
1522         return hr;
1523
1524     pDummy->flags = CLS_VARDESC;
1525     ITypeInfo_AddRef(This);
1526     pDummy->pInterface = (IUnknown*)This;
1527     pDummy->pStorage = ppVarDesc;
1528     return hr;
1529 }
1530
1531 HRESULT CALLBACK ITypeInfo_GetNames_Proxy(
1532     ITypeInfo* This,
1533     MEMBERID memid,
1534     BSTR* rgBstrNames,
1535     UINT cMaxNames,
1536     UINT* pcNames)
1537 {
1538   FIXME("not implemented\n");
1539   return E_FAIL;
1540 }
1541
1542 HRESULT __RPC_STUB ITypeInfo_GetNames_Stub(
1543     ITypeInfo* This,
1544     MEMBERID memid,
1545     BSTR* rgBstrNames,
1546     UINT cMaxNames,
1547     UINT* pcNames)
1548 {
1549   FIXME("not implemented\n");
1550   return E_FAIL;
1551 }
1552
1553 HRESULT CALLBACK ITypeInfo_GetIDsOfNames_Proxy(
1554     ITypeInfo* This,
1555     LPOLESTR* rgszNames,
1556     UINT cNames,
1557     MEMBERID* pMemId)
1558 {
1559   FIXME("not implemented\n");
1560   return E_FAIL;
1561 }
1562
1563 HRESULT __RPC_STUB ITypeInfo_GetIDsOfNames_Stub(
1564     ITypeInfo* This)
1565 {
1566   FIXME("not implemented\n");
1567   return E_FAIL;
1568 }
1569
1570 HRESULT CALLBACK ITypeInfo_Invoke_Proxy(
1571     ITypeInfo* This,
1572     PVOID pvInstance,
1573     MEMBERID memid,
1574     WORD wFlags,
1575     DISPPARAMS* pDispParams,
1576     VARIANT* pVarResult,
1577     EXCEPINFO* pExcepInfo,
1578     UINT* puArgErr)
1579 {
1580   FIXME("not implemented\n");
1581   return E_FAIL;
1582 }
1583
1584 HRESULT __RPC_STUB ITypeInfo_Invoke_Stub(
1585     ITypeInfo* This)
1586 {
1587   FIXME("not implemented\n");
1588   return E_FAIL;
1589 }
1590
1591 HRESULT CALLBACK ITypeInfo_GetDocumentation_Proxy(
1592     ITypeInfo* This,
1593     MEMBERID memid,
1594     BSTR* pBstrName,
1595     BSTR* pBstrDocString,
1596     DWORD* pdwHelpContext,
1597     BSTR* pBstrHelpFile)
1598 {
1599     DWORD help_context;
1600     BSTR name, doc_string, help_file;
1601     HRESULT hr;
1602     TRACE("(%p, %08x, %p, %p, %p, %p)\n", This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1603
1604     /* FIXME: presumably refPtrFlags is supposed to be a bitmask of which ptrs we actually want? */
1605     hr = ITypeInfo_RemoteGetDocumentation_Proxy(This, memid, 0, &name, &doc_string, &help_context, &help_file);
1606     if(SUCCEEDED(hr))
1607     {
1608         if(pBstrName) *pBstrName = name;
1609         else SysFreeString(name);
1610
1611         if(pBstrDocString) *pBstrDocString = doc_string;
1612         else SysFreeString(doc_string);
1613
1614         if(pBstrHelpFile) *pBstrHelpFile = help_file;
1615         else SysFreeString(help_file);
1616
1617         if(pdwHelpContext) *pdwHelpContext = help_context;
1618     }
1619     return hr;
1620 }
1621
1622 HRESULT __RPC_STUB ITypeInfo_GetDocumentation_Stub(
1623     ITypeInfo* This,
1624     MEMBERID memid,
1625     DWORD refPtrFlags,
1626     BSTR* pBstrName,
1627     BSTR* pBstrDocString,
1628     DWORD* pdwHelpContext,
1629     BSTR* pBstrHelpFile)
1630 {
1631     TRACE("(%p, %08x, %08x, %p, %p, %p, %p)\n", This, memid, refPtrFlags, pBstrName, pBstrDocString,
1632           pdwHelpContext, pBstrHelpFile);
1633     return ITypeInfo_GetDocumentation(This, memid, pBstrName, pBstrDocString, pdwHelpContext, pBstrHelpFile);
1634 }
1635
1636 HRESULT CALLBACK ITypeInfo_GetDllEntry_Proxy(
1637     ITypeInfo* This,
1638     MEMBERID memid,
1639     INVOKEKIND invKind,
1640     BSTR* pBstrDllName,
1641     BSTR* pBstrName,
1642     WORD* pwOrdinal)
1643 {
1644   FIXME("not implemented\n");
1645   return E_FAIL;
1646 }
1647
1648 HRESULT __RPC_STUB ITypeInfo_GetDllEntry_Stub(
1649     ITypeInfo* This,
1650     MEMBERID memid,
1651     INVOKEKIND invKind,
1652     DWORD refPtrFlags,
1653     BSTR* pBstrDllName,
1654     BSTR* pBstrName,
1655     WORD* pwOrdinal)
1656 {
1657   FIXME("not implemented\n");
1658   return E_FAIL;
1659 }
1660
1661 HRESULT CALLBACK ITypeInfo_AddressOfMember_Proxy(
1662     ITypeInfo* This,
1663     MEMBERID memid,
1664     INVOKEKIND invKind,
1665     PVOID* ppv)
1666 {
1667   FIXME("not implemented\n");
1668   return E_FAIL;
1669 }
1670
1671 HRESULT __RPC_STUB ITypeInfo_AddressOfMember_Stub(
1672     ITypeInfo* This)
1673 {
1674   FIXME("not implemented\n");
1675   return E_FAIL;
1676 }
1677
1678 HRESULT CALLBACK ITypeInfo_CreateInstance_Proxy(
1679     ITypeInfo* This,
1680     IUnknown* pUnkOuter,
1681     REFIID riid,
1682     PVOID* ppvObj)
1683 {
1684   FIXME("not implemented\n");
1685   return E_FAIL;
1686 }
1687
1688 HRESULT __RPC_STUB ITypeInfo_CreateInstance_Stub(
1689     ITypeInfo* This,
1690     REFIID riid,
1691     IUnknown** ppvObj)
1692 {
1693   FIXME("not implemented\n");
1694   return E_FAIL;
1695 }
1696
1697 HRESULT CALLBACK ITypeInfo_GetContainingTypeLib_Proxy(
1698     ITypeInfo* This,
1699     ITypeLib** ppTLib,
1700     UINT* pIndex)
1701 {
1702     ITypeLib *pTL;
1703     UINT index;
1704     HRESULT hr;
1705
1706     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1707
1708     hr = ITypeInfo_RemoteGetContainingTypeLib_Proxy(This, &pTL, &index);
1709     if(SUCCEEDED(hr))
1710     {
1711         if(pIndex)
1712             *pIndex = index;
1713
1714         if(ppTLib)
1715             *ppTLib = pTL;
1716         else
1717             ITypeLib_Release(pTL);
1718     }
1719     return hr;
1720 }
1721
1722 HRESULT __RPC_STUB ITypeInfo_GetContainingTypeLib_Stub(
1723     ITypeInfo* This,
1724     ITypeLib** ppTLib,
1725     UINT* pIndex)
1726 {
1727     TRACE("(%p, %p, %p)\n", This, ppTLib, pIndex );
1728     return ITypeInfo_GetContainingTypeLib(This, ppTLib, pIndex);
1729 }
1730
1731 void CALLBACK ITypeInfo_ReleaseTypeAttr_Proxy(
1732     ITypeInfo* This,
1733     TYPEATTR* pTypeAttr)
1734 {
1735     TRACE("(%p, %p)\n", This, pTypeAttr);
1736     free_embedded_typedesc(&pTypeAttr->tdescAlias);
1737     CoTaskMemFree(pTypeAttr);
1738 }
1739
1740 HRESULT __RPC_STUB ITypeInfo_ReleaseTypeAttr_Stub(
1741     ITypeInfo* This)
1742 {
1743     TRACE("nothing to do\n");
1744     return S_OK;
1745 }
1746
1747 void CALLBACK ITypeInfo_ReleaseFuncDesc_Proxy(
1748     ITypeInfo* This,
1749     FUNCDESC* pFuncDesc)
1750 {
1751     SHORT param;
1752     TRACE("(%p, %p)\n", This, pFuncDesc);
1753
1754     for(param = 0; param < pFuncDesc->cParams; param++)
1755         free_embedded_elemdesc(pFuncDesc->lprgelemdescParam + param);
1756     if(param)
1757         CoTaskMemFree(pFuncDesc->lprgelemdescParam);
1758
1759     free_embedded_elemdesc(&pFuncDesc->elemdescFunc);
1760
1761     if(pFuncDesc->cScodes != 0 && pFuncDesc->cScodes != -1)
1762         CoTaskMemFree(pFuncDesc->lprgscode);
1763
1764     CoTaskMemFree(pFuncDesc);
1765 }
1766
1767 HRESULT __RPC_STUB ITypeInfo_ReleaseFuncDesc_Stub(
1768     ITypeInfo* This)
1769 {
1770     TRACE("nothing to do\n");
1771     return S_OK;
1772 }
1773
1774 void CALLBACK ITypeInfo_ReleaseVarDesc_Proxy(
1775     ITypeInfo* This,
1776     VARDESC* pVarDesc)
1777 {
1778     TRACE("(%p, %p)\n", This, pVarDesc);
1779
1780     CoTaskMemFree(pVarDesc->lpstrSchema);
1781
1782     if(pVarDesc->varkind == VAR_CONST)
1783         CoTaskMemFree(pVarDesc->u.lpvarValue);
1784
1785     free_embedded_elemdesc(&pVarDesc->elemdescVar);
1786     CoTaskMemFree(pVarDesc);
1787 }
1788
1789 HRESULT __RPC_STUB ITypeInfo_ReleaseVarDesc_Stub(
1790     ITypeInfo* This)
1791 {
1792     TRACE("nothing to do\n");
1793     return S_OK;
1794 }
1795
1796
1797 /* ITypeInfo2 */
1798
1799 HRESULT CALLBACK ITypeInfo2_GetDocumentation2_Proxy(
1800     ITypeInfo2* This,
1801     MEMBERID memid,
1802     LCID lcid,
1803     BSTR* pbstrHelpString,
1804     DWORD* pdwHelpStringContext,
1805     BSTR* pbstrHelpStringDll)
1806 {
1807   FIXME("not implemented\n");
1808   return E_FAIL;
1809 }
1810
1811 HRESULT __RPC_STUB ITypeInfo2_GetDocumentation2_Stub(
1812     ITypeInfo2* This,
1813     MEMBERID memid,
1814     LCID lcid,
1815     DWORD refPtrFlags,
1816     BSTR* pbstrHelpString,
1817     DWORD* pdwHelpStringContext,
1818     BSTR* pbstrHelpStringDll)
1819 {
1820   FIXME("not implemented\n");
1821   return E_FAIL;
1822 }
1823
1824 /* ITypeLib */
1825
1826 UINT CALLBACK ITypeLib_GetTypeInfoCount_Proxy(
1827     ITypeLib* This)
1828 {
1829     UINT count = 0;
1830     TRACE("(%p)\n", This);
1831
1832     ITypeLib_RemoteGetTypeInfoCount_Proxy(This, &count);
1833
1834     return count;
1835 }
1836
1837 HRESULT __RPC_STUB ITypeLib_GetTypeInfoCount_Stub(
1838     ITypeLib* This,
1839     UINT* pcTInfo)
1840 {
1841     TRACE("(%p, %p)\n", This, pcTInfo);
1842     *pcTInfo = ITypeLib_GetTypeInfoCount(This);
1843     return S_OK;
1844 }
1845
1846 HRESULT CALLBACK ITypeLib_GetLibAttr_Proxy(
1847     ITypeLib* This,
1848     TLIBATTR** ppTLibAttr)
1849 {
1850     CLEANLOCALSTORAGE stg;
1851     TRACE("(%p, %p)\n", This, ppTLibAttr);
1852
1853     stg.flags = 0;
1854     stg.pStorage = NULL;
1855     stg.pInterface = NULL;
1856
1857     return ITypeLib_RemoteGetLibAttr_Proxy(This, ppTLibAttr, &stg);
1858 }
1859
1860 HRESULT __RPC_STUB ITypeLib_GetLibAttr_Stub(
1861     ITypeLib* This,
1862     LPTLIBATTR* ppTLibAttr,
1863     CLEANLOCALSTORAGE* pDummy)
1864 {
1865     HRESULT hr;
1866     TRACE("(%p, %p)\n", This, ppTLibAttr);
1867
1868     hr = ITypeLib_GetLibAttr(This, ppTLibAttr);
1869     if(hr != S_OK)
1870         return hr;
1871
1872     pDummy->flags = CLS_LIBATTR;
1873     ITypeLib_AddRef(This);
1874     pDummy->pInterface = (IUnknown*)This;
1875     pDummy->pStorage = ppTLibAttr;
1876     return hr;
1877 }
1878
1879 HRESULT CALLBACK ITypeLib_GetDocumentation_Proxy(
1880     ITypeLib* This,
1881     INT index,
1882     BSTR* pBstrName,
1883     BSTR* pBstrDocString,
1884     DWORD* pdwHelpContext,
1885     BSTR* pBstrHelpFile)
1886 {
1887   FIXME("not implemented\n");
1888   return E_FAIL;
1889 }
1890
1891 HRESULT __RPC_STUB ITypeLib_GetDocumentation_Stub(
1892     ITypeLib* This,
1893     INT index,
1894     DWORD refPtrFlags,
1895     BSTR* pBstrName,
1896     BSTR* pBstrDocString,
1897     DWORD* pdwHelpContext,
1898     BSTR* pBstrHelpFile)
1899 {
1900   FIXME("not implemented\n");
1901   return E_FAIL;
1902 }
1903
1904 HRESULT CALLBACK ITypeLib_IsName_Proxy(
1905     ITypeLib* This,
1906     LPOLESTR szNameBuf,
1907     ULONG lHashVal,
1908     BOOL* pfName)
1909 {
1910   FIXME("not implemented\n");
1911   return E_FAIL;
1912 }
1913
1914 HRESULT __RPC_STUB ITypeLib_IsName_Stub(
1915     ITypeLib* This,
1916     LPOLESTR szNameBuf,
1917     ULONG lHashVal,
1918     BOOL* pfName,
1919     BSTR* pBstrLibName)
1920 {
1921   FIXME("not implemented\n");
1922   return E_FAIL;
1923 }
1924
1925 HRESULT CALLBACK ITypeLib_FindName_Proxy(
1926     ITypeLib* This,
1927     LPOLESTR szNameBuf,
1928     ULONG lHashVal,
1929     ITypeInfo** ppTInfo,
1930     MEMBERID* rgMemId,
1931     USHORT* pcFound)
1932 {
1933   FIXME("not implemented\n");
1934   return E_FAIL;
1935 }
1936
1937 HRESULT __RPC_STUB ITypeLib_FindName_Stub(
1938     ITypeLib* This,
1939     LPOLESTR szNameBuf,
1940     ULONG lHashVal,
1941     ITypeInfo** ppTInfo,
1942     MEMBERID* rgMemId,
1943     USHORT* pcFound,
1944     BSTR* pBstrLibName)
1945 {
1946   FIXME("not implemented\n");
1947   return E_FAIL;
1948 }
1949
1950 void CALLBACK ITypeLib_ReleaseTLibAttr_Proxy(
1951     ITypeLib* This,
1952     TLIBATTR* pTLibAttr)
1953 {
1954     TRACE("(%p, %p)\n", This, pTLibAttr);
1955     CoTaskMemFree(pTLibAttr);
1956 }
1957
1958 HRESULT __RPC_STUB ITypeLib_ReleaseTLibAttr_Stub(
1959     ITypeLib* This)
1960 {
1961     TRACE("nothing to do\n");
1962     return S_OK;
1963 }
1964
1965
1966 /* ITypeLib2 */
1967
1968 HRESULT CALLBACK ITypeLib2_GetLibStatistics_Proxy(
1969     ITypeLib2* This,
1970     ULONG* pcUniqueNames,
1971     ULONG* pcchUniqueNames)
1972 {
1973   FIXME("not implemented\n");
1974   return E_FAIL;
1975 }
1976
1977 HRESULT __RPC_STUB ITypeLib2_GetLibStatistics_Stub(
1978     ITypeLib2* This,
1979     ULONG* pcUniqueNames,
1980     ULONG* pcchUniqueNames)
1981 {
1982   FIXME("not implemented\n");
1983   return E_FAIL;
1984 }
1985
1986 HRESULT CALLBACK ITypeLib2_GetDocumentation2_Proxy(
1987     ITypeLib2* This,
1988     INT index,
1989     LCID lcid,
1990     BSTR* pbstrHelpString,
1991     DWORD* pdwHelpStringContext,
1992     BSTR* pbstrHelpStringDll)
1993 {
1994   FIXME("not implemented\n");
1995   return E_FAIL;
1996 }
1997
1998 HRESULT __RPC_STUB ITypeLib2_GetDocumentation2_Stub(
1999     ITypeLib2* This,
2000     INT index,
2001     LCID lcid,
2002     DWORD refPtrFlags,
2003     BSTR* pbstrHelpString,
2004     DWORD* pdwHelpStringContext,
2005     BSTR* pbstrHelpStringDll)
2006 {
2007   FIXME("not implemented\n");
2008   return E_FAIL;
2009 }
2010
2011 HRESULT CALLBACK IPropertyBag_Read_Proxy(
2012     IPropertyBag* This,
2013     LPCOLESTR pszPropName,
2014     VARIANT *pVar,
2015     IErrorLog *pErrorLog)
2016 {
2017   FIXME("not implemented\n");
2018   return E_FAIL;
2019 }
2020
2021 HRESULT __RPC_STUB IPropertyBag_Read_Stub(
2022     IPropertyBag* This,
2023     LPCOLESTR pszPropName,
2024     VARIANT *pVar,
2025     IErrorLog *pErrorLog,
2026     DWORD varType,
2027     IUnknown *pUnkObj)
2028 {
2029   FIXME("not implemented\n");
2030   return E_FAIL;
2031 }