git.oblomov.eu Git - wine/blob - dlls/oleaut32/tmarshal.c

   1 /*
   2  *      TYPELIB Marshaler
   3  *
   4  *      Copyright 2002  Marcus Meissner
   5  *
   6  * This library is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU Lesser General Public
   8  * License as published by the Free Software Foundation; either
   9  * version 2.1 of the License, or (at your option) any later version.
  10  *
  11  * This library is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  14  * Lesser General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU Lesser General Public
  17  * License along with this library; if not, write to the Free Software
  18  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  19  */
  20
  21 #include "config.h"
  22
  23 #include <assert.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <stdio.h>
  27 #include <ctype.h>
  28
  29 #include "winerror.h"
  30 #include "winnls.h"
  31 #include "winreg.h"
  32 #include "winuser.h"
  33
  34 #include "ole2.h"
  35 #include "wine/unicode.h"
  36 #include "heap.h"
  37 #include "ole2disp.h"
  38 #include "typelib.h"
  39 #include "wine/debug.h"
  40 #include "winternl.h"
  41
  42 static const WCHAR riidW[5] = {'r','i','i','d',0};
  43 static const WCHAR pdispparamsW[] = {'p','d','i','s','p','p','a','r','a','m','s',0};
  44 static const WCHAR ppvObjectW[] = {'p','p','v','O','b','j','e','c','t',0};
  45
  46 WINE_DEFAULT_DEBUG_CHANNEL(ole);
  47 WINE_DECLARE_DEBUG_CHANNEL(olerelay);
  48
  49 typedef struct _marshal_state {
  50     LPBYTE      base;
  51     int         size;
  52     int         curoff;
  53
  54     BOOL        thisisiid;
  55     IID         iid;    /* HACK: for VT_VOID */
  56 } marshal_state;
  57
  58 static HRESULT
  59 xbuf_add(marshal_state *buf, LPBYTE stuff, DWORD size) {
  60     while (buf->size - buf->curoff < size) {
  61         if (buf->base) {
  62             buf->size += 100;
  63             buf->base = HeapReAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,buf->base,buf->size);
  64             if (!buf->base)
  65                 return E_OUTOFMEMORY;
  66         } else {
  67             buf->base = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,32);
  68             buf->size = 32;
  69             if (!buf->base)
  70                 return E_OUTOFMEMORY;
  71         }
  72     }
  73     memcpy(buf->base+buf->curoff,stuff,size);
  74     buf->curoff += size;
  75     return S_OK;
  76 }
  77
  78 static HRESULT
  79 xbuf_get(marshal_state *buf, LPBYTE stuff, DWORD size) {
  80     if (buf->size < buf->curoff+size) return E_FAIL;
  81     memcpy(stuff,buf->base+buf->curoff,size);
  82     buf->curoff += size;
  83     return S_OK;
  84 }
  85
  86 static HRESULT
  87 xbuf_skip(marshal_state *buf, DWORD size) {
  88     if (buf->size < buf->curoff+size) return E_FAIL;
  89     buf->curoff += size;
  90     return S_OK;
  91 }
  92
  93 static HRESULT
  94 _unmarshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN *pUnk) {
  95     IStream             *pStm;
  96     ULARGE_INTEGER      newpos;
  97     LARGE_INTEGER       seekto;
  98     ULONG               res;
  99     HRESULT             hres;
 100     DWORD               xsize;
 101
 102     TRACE("...%s...\n",debugstr_guid(riid));
 103     *pUnk = NULL;
 104     hres = xbuf_get(buf,(LPBYTE)&xsize,sizeof(xsize));
 105     if (hres) return hres;
 106     if (xsize == 0) return S_OK;
 107     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 108     if (hres) {
 109         FIXME("Stream create failed %lx\n",hres);
 110         return hres;
 111     }
 112     hres = IStream_Write(pStm,buf->base+buf->curoff,xsize,&res);
 113     if (hres) { FIXME("stream write %lx\n",hres); return hres; }
 114     memset(&seekto,0,sizeof(seekto));
 115     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 116     if (hres) { FIXME("Failed Seek %lx\n",hres); return hres;}
 117     hres = CoUnmarshalInterface(pStm,riid,(LPVOID*)pUnk);
 118     if (hres) {
 119         FIXME("Marshaling interface %s failed with %lx\n",debugstr_guid(riid),hres);
 120         return hres;
 121     }
 122     IStream_Release(pStm);
 123     return xbuf_skip(buf,xsize);
 124 }
 125
 126 static HRESULT
 127 _marshal_interface(marshal_state *buf, REFIID riid, LPUNKNOWN pUnk) {
 128     LPUNKNOWN           newiface;
 129     LPBYTE              tempbuf;
 130     IStream             *pStm;
 131     STATSTG             ststg;
 132     ULARGE_INTEGER      newpos;
 133     LARGE_INTEGER       seekto;
 134     ULONG               res;
 135     DWORD               xsize;
 136     HRESULT             hres;
 137
 138     hres = S_OK;
 139     if (!pUnk)
 140         goto fail;
 141
 142     TRACE("...%s...\n",debugstr_guid(riid));
 143     hres=IUnknown_QueryInterface(pUnk,riid,(LPVOID*)&newiface);
 144     if (hres) {
 145         TRACE("%p does not support iface %s\n",pUnk,debugstr_guid(riid));
 146         goto fail;
 147     }
 148     hres = CreateStreamOnHGlobal(0,TRUE,&pStm);
 149     if (hres) {
 150         FIXME("Stream create failed %lx\n",hres);
 151         goto fail;
 152     }
 153     hres = CoMarshalInterface(pStm,riid,newiface,0,NULL,0);
 154     IUnknown_Release(newiface);
 155     if (hres) {
 156         FIXME("Marshaling interface %s failed with %lx\n",
 157                 debugstr_guid(riid),hres
 158         );
 159         goto fail;
 160     }
 161     hres = IStream_Stat(pStm,&ststg,0);
 162     tempbuf = HeapAlloc(GetProcessHeap(), 0, ststg.cbSize.s.LowPart);
 163     memset(&seekto,0,sizeof(seekto));
 164     hres = IStream_Seek(pStm,seekto,SEEK_SET,&newpos);
 165     if (hres) { FIXME("Failed Seek %lx\n",hres); goto fail;}
 166     hres = IStream_Read(pStm,tempbuf,ststg.cbSize.s.LowPart,&res);
 167     if (hres) { FIXME("Failed Read %lx\n",hres); goto fail;}
 168     IStream_Release(pStm);
 169     xsize = ststg.cbSize.s.LowPart;
 170     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 171     hres = xbuf_add(buf,tempbuf,ststg.cbSize.s.LowPart);
 172     HeapFree(GetProcessHeap(),0,tempbuf);
 173     return hres;
 174 fail:
 175     xsize = 0;
 176     xbuf_add(buf,(LPBYTE)&xsize,sizeof(xsize));
 177     return hres;
 178 }
 179
 180 /********************* OLE Proxy/Stub Factory ********************************/
 181 static HRESULT WINAPI
 182 PSFacBuf_QueryInterface(LPPSFACTORYBUFFER iface, REFIID iid, LPVOID *ppv) {
 183     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)||IsEqualIID(iid,&IID_IUnknown)) {
 184         *ppv = (LPVOID)iface;
 185         /* No ref counting, static class */
 186         return S_OK;
 187     }
 188     FIXME("(%s) unknown IID?\n",debugstr_guid(iid));
 189     return E_NOINTERFACE;
 190 }
 191
 192 static ULONG WINAPI PSFacBuf_AddRef(LPPSFACTORYBUFFER iface) { return 2; }
 193 static ULONG WINAPI PSFacBuf_Release(LPPSFACTORYBUFFER iface) { return 1; }
 194
 195 static HRESULT
 196 _get_typeinfo_for_iid(REFIID riid, ITypeInfo**ti) {
 197     HRESULT     hres;
 198     HKEY        ikey;
 199     char        tlguid[200],typelibkey[300],interfacekey[300],ver[100];
 200     char        tlfn[260];
 201     OLECHAR     tlfnW[260];
 202     DWORD       tlguidlen, verlen, type, tlfnlen;
 203     ITypeLib    *tl;
 204
 205     sprintf( interfacekey, "Interface\\{%08lx-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x}\\Typelib",
 206         riid->Data1, riid->Data2, riid->Data3,
 207         riid->Data4[0], riid->Data4[1], riid->Data4[2], riid->Data4[3],
 208         riid->Data4[4], riid->Data4[5], riid->Data4[6], riid->Data4[7]
 209     );
 210
 211     if (RegOpenKeyA(HKEY_CLASSES_ROOT,interfacekey,&ikey)) {
 212         FIXME("No %s key found.\n",interfacekey);
 213         return E_FAIL;
 214     }
 215     type = (1<<REG_SZ);
 216     tlguidlen = sizeof(tlguid);
 217     if (RegQueryValueExA(ikey,NULL,NULL,&type,tlguid,&tlguidlen)) {
 218         FIXME("Getting typelib guid failed.\n");
 219         RegCloseKey(ikey);
 220         return E_FAIL;
 221     }
 222     type = (1<<REG_SZ);
 223     verlen = sizeof(ver);
 224     if (RegQueryValueExA(ikey,"Version",NULL,&type,ver,&verlen)) {
 225         FIXME("Could not get version value?\n");
 226         RegCloseKey(ikey);
 227         return E_FAIL;
 228     }
 229     RegCloseKey(ikey);
 230     sprintf(typelibkey,"Typelib\\%s\\%s\\0\\win32",tlguid,ver);
 231     tlfnlen = sizeof(tlfn);
 232     if (RegQueryValueA(HKEY_CLASSES_ROOT,typelibkey,tlfn,&tlfnlen)) {
 233         FIXME("Could not get typelib fn?\n");
 234         return E_FAIL;
 235     }
 236     MultiByteToWideChar(CP_ACP, 0, tlfn, -1, tlfnW, -1);
 237     hres = LoadTypeLib(tlfnW,&tl);
 238     if (hres) {
 239         ERR("Failed to load typelib for %s, but it should be there.\n",debugstr_guid(riid));
 240         return hres;
 241     }
 242     hres = ITypeLib_GetTypeInfoOfGuid(tl,riid,ti);
 243     if (hres) {
 244         ERR("typelib does not contain info for %s?\n",debugstr_guid(riid));
 245         ITypeLib_Release(tl);
 246         return hres;
 247     }
 248     /* FIXME: do this?  ITypeLib_Release(tl); */
 249     return hres;
 250 }
 251
 252 /* Determine nr of functions. Since we use the toplevel interface and all
 253  * inherited ones have lower numbers, we are ok to not to descent into
 254  * the inheritance tree I think.
 255  */
 256 static int _nroffuncs(ITypeInfo *tinfo) {
 257     int         n, max = 0;
 258     FUNCDESC    *fdesc;
 259     HRESULT     hres;
 260
 261     n=0;
 262     while (1) {
 263         hres = ITypeInfo_GetFuncDesc(tinfo,n,&fdesc);
 264         if (fdesc->oVft/4 > max)
 265             max = fdesc->oVft/4;
 266         if (hres)
 267             return max+1;
 268         n++;
 269     }
 270     /*NOTREACHED*/
 271 }
 272
 273 typedef struct _TMAsmProxy {
 274     BYTE        popleax;
 275     BYTE        pushlval;
 276     BYTE        nr;
 277     BYTE        pushleax;
 278     BYTE        lcall;
 279     DWORD       xcall;
 280     BYTE        lret;
 281     WORD        bytestopop;
 282 } WINE_PACKED TMAsmProxy;
 283
 284 typedef struct _TMProxyImpl {
 285     DWORD                               *lpvtbl;
 286     ICOM_VTABLE(IRpcProxyBuffer)        *lpvtbl2;
 287     DWORD                               ref;
 288
 289     TMAsmProxy                          *asmstubs;
 290     ITypeInfo*                          tinfo;
 291     IRpcChannelBuffer*                  chanbuf;
 292     IID                                 iid;
 293 } TMProxyImpl;
 294
 295 static HRESULT WINAPI
 296 TMProxyImpl_QueryInterface(LPRPCPROXYBUFFER iface, REFIID riid, LPVOID *ppv) {
 297     TRACE("()\n");
 298     if (IsEqualIID(riid,&IID_IUnknown)||IsEqualIID(riid,&IID_IRpcProxyBuffer)) {
 299         *ppv = (LPVOID)iface;
 300         IRpcProxyBuffer_AddRef(iface);
 301         return S_OK;
 302     }
 303     FIXME("no interface for %s\n",debugstr_guid(riid));
 304     return E_NOINTERFACE;
 305 }
 306
 307 static ULONG WINAPI
 308 TMProxyImpl_AddRef(LPRPCPROXYBUFFER iface) {
 309     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 310
 311     TRACE("()\n");
 312     This->ref++;
 313     return This->ref;
 314 }
 315
 316 static ULONG WINAPI
 317 TMProxyImpl_Release(LPRPCPROXYBUFFER iface) {
 318     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 319
 320     TRACE("()\n");
 321     This->ref--;
 322     if (This->ref) return This->ref;
 323     if (This->chanbuf) IRpcChannelBuffer_Release(This->chanbuf);
 324     HeapFree(GetProcessHeap(),0,This);
 325     return 0;
 326 }
 327
 328 static HRESULT WINAPI
 329 TMProxyImpl_Connect(
 330     LPRPCPROXYBUFFER iface,IRpcChannelBuffer* pRpcChannelBuffer
 331 ) {
 332     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 333
 334     TRACE("(%p)\n",pRpcChannelBuffer);
 335     This->chanbuf = pRpcChannelBuffer;
 336     IRpcChannelBuffer_AddRef(This->chanbuf);
 337     return S_OK;
 338 }
 339
 340 static void WINAPI
 341 TMProxyImpl_Disconnect(LPRPCPROXYBUFFER iface) {
 342     ICOM_THIS_MULTI(TMProxyImpl,lpvtbl2,iface);
 343
 344     FIXME("()\n");
 345     IRpcChannelBuffer_Release(This->chanbuf);
 346     This->chanbuf = NULL;
 347 }
 348
 349
 350 static ICOM_VTABLE(IRpcProxyBuffer) tmproxyvtable = {
 351     ICOM_MSVTABLE_COMPAT_DummyRTTIVALUE
 352     TMProxyImpl_QueryInterface,
 353     TMProxyImpl_AddRef,
 354     TMProxyImpl_Release,
 355     TMProxyImpl_Connect,
 356     TMProxyImpl_Disconnect
 357 };
 358
 359 /* how much space do we use on stack in DWORD steps. */
 360 int const
 361 _argsize(DWORD vt) {
 362     switch (vt) {
 363     case VT_DATE:
 364         return sizeof(DATE)/sizeof(DWORD);
 365     case VT_VARIANT:
 366         return (sizeof(VARIANT)+3)/sizeof(DWORD);
 367     default:
 368         return 1;
 369     }
 370 }
 371
 372 static int
 373 _xsize(TYPEDESC *td) {
 374     switch (td->vt) {
 375     case VT_DATE:
 376         return sizeof(DATE);
 377     case VT_VARIANT:
 378         return sizeof(VARIANT)+3;
 379     case VT_CARRAY: {
 380         int i, arrsize = 1;
 381         ARRAYDESC *adesc = td->u.lpadesc;
 382
 383         for (i=0;i<adesc->cDims;i++)
 384             arrsize *= adesc->rgbounds[i].cElements;
 385         return arrsize*_xsize(&adesc->tdescElem);
 386     }
 387     case VT_UI2:
 388     case VT_I2:
 389         return 2;
 390     case VT_UI1:
 391     case VT_I1:
 392         return 1;
 393     default:
 394         return 4;
 395     }
 396 }
 397
 398 static HRESULT
 399 serialize_param(
 400     ITypeInfo           *tinfo,
 401     BOOL                writeit,
 402     BOOL                debugout,
 403     BOOL                dealloc,
 404     TYPEDESC            *tdesc,
 405     DWORD               *arg,
 406     marshal_state       *buf
 407 ) {
 408     HRESULT hres = S_OK;
 409
 410     TRACE("(tdesc.vt %d)\n",tdesc->vt);
 411
 412     switch (tdesc->vt) {
 413     case VT_EMPTY: /* nothing. empty variant for instance */
 414         return S_OK;
 415     case VT_BOOL:
 416     case VT_ERROR:
 417     case VT_UI4:
 418     case VT_UINT:
 419     case VT_I4:
 420     case VT_R4:
 421     case VT_UI2:
 422     case VT_UI1:
 423         hres = S_OK;
 424         if (debugout) MESSAGE("%lx",*arg);
 425         if (writeit)
 426             hres = xbuf_add(buf,(LPBYTE)arg,sizeof(DWORD));
 427         return hres;
 428     case VT_VARIANT: {
 429         TYPEDESC        tdesc2;
 430         VARIANT         *vt = (VARIANT*)arg;
 431         DWORD           vttype = V_VT(vt);
 432
 433         if (debugout) MESSAGE("Vt(%ld)(",vttype);
 434         tdesc2.vt = vttype;
 435         if (writeit) {
 436             hres = xbuf_add(buf,(LPBYTE)&vttype,sizeof(vttype));
 437             if (hres) return hres;
 438         }
 439         /* need to recurse since we need to free the stuff */
 440         hres = serialize_param(tinfo,writeit,debugout,dealloc,&tdesc2,&(V_I4(vt)),buf);
 441         if (debugout) MESSAGE(")");
 442         return hres;
 443     }
 444     case VT_BSTR: {
 445         if (debugout) {
 446             if (arg)
 447                     MESSAGE("%s",debugstr_w((BSTR)*arg));
 448             else
 449                     MESSAGE("<bstr NULL>");
 450         }
 451         if (writeit) {
 452             if (!*arg) {
 453                 DWORD fakelen = -1;
 454                 hres = xbuf_add(buf,(LPBYTE)&fakelen,4);
 455                 if (hres)
 456                     return hres;
 457             } else {
 458                 DWORD *bstr = ((DWORD*)(*arg))-1;
 459
 460                 hres = xbuf_add(buf,(LPBYTE)bstr,bstr[0]+4);
 461                 if (hres)
 462                     return hres;
 463             }
 464         }
 465         if (dealloc && arg)
 466             SysFreeString((BSTR)arg);
 467         return S_OK;
 468     }
 469     case VT_PTR: {
 470         DWORD cookie;
 471
 472         if (debugout) MESSAGE("*");
 473         if (writeit) {
 474             cookie = *arg ? 0x42424242 : 0;
 475             hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 476             if (hres)
 477                 return hres;
 478         }
 479         if (!*arg) {
 480             if (debugout) MESSAGE("NULL");
 481             return S_OK;
 482         }
 483         hres = serialize_param(tinfo,writeit,debugout,dealloc,tdesc->u.lptdesc,(DWORD*)*arg,buf);
 484         if (dealloc) HeapFree(GetProcessHeap(),0,(LPVOID)arg);
 485         return hres;
 486     }
 487     case VT_UNKNOWN:
 488         if (debugout) MESSAGE("unk(0x%lx)",*arg);
 489         if (writeit)
 490             hres = _marshal_interface(buf,&IID_IUnknown,(LPUNKNOWN)*arg);
 491         return hres;
 492     case VT_DISPATCH:
 493         if (debugout) MESSAGE("idisp(0x%lx)",*arg);
 494         if (writeit)
 495             hres = _marshal_interface(buf,&IID_IDispatch,(LPUNKNOWN)*arg);
 496         return hres;
 497     case VT_VOID:
 498         if (debugout) MESSAGE("<void>");
 499         return S_OK;
 500     case VT_USERDEFINED: {
 501         ITypeInfo       *tinfo2;
 502         TYPEATTR        *tattr;
 503
 504         hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 505         if (hres) {
 506             FIXME("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
 507             return hres;
 508         }
 509         ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 510         switch (tattr->typekind) {
 511         case TKIND_INTERFACE:
 512             if (writeit)
 513                hres=_marshal_interface(buf,&(tattr->guid),(LPUNKNOWN)arg);
 514             break;
 515         case TKIND_RECORD: {
 516             int i;
 517             if (debugout) MESSAGE("{");
 518             for (i=0;i<tattr->cVars;i++) {
 519                 VARDESC *vdesc;
 520                 ELEMDESC *elem2;
 521                 TYPEDESC *tdesc2;
 522
 523                 hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 524                 if (hres) {
 525                     FIXME("Could not get vardesc of %d\n",i);
 526                     return hres;
 527                 }
 528                 /* Need them for hack below */
 529                 /*
 530                 memset(names,0,sizeof(names));
 531                 hres = ITypeInfo_GetNames(tinfo2,vdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
 532                 if (nrofnames > sizeof(names)/sizeof(names[0])) {
 533                     ERR("Need more names!\n");
 534                 }
 535                 if (!hres && debugout)
 536                     MESSAGE("%s=",debugstr_w(names[0]));
 537                 */
 538                 elem2 = &vdesc->elemdescVar;
 539                 tdesc2 = &elem2->tdesc;
 540                 hres = serialize_param(
 541                     tinfo2,
 542                     writeit,
 543                     debugout,
 544                     dealloc,
 545                     tdesc2,
 546                     (DWORD*)(((LPBYTE)arg)+vdesc->u.oInst),
 547                     buf
 548                 );
 549                 if (hres!=S_OK)
 550                     return hres;
 551                 if (debugout && (i<(tattr->cVars-1)))
 552                     MESSAGE(",");
 553             }
 554             if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
 555                 memcpy(&(buf->iid),arg,sizeof(buf->iid));
 556             if (debugout) MESSAGE("}");
 557             break;
 558         }
 559         default:
 560             FIXME("Don't know how to marshal type kind %d\n",tattr->typekind);
 561             hres = E_FAIL;
 562             break;
 563         }
 564         ITypeInfo_Release(tinfo2);
 565         return hres;
 566     }
 567     case VT_CARRAY: {
 568         ARRAYDESC *adesc = tdesc->u.lpadesc;
 569         int i, arrsize = 1;
 570
 571         if (debugout) MESSAGE("carr");
 572         for (i=0;i<adesc->cDims;i++) {
 573             if (debugout) MESSAGE("[%ld]",adesc->rgbounds[i].cElements);
 574             arrsize *= adesc->rgbounds[i].cElements;
 575         }
 576         if (debugout) MESSAGE("[");
 577         for (i=0;i<arrsize;i++) {
 578             hres = serialize_param(tinfo, writeit, debugout, dealloc, &adesc->tdescElem, (DWORD*)((LPBYTE)arg+i*_xsize(&adesc->tdescElem)), buf);
 579             if (hres)
 580                 return hres;
 581             if (debugout && (i<arrsize-1)) MESSAGE(",");
 582         }
 583         if (debugout) MESSAGE("]");
 584         return S_OK;
 585     }
 586     default:
 587         ERR("Unhandled marshal type %d.\n",tdesc->vt);
 588         return S_OK;
 589     }
 590 }
 591
 592 static HRESULT
 593 serialize_LPVOID_ptr(
 594     ITypeInfo           *tinfo,
 595     BOOL                writeit,
 596     BOOL                debugout,
 597     BOOL                dealloc,
 598     TYPEDESC            *tdesc,
 599     DWORD               *arg,
 600     marshal_state       *buf
 601 ) {
 602     HRESULT     hres;
 603     DWORD       cookie;
 604
 605     if ((tdesc->vt != VT_PTR)                   ||
 606         (tdesc->u.lptdesc->vt != VT_PTR)        ||
 607         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
 608     ) {
 609         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
 610         return E_FAIL;
 611     }
 612     cookie = (*arg) ? 0x42424242: 0x0;
 613     if (writeit) {
 614         hres = xbuf_add(buf, (LPVOID)&cookie, sizeof(cookie));
 615         if (hres)
 616             return hres;
 617     }
 618     if (!*arg) {
 619         if (debugout) MESSAGE("<lpvoid NULL>");
 620         return S_OK;
 621     }
 622     if (debugout)
 623         MESSAGE("ppv(%p)",*(LPUNKNOWN*)*arg);
 624     if (writeit) {
 625         hres = _marshal_interface(buf,&(buf->iid),*(LPUNKNOWN*)*arg);
 626         if (hres)
 627             return hres;
 628     }
 629     if (dealloc)
 630         HeapFree(GetProcessHeap(),0,(LPVOID)*arg);
 631     return S_OK;
 632 }
 633
 634 static HRESULT
 635 serialize_DISPPARAM_ptr(
 636     ITypeInfo           *tinfo,
 637     BOOL                writeit,
 638     BOOL                debugout,
 639     BOOL                dealloc,
 640     TYPEDESC            *tdesc,
 641     DWORD               *arg,
 642     marshal_state       *buf
 643 ) {
 644     DWORD       cookie;
 645     HRESULT     hres;
 646     DISPPARAMS  *disp;
 647     int         i;
 648
 649     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
 650         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
 651         return E_FAIL;
 652     }
 653
 654     cookie = *arg ? 0x42424242 : 0x0;
 655     if (writeit) {
 656         hres = xbuf_add(buf,(LPBYTE)&cookie,sizeof(cookie));
 657         if (hres)
 658             return hres;
 659     }
 660     if (!*arg) {
 661         if (debugout) MESSAGE("<DISPPARAMS NULL>");
 662         return S_OK;
 663     }
 664     disp = (DISPPARAMS*)*arg;
 665     if (writeit) {
 666         hres = xbuf_add(buf,(LPBYTE)&disp->cArgs,sizeof(disp->cArgs));
 667         if (hres)
 668             return hres;
 669     }
 670     if (debugout) MESSAGE("D{");
 671     for (i=0;i<disp->cArgs;i++) {
 672         TYPEDESC        vtdesc;
 673
 674         vtdesc.vt = VT_VARIANT;
 675         serialize_param(
 676             tinfo,
 677             writeit,
 678             debugout,
 679             dealloc,
 680             &vtdesc,
 681             (DWORD*)(disp->rgvarg+i),
 682             buf
 683         );
 684         if (debugout && (i<disp->cArgs-1))
 685             MESSAGE(",");
 686     }
 687     if (dealloc)
 688         HeapFree(GetProcessHeap(),0,disp->rgvarg);
 689     if (writeit) {
 690         hres = xbuf_add(buf,(LPBYTE)&disp->cNamedArgs,sizeof(disp->cNamedArgs));
 691         if (hres)
 692             return hres;
 693     }
 694     if (debugout) MESSAGE("}{");
 695     for (i=0;i<disp->cNamedArgs;i++) {
 696         TYPEDESC        vtdesc;
 697
 698         vtdesc.vt = VT_UINT;
 699         serialize_param(
 700             tinfo,
 701             writeit,
 702             debugout,
 703             dealloc,
 704             &vtdesc,
 705             (DWORD*)(disp->rgdispidNamedArgs+i),
 706             buf
 707         );
 708         if (debugout && (i<disp->cNamedArgs-1))
 709             MESSAGE(",");
 710     }
 711     if (debugout) MESSAGE("}");
 712     if (dealloc) {
 713         HeapFree(GetProcessHeap(),0,disp->rgdispidNamedArgs);
 714         HeapFree(GetProcessHeap(),0,disp);
 715     }
 716     return S_OK;
 717 }
 718
 719 static HRESULT
 720 deserialize_param(
 721     ITypeInfo           *tinfo,
 722     BOOL                readit,
 723     BOOL                debugout,
 724     BOOL                alloc,
 725     TYPEDESC            *tdesc,
 726     DWORD               *arg,
 727     marshal_state       *buf
 728 ) {
 729     HRESULT hres = S_OK;
 730
 731     TRACE("vt %d at %p\n",tdesc->vt,arg);
 732
 733     while (1) {
 734         switch (tdesc->vt) {
 735         case VT_EMPTY:
 736             if (debugout) MESSAGE("<empty>");
 737             return S_OK;
 738         case VT_NULL:
 739             if (debugout) MESSAGE("<null>");
 740             return S_OK;
 741         case VT_VARIANT: {
 742             VARIANT     *vt = (VARIANT*)arg;
 743
 744             if (readit) {
 745                 DWORD   vttype;
 746                 TYPEDESC        tdesc2;
 747                 hres = xbuf_get(buf,(LPBYTE)&vttype,sizeof(vttype));
 748                 if (hres) {
 749                     FIXME("vt type not read?\n");
 750                     return hres;
 751                 }
 752                 memset(&tdesc2,0,sizeof(tdesc2));
 753                 tdesc2.vt = vttype;
 754                 V_VT(vt)  = vttype;
 755                 if (debugout) MESSAGE("Vt(%ld)(",vttype);
 756                 hres = deserialize_param(tinfo, readit, debugout, alloc, &tdesc2, &(V_I4(vt)), buf);
 757                 MESSAGE(")");
 758                 return hres;
 759             } else {
 760                 VariantInit(vt);
 761                 return S_OK;
 762             }
 763         }
 764         case VT_ERROR:
 765         case VT_BOOL: case VT_I4: case VT_UI4: case VT_UINT: case VT_R4:
 766         case VT_UI2:
 767         case VT_UI1:
 768             if (readit) {
 769                 hres = xbuf_get(buf,(LPBYTE)arg,sizeof(DWORD));
 770                 if (hres) FIXME("Failed to read integer 4 byte\n");
 771             }
 772             if (debugout) MESSAGE("%lx",*arg);
 773             return hres;
 774         case VT_BSTR: {
 775             WCHAR       *str;
 776             DWORD       len;
 777
 778             if (readit) {
 779                 hres = xbuf_get(buf,(LPBYTE)&len,sizeof(DWORD));
 780                 if (hres) {
 781                     FIXME("failed to read bstr klen\n");
 782                     return hres;
 783                 }
 784                 if (len == -1) {
 785                     *arg = 0;
 786                     if (debugout) MESSAGE("<bstr NULL>");
 787                 } else {
 788                     str  = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,len+sizeof(WCHAR));
 789                     hres = xbuf_get(buf,(LPBYTE)str,len);
 790                     if (hres) {
 791                         FIXME("Failed to read BSTR.\n");
 792                         return hres;
 793                     }
 794                     *arg = (DWORD)SysAllocStringLen(str,len);
 795                     if (debugout) MESSAGE("%s",debugstr_w(str));
 796                     HeapFree(GetProcessHeap(),0,str);
 797                 }
 798             } else {
 799                 *arg = 0;
 800             }
 801             return S_OK;
 802         }
 803         case VT_PTR: {
 804             DWORD       cookie;
 805             BOOL        derefhere = 0;
 806
 807             derefhere = (tdesc->u.lptdesc->vt != VT_USERDEFINED);
 808
 809             if (readit) {
 810                 hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
 811                 if (hres) {
 812                     FIXME("Failed to load pointer cookie.\n");
 813                     return hres;
 814                 }
 815                 if (cookie != 0x42424242) {
 816                     if (debugout) MESSAGE("NULL");
 817                     *arg = 0;
 818                     return S_OK;
 819                 }
 820                 if (debugout) MESSAGE("*");
 821             }
 822             if (alloc) {
 823                 if (derefhere)
 824                     *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,_xsize(tdesc->u.lptdesc));
 825             }
 826             if (derefhere)
 827                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, (LPDWORD)*arg, buf);
 828             else
 829                 return deserialize_param(tinfo, readit, debugout, alloc, tdesc->u.lptdesc, arg, buf);
 830         }
 831         case VT_UNKNOWN:
 832             /* FIXME: UNKNOWN is unknown ..., but allocate 4 byte for it */
 833             if (alloc)
 834                 *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DWORD));
 835             hres = S_OK;
 836             if (readit)
 837                 hres = _unmarshal_interface(buf,&IID_IUnknown,(LPUNKNOWN*)arg);
 838             if (debugout)
 839                 MESSAGE("unk(%p)",arg);
 840             return hres;
 841         case VT_DISPATCH:
 842             hres = S_OK;
 843             if (readit)
 844                 hres = _unmarshal_interface(buf,&IID_IDispatch,(LPUNKNOWN*)arg);
 845             if (debugout)
 846                 MESSAGE("idisp(%p)",arg);
 847             return hres;
 848         case VT_VOID:
 849             if (debugout) MESSAGE("<void>");
 850             return S_OK;
 851         case VT_USERDEFINED: {
 852             ITypeInfo   *tinfo2;
 853             TYPEATTR    *tattr;
 854
 855             hres = ITypeInfo_GetRefTypeInfo(tinfo,tdesc->u.hreftype,&tinfo2);
 856             if (hres) {
 857                 FIXME("Could not get typeinfo of hreftype %lx for VT_USERDEFINED.\n",tdesc->u.hreftype);
 858                 return hres;
 859             }
 860             hres = ITypeInfo_GetTypeAttr(tinfo2,&tattr);
 861             if (hres) {
 862                 FIXME("Could not get typeattr in VT_USERDEFINED.\n");
 863             } else {
 864                 if (alloc)
 865                     *arg = (DWORD)HeapAlloc(GetProcessHeap(),0,tattr->cbSizeInstance);
 866                 switch (tattr->typekind) {
 867                 case TKIND_INTERFACE:
 868                     if (readit)
 869                         hres = _unmarshal_interface(buf,&(tattr->guid),(LPUNKNOWN*)arg);
 870                     break;
 871                 case TKIND_RECORD: {
 872                     int i;
 873
 874                     if (debugout) MESSAGE("{");
 875                     for (i=0;i<tattr->cVars;i++) {
 876                         VARDESC *vdesc;
 877
 878                         hres = ITypeInfo2_GetVarDesc(tinfo2, i, &vdesc);
 879                         if (hres) {
 880                             FIXME("Could not get vardesc of %d\n",i);
 881                             return hres;
 882                         }
 883                         hres = deserialize_param(
 884                             tinfo2,
 885                             readit,
 886                             debugout,
 887                             alloc,
 888                             &vdesc->elemdescVar.tdesc,
 889                             (DWORD*)(((LPBYTE)*arg)+vdesc->u.oInst),
 890                             buf
 891                         );
 892                         if (debugout && (i<tattr->cVars-1)) MESSAGE(",");
 893                     }
 894                     if (buf->thisisiid && (tattr->cbSizeInstance==sizeof(GUID)))
 895                         memcpy(&(buf->iid),(LPBYTE)*arg,sizeof(buf->iid));
 896                     if (debugout) MESSAGE("}");
 897                     break;
 898                 }
 899                 default:
 900                     FIXME("Don't know how to marshal type kind %d\n",tattr->typekind);
 901                     hres = E_FAIL;
 902                     break;
 903                 }
 904             }
 905             if (hres)
 906                 FIXME("failed to stuballoc in TKIND_RECORD.\n");
 907             ITypeInfo_Release(tinfo2);
 908             return hres;
 909         }
 910         case VT_CARRAY: {
 911             /* arg is pointing to the start of the array. */
 912             ARRAYDESC *adesc = tdesc->u.lpadesc;
 913             int         arrsize,i;
 914             arrsize = 1;
 915             if (adesc->cDims > 1) FIXME("cDims > 1 in VT_CARRAY. Does it work?\n");
 916             for (i=0;i<adesc->cDims;i++)
 917                 arrsize *= adesc->rgbounds[i].cElements;
 918             for (i=0;i<arrsize;i++)
 919                 deserialize_param(
 920                     tinfo,
 921                     readit,
 922                     debugout,
 923                     alloc,
 924                     &adesc->tdescElem,
 925                     (DWORD*)((LPBYTE)(arg)+i*_xsize(&adesc->tdescElem)),
 926                     buf
 927                 );
 928             return S_OK;
 929         }
 930         default:
 931             ERR("No handler for VT type %d!\n",tdesc->vt);
 932             return S_OK;
 933         }
 934     }
 935 }
 936
 937 static HRESULT
 938 deserialize_LPVOID_ptr(
 939     ITypeInfo           *tinfo,
 940     BOOL                readit,
 941     BOOL                debugout,
 942     BOOL                alloc,
 943     TYPEDESC            *tdesc,
 944     DWORD               *arg,
 945     marshal_state       *buf
 946 ) {
 947     HRESULT     hres;
 948     DWORD       cookie;
 949
 950     if ((tdesc->vt != VT_PTR)                   ||
 951         (tdesc->u.lptdesc->vt != VT_PTR)        ||
 952         (tdesc->u.lptdesc->u.lptdesc->vt != VT_VOID)
 953     ) {
 954         FIXME("ppvObject not expressed as VT_PTR -> VT_PTR -> VT_VOID?\n");
 955         return E_FAIL;
 956     }
 957     if (alloc)
 958         *arg=(DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(LPVOID));
 959     if (readit) {
 960         hres = xbuf_get(buf, (LPVOID)&cookie, sizeof(cookie));
 961         if (hres)
 962             return hres;
 963         if (cookie != 0x42424242) {
 964             *(DWORD*)*arg = 0;
 965             if (debugout) MESSAGE("<lpvoid NULL>");
 966             return S_OK;
 967         }
 968     }
 969     if (readit) {
 970         hres = _unmarshal_interface(buf,&buf->iid,(LPUNKNOWN*)*arg);
 971         if (hres)
 972             return hres;
 973     }
 974     if (debugout) MESSAGE("ppv(%p)",(LPVOID)*arg);
 975     return S_OK;
 976 }
 977
 978 static HRESULT
 979 deserialize_DISPPARAM_ptr(
 980     ITypeInfo           *tinfo,
 981     BOOL                readit,
 982     BOOL                debugout,
 983     BOOL                alloc,
 984     TYPEDESC            *tdesc,
 985     DWORD               *arg,
 986     marshal_state       *buf
 987 ) {
 988     DWORD       cookie;
 989     DISPPARAMS  *disps;
 990     HRESULT     hres;
 991     int         i;
 992
 993     if ((tdesc->vt != VT_PTR) || (tdesc->u.lptdesc->vt != VT_USERDEFINED)) {
 994         FIXME("DISPPARAMS not expressed as VT_PTR -> VT_USERDEFINED?\n");
 995         return E_FAIL;
 996     }
 997     if (readit) {
 998         hres = xbuf_get(buf,(LPBYTE)&cookie,sizeof(cookie));
 999         if (hres)
1000             return hres;
1001         if (cookie == 0) {
1002             *arg = 0;
1003             if (debugout) MESSAGE("<DISPPARAMS NULL>");
1004             return S_OK;
1005         }
1006     }
1007     if (alloc)
1008         *arg = (DWORD)HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPPARAMS));
1009     disps = (DISPPARAMS*)*arg;
1010     if (!readit)
1011         return S_OK;
1012     hres = xbuf_get(buf, (LPBYTE)&disps->cArgs, sizeof(disps->cArgs));
1013     if (hres)
1014         return hres;
1015     if (alloc)
1016         disps->rgvarg = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(VARIANT)*disps->cArgs);
1017     if (debugout) MESSAGE("D{");
1018     for (i=0; i< disps->cArgs; i++) {
1019         TYPEDESC vdesc;
1020
1021         vdesc.vt = VT_VARIANT;
1022         hres = deserialize_param(
1023             tinfo,
1024             readit,
1025             debugout,
1026             alloc,
1027             &vdesc,
1028             (DWORD*)(disps->rgvarg+i),
1029             buf
1030         );
1031     }
1032     if (debugout) MESSAGE("}{");
1033     hres = xbuf_get(buf, (LPBYTE)&disps->cNamedArgs, sizeof(disps->cNamedArgs));
1034     if (hres)
1035         return hres;
1036     if (disps->cNamedArgs) {
1037         if (alloc)
1038             disps->rgdispidNamedArgs = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(DISPID)*disps->cNamedArgs);
1039         for (i=0; i< disps->cNamedArgs; i++) {
1040             TYPEDESC vdesc;
1041
1042             vdesc.vt = VT_UINT;
1043             hres = deserialize_param(
1044                 tinfo,
1045                 readit,
1046                 debugout,
1047                 alloc,
1048                 &vdesc,
1049                 (DWORD*)(disps->rgdispidNamedArgs+i),
1050                 buf
1051             );
1052             if (debugout && i<(disps->cNamedArgs-1)) MESSAGE(",");
1053         }
1054     }
1055     if (debugout) MESSAGE("}");
1056     return S_OK;
1057 }
1058
1059 /* Searches function, also in inherited interfaces */
1060 static HRESULT
1061 _get_funcdesc(
1062     ITypeInfo *tinfo, int iMethod, FUNCDESC **fdesc, BSTR *iname, BSTR *fname
1063 ) {
1064     int i = 0, j = 0;
1065     HRESULT hres;
1066
1067     if (fname) *fname = NULL;
1068     if (iname) *iname = NULL;
1069
1070     while (1) {
1071         hres = ITypeInfo_GetFuncDesc(tinfo, i, fdesc);
1072         if (hres) {
1073             ITypeInfo   *tinfo2;
1074             HREFTYPE    href;
1075             TYPEATTR    *attr;
1076
1077             hres = ITypeInfo_GetTypeAttr(tinfo, &attr);
1078             if (hres) {
1079                 FIXME("GetTypeAttr failed with %lx\n",hres);
1080                 return hres;
1081             }
1082             /* Not found, so look in inherited ifaces. */
1083             for (j=0;j<attr->cImplTypes;j++) {
1084                 hres = ITypeInfo_GetRefTypeOfImplType(tinfo, j, &href);
1085                 if (hres) {
1086                     FIXME("Did not find a reftype for interface offset %d?\n",j);
1087                     break;
1088                 }
1089                 hres = ITypeInfo_GetRefTypeInfo(tinfo, href, &tinfo2);
1090                 if (hres) {
1091                     FIXME("Did not find a typeinfo for reftype %ld?\n",href);
1092                     continue;
1093                 }
1094                 hres = _get_funcdesc(tinfo2,iMethod,fdesc,iname,fname);
1095                 ITypeInfo_Release(tinfo2);
1096                 if (!hres) return S_OK;
1097             }
1098             return E_FAIL;
1099         }
1100         if (((*fdesc)->oVft/4) == iMethod) {
1101             if (fname)
1102                 ITypeInfo_GetDocumentation(tinfo,(*fdesc)->memid,fname,NULL,NULL,NULL);
1103             if (iname)
1104                 ITypeInfo_GetDocumentation(tinfo,-1,iname,NULL,NULL,NULL);
1105             return S_OK;
1106         }
1107         i++;
1108     }
1109     return E_FAIL;
1110 }
1111
1112 static DWORD
1113 xCall(LPVOID retptr, int method, TMProxyImpl *tpinfo /*, args */) {
1114     DWORD               *args = ((DWORD*)&tpinfo)+1, *xargs;
1115     FUNCDESC            *fdesc;
1116     HRESULT             hres;
1117     int                 i, relaydeb = TRACE_ON(olerelay);
1118     marshal_state       buf;
1119     RPCOLEMESSAGE       msg;
1120     ULONG               status;
1121     BSTR                fname,iname;
1122     BSTR                names[10];
1123     int                 nrofnames;
1124
1125     hres = _get_funcdesc(tpinfo->tinfo,method,&fdesc,&iname,&fname);
1126     if (hres) {
1127         ERR("Did not find typeinfo/funcdesc entry for method %d!\n",method);
1128         return 0;
1129     }
1130
1131     /*dump_FUNCDESC(fdesc);*/
1132     if (relaydeb) {
1133         TRACE_(olerelay)("->");
1134         if (iname)
1135             MESSAGE("%s:",debugstr_w(iname));
1136         if (fname)
1137             MESSAGE("%s(%d)",debugstr_w(fname),method);
1138         else
1139             MESSAGE("%d",method);
1140         MESSAGE("(");
1141         if (iname) SysFreeString(iname);
1142         if (fname) SysFreeString(fname);
1143     }
1144     /* Need them for hack below */
1145     memset(names,0,sizeof(names));
1146     if (ITypeInfo_GetNames(tpinfo->tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames))
1147         nrofnames = 0;
1148     if (nrofnames > sizeof(names)/sizeof(names[0]))
1149         ERR("Need more names!\n");
1150
1151     memset(&buf,0,sizeof(buf));
1152     buf.iid = IID_IUnknown;
1153     if (method == 0) {
1154         xbuf_add(&buf,(LPBYTE)args[0],sizeof(IID));
1155         if (relaydeb) MESSAGE("riid=%s,[out]",debugstr_guid((REFIID)args[0]));
1156     } else {
1157         xargs = args;
1158         for (i=0;i<fdesc->cParams;i++) {
1159             ELEMDESC    *elem = fdesc->lprgelemdescParam+i;
1160             BOOL        isserialized = FALSE;
1161             if (relaydeb) {
1162                 if (i) MESSAGE(",");
1163                 if (i+1<nrofnames && names[i+1])
1164                     MESSAGE("%s=",debugstr_w(names[i+1]));
1165             }
1166             /* No need to marshal other data than FIN */
1167             if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN)) {
1168                 xargs+=_argsize(elem->tdesc.vt);
1169                 if (relaydeb) MESSAGE("[out]");
1170                 continue;
1171             }
1172             if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1173                 /* If the parameter is 'riid', we use it as interface IID
1174                  * for a later ppvObject serialization.
1175                  */
1176                 buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1177
1178                 /* DISPPARAMS* needs special serializer */
1179                 if (!lstrcmpW(names[i+1],pdispparamsW)) {
1180                     hres = serialize_DISPPARAM_ptr(
1181                         tpinfo->tinfo,
1182                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1183                         relaydeb,
1184                         FALSE,
1185                         &elem->tdesc,
1186                         xargs,
1187                         &buf
1188                     );
1189                     isserialized = TRUE;
1190                 }
1191                 if (!lstrcmpW(names[i+1],ppvObjectW)) {
1192                     hres = serialize_LPVOID_ptr(
1193                         tpinfo->tinfo,
1194                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1195                         relaydeb,
1196                         FALSE,
1197                         &elem->tdesc,
1198                         xargs,
1199                         &buf
1200                     );
1201                     if (hres == S_OK)
1202                         isserialized = TRUE;
1203                 }
1204             }
1205             if (!isserialized)
1206                 hres = serialize_param(
1207                     tpinfo->tinfo,
1208                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1209                     relaydeb,
1210                     FALSE,
1211                     &elem->tdesc,
1212                     xargs,
1213                     &buf
1214                 );
1215
1216             if (hres) {
1217                 FIXME("Failed to serialize param, hres %lx\n",hres);
1218                 break;
1219             }
1220             xargs+=_argsize(elem->tdesc.vt);
1221         }
1222     }
1223     if (relaydeb) MESSAGE(")");
1224     memset(&msg,0,sizeof(msg));
1225     msg.cbBuffer = buf.curoff;
1226     msg.iMethod  = method;
1227     hres = IRpcChannelBuffer_GetBuffer(tpinfo->chanbuf,&msg,&(tpinfo->iid));
1228     if (hres) {
1229         FIXME("RpcChannelBuffer GetBuffer failed, %lx\n",hres);
1230         return hres;
1231     }
1232     memcpy(msg.Buffer,buf.base,buf.curoff);
1233     if (relaydeb) MESSAGE("\n");
1234     hres = IRpcChannelBuffer_SendReceive(tpinfo->chanbuf,&msg,&status);
1235     if (hres) {
1236         FIXME("RpcChannelBuffer SendReceive failed, %lx\n",hres);
1237         return hres;
1238     }
1239     relaydeb = TRACE_ON(olerelay);
1240     if (relaydeb) MESSAGE(" = %08lx (",status);
1241     if (buf.base)
1242         buf.base = HeapReAlloc(GetProcessHeap(),0,buf.base,msg.cbBuffer);
1243     else
1244         buf.base = HeapAlloc(GetProcessHeap(),0,msg.cbBuffer);
1245     buf.size = msg.cbBuffer;
1246     memcpy(buf.base,msg.Buffer,buf.size);
1247     buf.curoff = 0;
1248     if (method == 0) {
1249         _unmarshal_interface(&buf,(REFIID)args[0],(LPUNKNOWN*)args[1]);
1250         if (relaydeb) MESSAGE("[in],%p",*((DWORD**)args[1]));
1251     } else {
1252         xargs = args;
1253         for (i=0;i<fdesc->cParams;i++) {
1254             ELEMDESC    *elem = fdesc->lprgelemdescParam+i;
1255             BOOL        isdeserialized = FALSE;
1256
1257             if (relaydeb) {
1258                 if (i) MESSAGE(",");
1259                 if (i+1<nrofnames && names[i+1]) MESSAGE("%s=",debugstr_w(names[i+1]));
1260             }
1261             /* No need to marshal other data than FOUT I think */
1262             if (!(elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT)) {
1263                 xargs += _argsize(elem->tdesc.vt);
1264                 if (relaydeb) MESSAGE("[in]");
1265                 continue;
1266             }
1267             if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1268                 /* If the parameter is 'riid', we use it as interface IID
1269                  * for a later ppvObject serialization.
1270                  */
1271                 buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1272
1273                 /* deserialize DISPPARAM */
1274                 if (!lstrcmpW(names[i+1],pdispparamsW)) {
1275                     hres = deserialize_DISPPARAM_ptr(
1276                         tpinfo->tinfo,
1277                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1278                         relaydeb,
1279                         FALSE,
1280                         &(elem->tdesc),
1281                         xargs,
1282                         &buf
1283                     );
1284                     if (hres) {
1285                         FIXME("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
1286                         break;
1287                     }
1288                     isdeserialized = TRUE;
1289                 }
1290                 if (!lstrcmpW(names[i+1],ppvObjectW)) {
1291                     hres = deserialize_LPVOID_ptr(
1292                         tpinfo->tinfo,
1293                         elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1294                         relaydeb,
1295                         FALSE,
1296                         &elem->tdesc,
1297                         xargs,
1298                         &buf
1299                     );
1300                     if (hres == S_OK)
1301                         isdeserialized = TRUE;
1302                 }
1303             }
1304             if (!isdeserialized)
1305                 hres = deserialize_param(
1306                     tpinfo->tinfo,
1307                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1308                     relaydeb,
1309                     FALSE,
1310                     &(elem->tdesc),
1311                     xargs,
1312                     &buf
1313                 );
1314             if (hres) {
1315                 FIXME("Failed to unmarshall param, hres %lx\n",hres);
1316                 break;
1317             }
1318             xargs += _argsize(elem->tdesc.vt);
1319         }
1320     }
1321     if (relaydeb) MESSAGE(")\n\n");
1322     HeapFree(GetProcessHeap(),0,buf.base);
1323     return status;
1324 }
1325
1326 static HRESULT WINAPI
1327 PSFacBuf_CreateProxy(
1328     LPPSFACTORYBUFFER iface, IUnknown* pUnkOuter, REFIID riid,
1329     IRpcProxyBuffer **ppProxy, LPVOID *ppv
1330 ) {
1331     HRESULT     hres;
1332     ITypeInfo   *tinfo;
1333     int         i, nroffuncs;
1334     FUNCDESC    *fdesc;
1335     TMProxyImpl *proxy;
1336
1337     TRACE("(...%s...)\n",debugstr_guid(riid));
1338     hres = _get_typeinfo_for_iid(riid,&tinfo);
1339     if (hres) {
1340         FIXME("No typeinfo for %s?\n",debugstr_guid(riid));
1341         return hres;
1342     }
1343     nroffuncs = _nroffuncs(tinfo);
1344     proxy = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(TMProxyImpl));
1345     if (!proxy) return E_OUTOFMEMORY;
1346     proxy->asmstubs=HeapAlloc(GetProcessHeap(),0,sizeof(TMAsmProxy)*nroffuncs);
1347
1348     assert(sizeof(TMAsmProxy) == 12);
1349
1350     proxy->lpvtbl = HeapAlloc(GetProcessHeap(),0,sizeof(LPBYTE)*nroffuncs);
1351     for (i=0;i<nroffuncs;i++) {
1352         int             nrofargs;
1353         TMAsmProxy      *xasm = proxy->asmstubs+i;
1354
1355         /* nrofargs without This */
1356         switch (i) {
1357         case 0: nrofargs = 2;
1358                 break;
1359         case 1: case 2: nrofargs = 0;
1360                 break;
1361         default: {
1362                 int j;
1363                 hres = _get_funcdesc(tinfo,i,&fdesc,NULL,NULL);
1364                 if (hres) {
1365                     FIXME("GetFuncDesc %lx should not fail here.\n",hres);
1366                     return hres;
1367                 }
1368                 /* some args take more than 4 byte on the stack */
1369                 nrofargs = 0;
1370                 for (j=0;j<fdesc->cParams;j++)
1371                     nrofargs += _argsize(fdesc->lprgelemdescParam[j].tdesc.vt);
1372
1373                 if (fdesc->callconv != CC_STDCALL) {
1374                     ERR("calling convention is not stdcall????\n");
1375                     return E_FAIL;
1376                 }
1377                 break;
1378             }
1379         }
1380 /* popl %eax    -       return ptr
1381  * pushl <nr>
1382  * pushl %eax
1383  * call xCall
1384  * lret <nr> (+4)
1385  *
1386  *
1387  * arg3 arg2 arg1 <method> <returnptr>
1388  */
1389         xasm->popleax   = 0x58;
1390         xasm->pushlval  = 0x6a;
1391         xasm->nr        = i;
1392         xasm->pushleax  = 0x50;
1393         xasm->lcall     = 0xe8; /* relative jump */
1394         xasm->xcall     = (DWORD)xCall;
1395         xasm->xcall     -= (DWORD)&(xasm->lret);
1396         xasm->lret      = 0xc2;
1397         xasm->bytestopop= (nrofargs+2)*4; /* pop args, This, iMethod */
1398         proxy->lpvtbl[i] = (DWORD)xasm;
1399     }
1400     proxy->lpvtbl2      = &tmproxyvtable;
1401     proxy->ref          = 2;
1402     proxy->tinfo        = tinfo;
1403     memcpy(&proxy->iid,riid,sizeof(*riid));
1404     *ppv                = (LPVOID)proxy;
1405     *ppProxy            = (IRpcProxyBuffer *)&(proxy->lpvtbl2);
1406     return S_OK;
1407 }
1408
1409 typedef struct _TMStubImpl {
1410     ICOM_VTABLE(IRpcStubBuffer) *lpvtbl;
1411     DWORD                       ref;
1412
1413     LPUNKNOWN                   pUnk;
1414     ITypeInfo                   *tinfo;
1415     IID                         iid;
1416 } TMStubImpl;
1417
1418 static HRESULT WINAPI
1419 TMStubImpl_QueryInterface(LPRPCSTUBBUFFER iface, REFIID riid, LPVOID *ppv) {
1420     if (IsEqualIID(riid,&IID_IRpcStubBuffer)||IsEqualIID(riid,&IID_IUnknown)){
1421         *ppv = (LPVOID)iface;
1422         IRpcStubBuffer_AddRef(iface);
1423         return S_OK;
1424     }
1425     FIXME("%s, not supported IID.\n",debugstr_guid(riid));
1426     return E_NOINTERFACE;
1427 }
1428
1429 static ULONG WINAPI
1430 TMStubImpl_AddRef(LPRPCSTUBBUFFER iface) {
1431     ICOM_THIS(TMStubImpl,iface);
1432
1433     This->ref++;
1434     return This->ref;
1435 }
1436
1437 static ULONG WINAPI
1438 TMStubImpl_Release(LPRPCSTUBBUFFER iface) {
1439     ICOM_THIS(TMStubImpl,iface);
1440
1441     This->ref--;
1442     if (This->ref)
1443         return This->ref;
1444     HeapFree(GetProcessHeap(),0,This);
1445     return 0;
1446 }
1447
1448 static HRESULT WINAPI
1449 TMStubImpl_Connect(LPRPCSTUBBUFFER iface, LPUNKNOWN pUnkServer) {
1450     ICOM_THIS(TMStubImpl,iface);
1451
1452     IUnknown_AddRef(pUnkServer);
1453     This->pUnk = pUnkServer;
1454     return S_OK;
1455 }
1456
1457 static void WINAPI
1458 TMStubImpl_Disconnect(LPRPCSTUBBUFFER iface) {
1459     ICOM_THIS(TMStubImpl,iface);
1460
1461     IUnknown_Release(This->pUnk);
1462     This->pUnk = NULL;
1463     return;
1464 }
1465
1466 static HRESULT WINAPI
1467 TMStubImpl_Invoke(
1468     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf
1469 ) {
1470     int         i;
1471     FUNCDESC    *fdesc;
1472     ICOM_THIS(TMStubImpl,iface);
1473     HRESULT     hres;
1474     DWORD       *args, res, *xargs, nrofargs;
1475     marshal_state       buf;
1476     int         nrofnames;
1477     BSTR        names[10];
1478
1479     memset(&buf,0,sizeof(buf));
1480     buf.size    = xmsg->cbBuffer;
1481     buf.base    = xmsg->Buffer;
1482     buf.curoff  = 0;
1483     buf.iid     = IID_IUnknown;
1484
1485     TRACE("...\n");
1486     if (xmsg->iMethod == 0) { /* QI */
1487         IID             xiid;
1488         /* in: IID, out: <iface> */
1489
1490         xbuf_get(&buf,(LPBYTE)&xiid,sizeof(xiid));
1491         buf.curoff = 0;
1492         hres = _marshal_interface(&buf,&xiid,This->pUnk);
1493         xmsg->Buffer    = buf.base; /* Might have been reallocated */
1494         xmsg->cbBuffer  = buf.size;
1495         return hres;
1496     }
1497     hres = _get_funcdesc(This->tinfo,xmsg->iMethod,&fdesc,NULL,NULL);
1498     if (hres) {
1499         FIXME("GetFuncDesc on method %ld failed with %lx\n",xmsg->iMethod,hres);
1500         return hres;
1501     }
1502     /* Need them for hack below */
1503     memset(names,0,sizeof(names));
1504     ITypeInfo_GetNames(This->tinfo,fdesc->memid,names,sizeof(names)/sizeof(names[0]),&nrofnames);
1505     if (nrofnames > sizeof(names)/sizeof(names[0])) {
1506         ERR("Need more names!\n");
1507     }
1508
1509     /*dump_FUNCDESC(fdesc);*/
1510     nrofargs = 0;
1511     for (i=0;i<fdesc->cParams;i++)
1512         nrofargs += _argsize(fdesc->lprgelemdescParam[i].tdesc.vt);
1513     args = HeapAlloc(GetProcessHeap(),0,(nrofargs+1)*sizeof(DWORD));
1514     if (!args) return E_OUTOFMEMORY;
1515
1516     /* Allocate all stuff used by call. */
1517     xargs = args+1;
1518     for (i=0;i<fdesc->cParams;i++) {
1519         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1520         BOOL            isdeserialized = FALSE;
1521
1522         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1523             /* If the parameter is 'riid', we use it as interface IID
1524              * for a later ppvObject serialization.
1525              */
1526             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1527
1528             /* deserialize DISPPARAM */
1529             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1530                 hres = deserialize_DISPPARAM_ptr(
1531                     This->tinfo,
1532                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1533                     FALSE,
1534                     TRUE,
1535                     &(elem->tdesc),
1536                     xargs,
1537                     &buf
1538                 );
1539                 if (hres) {
1540                     FIXME("Failed to deserialize DISPPARAM*, hres %lx\n",hres);
1541                     break;
1542                 }
1543                 isdeserialized = TRUE;
1544             }
1545             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1546                 hres = deserialize_LPVOID_ptr(
1547                     This->tinfo,
1548                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1549                     FALSE,
1550                     TRUE,
1551                     &elem->tdesc,
1552                     xargs,
1553                     &buf
1554                 );
1555                 if (hres == S_OK)
1556                     isdeserialized = TRUE;
1557             }
1558         }
1559         if (!isdeserialized)
1560             hres = deserialize_param(
1561                 This->tinfo,
1562                 elem->u.paramdesc.wParamFlags & PARAMFLAG_FIN,
1563                 FALSE,
1564                 TRUE,
1565                 &(elem->tdesc),
1566                 xargs,
1567                 &buf
1568             );
1569         xargs += _argsize(elem->tdesc.vt);
1570         if (hres) {
1571             FIXME("Failed to deserialize param %s, hres %lx\n",debugstr_w(names[i+1]),hres);
1572             break;
1573         }
1574     }
1575     hres = IUnknown_QueryInterface(This->pUnk,&(This->iid),(LPVOID*)&(args[0]));
1576     if (hres) {
1577         ERR("Does not support iface %s\n",debugstr_guid(&(This->iid)));
1578         return hres;
1579     }
1580     res = _invoke(
1581             (*((LPVOID**)args[0]))[fdesc->oVft/4],
1582             fdesc->callconv,
1583             (xargs-args),
1584             args
1585     );
1586     IUnknown_Release((LPUNKNOWN)args[0]);
1587     buf.curoff = 0;
1588     xargs = args+1;
1589     for (i=0;i<fdesc->cParams;i++) {
1590         ELEMDESC        *elem = fdesc->lprgelemdescParam+i;
1591         BOOL            isserialized = FALSE;
1592
1593         if (((i+1)<nrofnames) && !IsBadStringPtrW(names[i+1],1)) {
1594             /* If the parameter is 'riid', we use it as interface IID
1595              * for a later ppvObject serialization.
1596              */
1597             buf.thisisiid = !lstrcmpW(names[i+1],riidW);
1598
1599             /* DISPPARAMS* needs special serializer */
1600             if (!lstrcmpW(names[i+1],pdispparamsW)) {
1601                 hres = serialize_DISPPARAM_ptr(
1602                     This->tinfo,
1603                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1604                     FALSE,
1605                     TRUE,
1606                     &elem->tdesc,
1607                     xargs,
1608                     &buf
1609                 );
1610                 isserialized = TRUE;
1611             }
1612             if (!lstrcmpW(names[i+1],ppvObjectW)) {
1613                 hres = serialize_LPVOID_ptr(
1614                     This->tinfo,
1615                     elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1616                     FALSE,
1617                     TRUE,
1618                     &elem->tdesc,
1619                     xargs,
1620                     &buf
1621                 );
1622                 if (hres == S_OK)
1623                     isserialized = TRUE;
1624             }
1625         }
1626         if (!isserialized)
1627             hres = serialize_param(
1628                This->tinfo,
1629                elem->u.paramdesc.wParamFlags & PARAMFLAG_FOUT,
1630                FALSE,
1631                TRUE,
1632                &elem->tdesc,
1633                xargs,
1634                &buf
1635             );
1636         xargs += _argsize(elem->tdesc.vt);
1637         if (hres) {
1638             FIXME("Failed to stuballoc param, hres %lx\n",hres);
1639             break;
1640         }
1641     }
1642     /* might need to use IRpcChannelBuffer_GetBuffer ? */
1643     xmsg->cbBuffer      = buf.curoff;
1644     xmsg->Buffer        = buf.base;
1645     HeapFree(GetProcessHeap(),0,args);
1646     return res;
1647 }
1648
1649 static LPRPCSTUBBUFFER WINAPI
1650 TMStubImpl_IsIIDSupported(LPRPCSTUBBUFFER iface, REFIID riid) {
1651     FIXME("Huh (%s)?\n",debugstr_guid(riid));
1652     return NULL;
1653 }
1654
1655 static ULONG WINAPI
1656 TMStubImpl_CountRefs(LPRPCSTUBBUFFER iface) {
1657     ICOM_THIS(TMStubImpl,iface);
1658
1659     return This->ref; /*FIXME? */
1660 }
1661
1662 static HRESULT WINAPI
1663 TMStubImpl_DebugServerQueryInterface(LPRPCSTUBBUFFER iface, LPVOID *ppv) {
1664     return E_NOTIMPL;
1665 }
1666
1667 static void WINAPI
1668 TMStubImpl_DebugServerRelease(LPRPCSTUBBUFFER iface, LPVOID ppv) {
1669     return;
1670 }
1671
1672 ICOM_VTABLE(IRpcStubBuffer) tmstubvtbl = {
1673     ICOM_MSVTABLE_COMPAT_DummyRTTIVALUE
1674     TMStubImpl_QueryInterface,
1675     TMStubImpl_AddRef,
1676     TMStubImpl_Release,
1677     TMStubImpl_Connect,
1678     TMStubImpl_Disconnect,
1679     TMStubImpl_Invoke,
1680     TMStubImpl_IsIIDSupported,
1681     TMStubImpl_CountRefs,
1682     TMStubImpl_DebugServerQueryInterface,
1683     TMStubImpl_DebugServerRelease
1684 };
1685
1686 static HRESULT WINAPI
1687 PSFacBuf_CreateStub(
1688     LPPSFACTORYBUFFER iface, REFIID riid,IUnknown *pUnkServer,
1689     IRpcStubBuffer** ppStub
1690 ) {
1691     HRESULT hres;
1692     ITypeInfo   *tinfo;
1693     TMStubImpl  *stub;
1694
1695     TRACE("(%s,%p,%p)\n",debugstr_guid(riid),pUnkServer,ppStub);
1696     hres = _get_typeinfo_for_iid(riid,&tinfo);
1697     if (hres) {
1698         FIXME("No typeinfo for %s?\n",debugstr_guid(riid));
1699         return hres;
1700     }
1701     stub = HeapAlloc(GetProcessHeap(),HEAP_ZERO_MEMORY,sizeof(TMStubImpl));
1702     if (!stub)
1703         return E_OUTOFMEMORY;
1704     stub->lpvtbl        = &tmstubvtbl;
1705     stub->ref           = 1;
1706     stub->tinfo         = tinfo;
1707     memcpy(&(stub->iid),riid,sizeof(*riid));
1708     hres = IRpcStubBuffer_Connect((LPRPCSTUBBUFFER)stub,pUnkServer);
1709     *ppStub             = (LPRPCSTUBBUFFER)stub;
1710     if (hres)
1711         FIXME("Connect to pUnkServer failed?\n");
1712     return hres;
1713 }
1714
1715 static ICOM_VTABLE(IPSFactoryBuffer) psfacbufvtbl = {
1716     ICOM_MSVTABLE_COMPAT_DummyRTTIVALUE
1717     PSFacBuf_QueryInterface,
1718     PSFacBuf_AddRef,
1719     PSFacBuf_Release,
1720     PSFacBuf_CreateProxy,
1721     PSFacBuf_CreateStub
1722 };
1723
1724 /* This is the whole PSFactoryBuffer object, just the vtableptr */
1725 static ICOM_VTABLE(IPSFactoryBuffer) *lppsfac = &psfacbufvtbl;
1726
1727 /***********************************************************************
1728  *           DllGetClassObject [OLE32.63]
1729  */
1730 HRESULT WINAPI
1731 TypeLibFac_DllGetClassObject(REFCLSID rclsid, REFIID iid,LPVOID *ppv)
1732 {
1733     if (IsEqualIID(iid,&IID_IPSFactoryBuffer)) {
1734         *ppv = &lppsfac;
1735         return S_OK;
1736     }
1737     return E_NOINTERFACE;
1738 }