xref: /reactos/dll/win32/ole32/usrmarshal.c (revision 407c54ba)
1 /*
2  * Miscellaneous Marshaling Routines
3  *
4  * Copyright 2005 Robert Shearman
5  *
6  * This library is free software; you can redistribute it and/or
7  * modify it under the terms of the GNU Lesser General Public
8  * License as published by the Free Software Foundation; either
9  * version 2.1 of the License, or (at your option) any later version.
10  *
11  * This library is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
14  * Lesser General Public License for more details.
15  *
16  * You should have received a copy of the GNU Lesser General Public
17  * License along with this library; if not, write to the Free Software
18  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
19  */
20 
21 #include <stdio.h>
22 #include <stdarg.h>
23 #include <string.h>
24 
25 #define COBJMACROS
26 #define NONAMELESSUNION
27 
28 #include "windef.h"
29 #include "winbase.h"
30 #include "wingdi.h"
31 #include "winuser.h"
32 #include "winerror.h"
33 
34 #include "ole2.h"
35 #include "oleauto.h"
36 #include "rpcproxy.h"
37 
38 #include "wine/unicode.h"
39 #include "wine/debug.h"
40 
41 WINE_DEFAULT_DEBUG_CHANNEL(ole);
42 
43 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align))&~(_Align))
44 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
45 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
46 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
47 
48 #define USER_MARSHAL_PTR_PREFIX \
49   ( (DWORD)'U'         | ( (DWORD)'s' << 8 ) | \
50   ( (DWORD)'e' << 16 ) | ( (DWORD)'r' << 24 ) )
51 
52 static const char* debugstr_user_flags(ULONG *pFlags)
53 {
54     char buf[12];
55     const char* loword;
56     switch (LOWORD(*pFlags))
57     {
58     case MSHCTX_LOCAL:
59         loword="MSHCTX_LOCAL";
60         break;
61     case MSHCTX_NOSHAREDMEM:
62         loword="MSHCTX_NOSHAREDMEM";
63         break;
64     case MSHCTX_DIFFERENTMACHINE:
65         loword="MSHCTX_DIFFERENTMACHINE";
66         break;
67     case MSHCTX_INPROC:
68         loword="MSHCTX_INPROC";
69         break;
70     default:
71         sprintf(buf, "%d", LOWORD(*pFlags));
72         loword=buf;
73     }
74 
75     if (HIWORD(*pFlags) == NDR_LOCAL_DATA_REPRESENTATION)
76         return wine_dbg_sprintf("MAKELONG(%s, NDR_LOCAL_DATA_REPRESENTATION)", loword);
77     else
78         return wine_dbg_sprintf("MAKELONG(%s, 0x%04x)", loword, HIWORD(*pFlags));
79 }
80 
81 /******************************************************************************
82  *           CLIPFORMAT_UserSize [OLE32.@]
83  *
84  * Calculates the buffer size required to marshal a clip format.
85  *
86  * PARAMS
87  *  pFlags       [I] Flags. See notes.
88  *  StartingSize [I] Starting size of the buffer. This value is added on to
89  *                   the buffer size required for the clip format.
90  *  pCF          [I] Clip format to size.
91  *
92  * RETURNS
93  *  The buffer size required to marshal a clip format plus the starting size.
94  *
95  * NOTES
96  *  Even though the function is documented to take a pointer to an unsigned
97  *  long in pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
98  *  the first parameter is an unsigned long.
99  *  This function is only intended to be called by the RPC runtime.
100  */
101 ULONG __RPC_USER CLIPFORMAT_UserSize(ULONG *pFlags, ULONG size, CLIPFORMAT *pCF)
102 {
103     TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), size, pCF);
104 
105     ALIGN_LENGTH(size, 3);
106 
107     size += 8;
108 
109     /* only need to marshal the name if it is not a pre-defined type and
110      * we are going remote */
111     if ((*pCF >= 0xc000) && (LOWORD(*pFlags) == MSHCTX_DIFFERENTMACHINE))
112     {
113         WCHAR format[255];
114         INT ret;
115         size += 3 * sizeof(UINT);
116         /* urg! this function is badly designed because it won't tell us how
117          * much space is needed without doing a dummy run of storing the
118          * name into a buffer */
119         ret = GetClipboardFormatNameW(*pCF, format, sizeof(format)/sizeof(format[0])-1);
120         if (!ret)
121             RaiseException(DV_E_CLIPFORMAT, 0, 0, NULL);
122         size += (ret + 1) * sizeof(WCHAR);
123     }
124     return size;
125 }
126 
127 /******************************************************************************
128  *           CLIPFORMAT_UserMarshal [OLE32.@]
129  *
130  * Marshals a clip format into a buffer.
131  *
132  * PARAMS
133  *  pFlags  [I] Flags. See notes.
134  *  pBuffer [I] Buffer to marshal the clip format into.
135  *  pCF     [I] Clip format to marshal.
136  *
137  * RETURNS
138  *  The end of the marshaled data in the buffer.
139  *
140  * NOTES
141  *  Even though the function is documented to take a pointer to an unsigned
142  *  long in pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
143  *  the first parameter is an unsigned long.
144  *  This function is only intended to be called by the RPC runtime.
145  */
146 unsigned char * __RPC_USER CLIPFORMAT_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, CLIPFORMAT *pCF)
147 {
148     TRACE("(%s, %p, &0x%04x\n", debugstr_user_flags(pFlags), pBuffer, *pCF);
149 
150     ALIGN_POINTER(pBuffer, 3);
151 
152     /* only need to marshal the name if it is not a pre-defined type and
153      * we are going remote */
154     if ((*pCF >= 0xc000) && (LOWORD(*pFlags) == MSHCTX_DIFFERENTMACHINE))
155     {
156         WCHAR format[255];
157         UINT len;
158 
159         *(DWORD *)pBuffer = WDT_REMOTE_CALL;
160         pBuffer += 4;
161         *(DWORD *)pBuffer = *pCF;
162         pBuffer += 4;
163 
164         len = GetClipboardFormatNameW(*pCF, format, sizeof(format)/sizeof(format[0])-1);
165         if (!len)
166             RaiseException(DV_E_CLIPFORMAT, 0, 0, NULL);
167         len += 1;
168         *(UINT *)pBuffer = len;
169         pBuffer += sizeof(UINT);
170         *(UINT *)pBuffer = 0;
171         pBuffer += sizeof(UINT);
172         *(UINT *)pBuffer = len;
173         pBuffer += sizeof(UINT);
174         TRACE("marshaling format name %s\n", debugstr_w(format));
175         memcpy(pBuffer, format, len * sizeof(WCHAR));
176         pBuffer += len * sizeof(WCHAR);
177     }
178     else
179     {
180         *(DWORD *)pBuffer = WDT_INPROC_CALL;
181         pBuffer += 4;
182         *(DWORD *)pBuffer = *pCF;
183         pBuffer += 4;
184     }
185 
186     return pBuffer;
187 }
188 
189 /******************************************************************************
190  *           CLIPFORMAT_UserUnmarshal [OLE32.@]
191  *
192  * Unmarshals a clip format from a buffer.
193  *
194  * PARAMS
195  *  pFlags  [I] Flags. See notes.
196  *  pBuffer [I] Buffer to marshal the clip format from.
197  *  pCF     [O] Address that receive the unmarshaled clip format.
198  *
199  * RETURNS
200  *  The end of the marshaled data in the buffer.
201  *
202  * NOTES
203  *  Even though the function is documented to take a pointer to an unsigned
204  *  long in pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
205  *  the first parameter is an unsigned long.
206  *  This function is only intended to be called by the RPC runtime.
207  */
208 unsigned char * __RPC_USER CLIPFORMAT_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, CLIPFORMAT *pCF)
209 {
210     LONG fContext;
211 
212     TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, pCF);
213 
214     ALIGN_POINTER(pBuffer, 3);
215 
216     fContext = *(DWORD *)pBuffer;
217     pBuffer += 4;
218 
219     if (fContext == WDT_INPROC_CALL)
220     {
221         *pCF = *(CLIPFORMAT *)pBuffer;
222         pBuffer += 4;
223     }
224     else if (fContext == WDT_REMOTE_CALL)
225     {
226         CLIPFORMAT cf;
227         UINT len;
228 
229         /* pointer ID for registered clip format string */
230         if (*(DWORD *)pBuffer == 0)
231             RaiseException(RPC_S_INVALID_BOUND, 0, 0, NULL);
232         pBuffer += 4;
233 
234         len = *(UINT *)pBuffer;
235         pBuffer += sizeof(UINT);
236         if (*(UINT *)pBuffer != 0)
237             RaiseException(RPC_S_INVALID_BOUND, 0, 0, NULL);
238         pBuffer += sizeof(UINT);
239         if (*(UINT *)pBuffer != len)
240             RaiseException(RPC_S_INVALID_BOUND, 0, 0, NULL);
241         pBuffer += sizeof(UINT);
242         if (((WCHAR *)pBuffer)[len - 1] != '\0')
243             RaiseException(RPC_S_INVALID_BOUND, 0, 0, NULL);
244         TRACE("unmarshaling clip format %s\n", debugstr_w((LPCWSTR)pBuffer));
245         cf = RegisterClipboardFormatW((LPCWSTR)pBuffer);
246         pBuffer += len * sizeof(WCHAR);
247         if (!cf)
248             RaiseException(DV_E_CLIPFORMAT, 0, 0, NULL);
249         *pCF = cf;
250     }
251     else
252         /* code not really appropriate, but nearest I can find */
253         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
254     return pBuffer;
255 }
256 
257 /******************************************************************************
258  *           CLIPFORMAT_UserFree [OLE32.@]
259  *
260  * Frees an unmarshaled clip format.
261  *
262  * PARAMS
263  *  pFlags  [I] Flags. See notes.
264  *  pCF     [I] Clip format to free.
265  *
266  * RETURNS
267  *  The end of the marshaled data in the buffer.
268  *
269  * NOTES
270  *  Even though the function is documented to take a pointer to an unsigned
271  *  long in pFlags, it actually takes a pointer to a USER_MARSHAL_CB
272  *  structure, of which the first parameter is an unsigned long.
273  *  This function is only intended to be called by the RPC runtime.
274  */
275 void __RPC_USER CLIPFORMAT_UserFree(ULONG *pFlags, CLIPFORMAT *pCF)
276 {
277     /* there is no inverse of the RegisterClipboardFormat function,
278      * so nothing to do */
279 }
280 
281 static ULONG handle_UserSize(ULONG *pFlags, ULONG StartingSize, HANDLE *handle)
282 {
283     if (LOWORD(*pFlags) == MSHCTX_DIFFERENTMACHINE)
284     {
285         ERR("can't remote a local handle\n");
286         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
287         return StartingSize;
288     }
289 
290     ALIGN_LENGTH(StartingSize, 3);
291     return StartingSize + sizeof(RemotableHandle);
292 }
293 
294 static unsigned char * handle_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, HANDLE *handle)
295 {
296     RemotableHandle *remhandle;
297     if (LOWORD(*pFlags) == MSHCTX_DIFFERENTMACHINE)
298     {
299         ERR("can't remote a local handle\n");
300         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
301         return pBuffer;
302     }
303 
304     ALIGN_POINTER(pBuffer, 3);
305     remhandle = (RemotableHandle *)pBuffer;
306     remhandle->fContext = WDT_INPROC_CALL;
307     remhandle->u.hInproc = (LONG_PTR)*handle;
308     return pBuffer + sizeof(RemotableHandle);
309 }
310 
311 static unsigned char * handle_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, HANDLE *handle)
312 {
313     RemotableHandle *remhandle;
314 
315     ALIGN_POINTER(pBuffer, 3);
316     remhandle = (RemotableHandle *)pBuffer;
317     if (remhandle->fContext != WDT_INPROC_CALL)
318         RaiseException(RPC_X_BAD_STUB_DATA, 0, 0, NULL);
319     *handle = (HANDLE)(LONG_PTR)remhandle->u.hInproc;
320     return pBuffer + sizeof(RemotableHandle);
321 }
322 
323 static void handle_UserFree(ULONG *pFlags, HANDLE *handle)
324 {
325     /* nothing to do */
326 }
327 
328 #define IMPL_WIREM_HANDLE(type) \
329     ULONG __RPC_USER type##_UserSize(ULONG *pFlags, ULONG StartingSize, type *handle) \
330     { \
331         TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), StartingSize, handle); \
332         return handle_UserSize(pFlags, StartingSize, (HANDLE *)handle); \
333     } \
334     \
335     unsigned char * __RPC_USER type##_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, type *handle) \
336     { \
337         TRACE("(%s, %p, &%p\n", debugstr_user_flags(pFlags), pBuffer, *handle); \
338         return handle_UserMarshal(pFlags, pBuffer, (HANDLE *)handle); \
339     } \
340     \
341     unsigned char * __RPC_USER type##_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, type *handle) \
342     { \
343         TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, handle); \
344         return handle_UserUnmarshal(pFlags, pBuffer, (HANDLE *)handle); \
345     } \
346     \
347     void __RPC_USER type##_UserFree(ULONG *pFlags, type *handle) \
348     { \
349         TRACE("(%s, &%p\n", debugstr_user_flags(pFlags), *handle); \
350         handle_UserFree(pFlags, (HANDLE *)handle); \
351     }
352 
353 IMPL_WIREM_HANDLE(HACCEL)
354 IMPL_WIREM_HANDLE(HMENU)
355 IMPL_WIREM_HANDLE(HWND)
356 IMPL_WIREM_HANDLE(HDC)
357 IMPL_WIREM_HANDLE(HICON)
358 IMPL_WIREM_HANDLE(HBRUSH)
359 
360 /******************************************************************************
361  *           HGLOBAL_UserSize [OLE32.@]
362  *
363  * Calculates the buffer size required to marshal an HGLOBAL.
364  *
365  * PARAMS
366  *  pFlags       [I] Flags. See notes.
367  *  StartingSize [I] Starting size of the buffer. This value is added on to
368  *                   the buffer size required for the clip format.
369  *  phGlobal     [I] HGLOBAL to size.
370  *
371  * RETURNS
372  *  The buffer size required to marshal an HGLOBAL plus the starting size.
373  *
374  * NOTES
375  *  Even though the function is documented to take a pointer to a ULONG in
376  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
377  *  the first parameter is a ULONG.
378  *  This function is only intended to be called by the RPC runtime.
379  */
380 ULONG __RPC_USER HGLOBAL_UserSize(ULONG *pFlags, ULONG StartingSize, HGLOBAL *phGlobal)
381 {
382     ULONG size = StartingSize;
383 
384     TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), StartingSize, phGlobal);
385 
386     ALIGN_LENGTH(size, 3);
387 
388     size += sizeof(ULONG);
389 
390     if (LOWORD(*pFlags == MSHCTX_INPROC))
391         size += sizeof(HGLOBAL);
392     else
393     {
394         size += sizeof(ULONG);
395         if (*phGlobal)
396         {
397             SIZE_T ret;
398             size += 3 * sizeof(ULONG);
399             ret = GlobalSize(*phGlobal);
400             size += (ULONG)ret;
401         }
402     }
403 
404     return size;
405 }
406 
407 /******************************************************************************
408  *           HGLOBAL_UserMarshal [OLE32.@]
409  *
410  * Marshals an HGLOBAL into a buffer.
411  *
412  * PARAMS
413  *  pFlags   [I] Flags. See notes.
414  *  pBuffer  [I] Buffer to marshal the clip format into.
415  *  phGlobal [I] HGLOBAL to marshal.
416  *
417  * RETURNS
418  *  The end of the marshaled data in the buffer.
419  *
420  * NOTES
421  *  Even though the function is documented to take a pointer to a ULONG in
422  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
423  *  the first parameter is a ULONG.
424  *  This function is only intended to be called by the RPC runtime.
425  */
426 unsigned char * __RPC_USER HGLOBAL_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, HGLOBAL *phGlobal)
427 {
428     TRACE("(%s, %p, &%p\n", debugstr_user_flags(pFlags), pBuffer, *phGlobal);
429 
430     ALIGN_POINTER(pBuffer, 3);
431 
432     if (LOWORD(*pFlags == MSHCTX_INPROC))
433     {
434         if (sizeof(*phGlobal) == 8)
435             *(ULONG *)pBuffer = WDT_INPROC64_CALL;
436         else
437             *(ULONG *)pBuffer = WDT_INPROC_CALL;
438         pBuffer += sizeof(ULONG);
439         *(HGLOBAL *)pBuffer = *phGlobal;
440         pBuffer += sizeof(HGLOBAL);
441     }
442     else
443     {
444         *(ULONG *)pBuffer = WDT_REMOTE_CALL;
445         pBuffer += sizeof(ULONG);
446         *(ULONG *)pBuffer = HandleToULong(*phGlobal);
447         pBuffer += sizeof(ULONG);
448         if (*phGlobal)
449         {
450             const unsigned char *memory;
451             SIZE_T size = GlobalSize(*phGlobal);
452             *(ULONG *)pBuffer = (ULONG)size;
453             pBuffer += sizeof(ULONG);
454             *(ULONG *)pBuffer = HandleToULong(*phGlobal);
455             pBuffer += sizeof(ULONG);
456             *(ULONG *)pBuffer = (ULONG)size;
457             pBuffer += sizeof(ULONG);
458 
459             memory = GlobalLock(*phGlobal);
460             memcpy(pBuffer, memory, size);
461             pBuffer += size;
462             GlobalUnlock(*phGlobal);
463         }
464     }
465 
466     return pBuffer;
467 }
468 
469 /******************************************************************************
470  *           HGLOBAL_UserUnmarshal [OLE32.@]
471  *
472  * Unmarshals an HGLOBAL from a buffer.
473  *
474  * PARAMS
475  *  pFlags   [I] Flags. See notes.
476  *  pBuffer  [I] Buffer to marshal the clip format from.
477  *  phGlobal [O] Address that receive the unmarshaled HGLOBAL.
478  *
479  * RETURNS
480  *  The end of the marshaled data in the buffer.
481  *
482  * NOTES
483  *  Even though the function is documented to take a pointer to an ULONG in
484  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
485  *  the first parameter is an ULONG.
486  *  This function is only intended to be called by the RPC runtime.
487  */
488 unsigned char * __RPC_USER HGLOBAL_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, HGLOBAL *phGlobal)
489 {
490     ULONG fContext;
491 
492     TRACE("(%s, %p, &%p\n", debugstr_user_flags(pFlags), pBuffer, *phGlobal);
493 
494     ALIGN_POINTER(pBuffer, 3);
495 
496     fContext = *(ULONG *)pBuffer;
497     pBuffer += sizeof(ULONG);
498 
499     if (((fContext == WDT_INPROC_CALL) && (sizeof(*phGlobal) < 8)) ||
500         ((fContext == WDT_INPROC64_CALL) && (sizeof(*phGlobal) == 8)))
501     {
502         *phGlobal = *(HGLOBAL *)pBuffer;
503         pBuffer += sizeof(*phGlobal);
504     }
505     else if (fContext == WDT_REMOTE_CALL)
506     {
507         ULONG handle;
508 
509         handle = *(ULONG *)pBuffer;
510         pBuffer += sizeof(ULONG);
511 
512         if (handle)
513         {
514             ULONG size;
515             void *memory;
516 
517             size = *(ULONG *)pBuffer;
518             pBuffer += sizeof(ULONG);
519             /* redundancy is bad - it means you have to check consistency like
520              * this: */
521             if (*(ULONG *)pBuffer != handle)
522             {
523                 RaiseException(RPC_X_BAD_STUB_DATA, 0, 0, NULL);
524                 return pBuffer;
525             }
526             pBuffer += sizeof(ULONG);
527             /* redundancy is bad - it means you have to check consistency like
528              * this: */
529             if (*(ULONG *)pBuffer != size)
530             {
531                 RaiseException(RPC_X_BAD_STUB_DATA, 0, 0, NULL);
532                 return pBuffer;
533             }
534             pBuffer += sizeof(ULONG);
535 
536             /* FIXME: check size is not too big */
537 
538             *phGlobal = GlobalAlloc(GMEM_MOVEABLE, size);
539             memory = GlobalLock(*phGlobal);
540             memcpy(memory, pBuffer, size);
541             pBuffer += size;
542             GlobalUnlock(*phGlobal);
543         }
544         else
545             *phGlobal = NULL;
546     }
547     else
548         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
549 
550     return pBuffer;
551 }
552 
553 /******************************************************************************
554  *           HGLOBAL_UserFree [OLE32.@]
555  *
556  * Frees an unmarshaled HGLOBAL.
557  *
558  * PARAMS
559  *  pFlags   [I] Flags. See notes.
560  *  phGlobal [I] HGLOBAL to free.
561  *
562  * RETURNS
563  *  The end of the marshaled data in the buffer.
564  *
565  * NOTES
566  *  Even though the function is documented to take a pointer to a ULONG in
567  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
568  *  which the first parameter is a ULONG.
569  *  This function is only intended to be called by the RPC runtime.
570  */
571 void __RPC_USER HGLOBAL_UserFree(ULONG *pFlags, HGLOBAL *phGlobal)
572 {
573     TRACE("(%s, &%p\n", debugstr_user_flags(pFlags), *phGlobal);
574 
575     if (LOWORD(*pFlags != MSHCTX_INPROC) && *phGlobal)
576         GlobalFree(*phGlobal);
577 }
578 
579 /******************************************************************************
580  *           HBITMAP_UserSize [OLE32.@]
581  *
582  * Calculates the buffer size required to marshal a bitmap.
583  *
584  * PARAMS
585  *  pFlags       [I] Flags. See notes.
586  *  StartingSize [I] Starting size of the buffer. This value is added on to
587  *                   the buffer size required for the clip format.
588  *  phBmp        [I] Bitmap to size.
589  *
590  * RETURNS
591  *  The buffer size required to marshal an bitmap plus the starting size.
592  *
593  * NOTES
594  *  Even though the function is documented to take a pointer to a ULONG in
595  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
596  *  the first parameter is a ULONG.
597  *  This function is only intended to be called by the RPC runtime.
598  */
599 ULONG __RPC_USER HBITMAP_UserSize(ULONG *flags, ULONG size, HBITMAP *bmp)
600 {
601     TRACE("(%s, %d, %p)\n", debugstr_user_flags(flags), size, *bmp);
602 
603     ALIGN_LENGTH(size, 3);
604 
605     size += sizeof(ULONG);
606     if (LOWORD(*flags) == MSHCTX_INPROC)
607         size += sizeof(ULONG);
608     else
609     {
610         size += sizeof(ULONG);
611 
612         if (*bmp)
613         {
614             size += sizeof(ULONG);
615             size += FIELD_OFFSET(userBITMAP, cbSize);
616             size += GetBitmapBits(*bmp, 0, NULL);
617         }
618     }
619 
620     return size;
621 }
622 
623 /******************************************************************************
624 *           HBITMAP_UserMarshal [OLE32.@]
625 *
626 * Marshals a bitmap into a buffer.
627 *
628 * PARAMS
629 *  pFlags  [I] Flags. See notes.
630 *  pBuffer [I] Buffer to marshal the clip format into.
631 *  phBmp   [I] Bitmap to marshal.
632 *
633 * RETURNS
634 *  The end of the marshaled data in the buffer.
635 *
636 * NOTES
637 *  Even though the function is documented to take a pointer to a ULONG in
638 *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
639 *  the first parameter is a ULONG.
640 *  This function is only intended to be called by the RPC runtime.
641 */
642 unsigned char * __RPC_USER HBITMAP_UserMarshal(ULONG *flags, unsigned char *buffer, HBITMAP *bmp)
643 {
644     TRACE("(%s, %p, %p)\n", debugstr_user_flags(flags), buffer, *bmp);
645 
646     ALIGN_POINTER(buffer, 3);
647 
648     if (LOWORD(*flags) == MSHCTX_INPROC)
649     {
650         *(ULONG *)buffer = WDT_INPROC_CALL;
651         buffer += sizeof(ULONG);
652         *(ULONG *)buffer = (ULONG)(ULONG_PTR)*bmp;
653         buffer += sizeof(ULONG);
654     }
655     else
656     {
657         *(ULONG *)buffer = WDT_REMOTE_CALL;
658         buffer += sizeof(ULONG);
659         *(ULONG *)buffer = (ULONG)(ULONG_PTR)*bmp;
660         buffer += sizeof(ULONG);
661 
662         if (*bmp)
663         {
664             static const ULONG header_size = FIELD_OFFSET(userBITMAP, cbSize);
665             BITMAP bitmap;
666             ULONG bitmap_size;
667 
668             bitmap_size = GetBitmapBits(*bmp, 0, NULL);
669             *(ULONG *)buffer = bitmap_size;
670             buffer += sizeof(ULONG);
671 
672             GetObjectW(*bmp, sizeof(BITMAP), &bitmap);
673             memcpy(buffer, &bitmap, header_size);
674             buffer += header_size;
675 
676             GetBitmapBits(*bmp, bitmap_size, buffer);
677             buffer += bitmap_size;
678         }
679     }
680     return buffer;
681 }
682 
683 /******************************************************************************
684  *           HBITMAP_UserUnmarshal [OLE32.@]
685  *
686  * Unmarshals a bitmap from a buffer.
687  *
688  * PARAMS
689  *  pFlags   [I] Flags. See notes.
690  *  pBuffer  [I] Buffer to marshal the clip format from.
691  *  phBmp    [O] Address that receive the unmarshaled bitmap.
692  *
693  * RETURNS
694  *  The end of the marshaled data in the buffer.
695  *
696  * NOTES
697  *  Even though the function is documented to take a pointer to an ULONG in
698  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
699  *  the first parameter is an ULONG.
700  *  This function is only intended to be called by the RPC runtime.
701  */
702 unsigned char * __RPC_USER HBITMAP_UserUnmarshal(ULONG *flags, unsigned char *buffer, HBITMAP *bmp)
703 {
704     ULONG context;
705 
706     TRACE("(%s, %p, %p)\n", debugstr_user_flags(flags), buffer, bmp);
707 
708     ALIGN_POINTER(buffer, 3);
709 
710     context = *(ULONG *)buffer;
711     buffer += sizeof(ULONG);
712 
713     if (context == WDT_INPROC_CALL)
714     {
715         *bmp = *(HBITMAP *)buffer;
716         buffer += sizeof(*bmp);
717     }
718     else if (context == WDT_REMOTE_CALL)
719     {
720         ULONG handle = *(ULONG *)buffer;
721         buffer += sizeof(ULONG);
722 
723         if (handle)
724         {
725             static const ULONG header_size = FIELD_OFFSET(userBITMAP, cbSize);
726             BITMAP bitmap;
727             ULONG bitmap_size;
728             unsigned char *bits;
729 
730             bitmap_size = *(ULONG *)buffer;
731             buffer += sizeof(ULONG);
732             bits = HeapAlloc(GetProcessHeap(), 0, bitmap_size);
733 
734             memcpy(&bitmap, buffer, header_size);
735             buffer += header_size;
736 
737             memcpy(bits, buffer, bitmap_size);
738             buffer += bitmap_size;
739 
740             bitmap.bmBits = bits;
741             *bmp = CreateBitmapIndirect(&bitmap);
742 
743             HeapFree(GetProcessHeap(), 0, bits);
744         }
745         else
746             *bmp = NULL;
747     }
748     else
749         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
750 
751     return buffer;
752 }
753 
754 /******************************************************************************
755  *           HBITMAP_UserFree [OLE32.@]
756  *
757  * Frees an unmarshaled bitmap.
758  *
759  * PARAMS
760  *  pFlags   [I] Flags. See notes.
761  *  phBmp    [I] Bitmap to free.
762  *
763  * RETURNS
764  *  The end of the marshaled data in the buffer.
765  *
766  * NOTES
767  *  Even though the function is documented to take a pointer to a ULONG in
768  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
769  *  which the first parameter is a ULONG.
770  *  This function is only intended to be called by the RPC runtime.
771  */
772 void __RPC_USER HBITMAP_UserFree(ULONG *flags, HBITMAP *bmp)
773 {
774     TRACE("(%s, %p)\n", debugstr_user_flags(flags), *bmp);
775 
776     if (LOWORD(*flags) != MSHCTX_INPROC)
777         DeleteObject(*bmp);
778 }
779 
780 /******************************************************************************
781  *           HPALETTE_UserSize [OLE32.@]
782  *
783  * Calculates the buffer size required to marshal a palette.
784  *
785  * PARAMS
786  *  pFlags       [I] Flags. See notes.
787  *  StartingSize [I] Starting size of the buffer. This value is added on to
788  *                   the buffer size required for the clip format.
789  *  phPal        [I] Palette to size.
790  *
791  * RETURNS
792  *  The buffer size required to marshal a palette plus the starting size.
793  *
794  * NOTES
795  *  Even though the function is documented to take a pointer to a ULONG in
796  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
797  *  the first parameter is a ULONG.
798  *  This function is only intended to be called by the RPC runtime.
799  */
800 ULONG __RPC_USER HPALETTE_UserSize(ULONG *pFlags, ULONG StartingSize, HPALETTE *phPal)
801 {
802     FIXME(":stub\n");
803     return StartingSize;
804 }
805 
806 /******************************************************************************
807  *           HPALETTE_UserMarshal [OLE32.@]
808  *
809  * Marshals a palette into a buffer.
810  *
811  * PARAMS
812  *  pFlags  [I] Flags. See notes.
813  *  pBuffer [I] Buffer to marshal the clip format into.
814  *  phPal   [I] Palette to marshal.
815  *
816  * RETURNS
817  *  The end of the marshaled data in the buffer.
818  *
819  * NOTES
820  *  Even though the function is documented to take a pointer to a ULONG in
821  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
822  *  the first parameter is a ULONG.
823  *  This function is only intended to be called by the RPC runtime.
824  */
825 unsigned char * __RPC_USER HPALETTE_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, HPALETTE *phPal)
826 {
827     FIXME(":stub\n");
828     return pBuffer;
829 }
830 
831 /******************************************************************************
832  *           HPALETTE_UserUnmarshal [OLE32.@]
833  *
834  * Unmarshals a palette from a buffer.
835  *
836  * PARAMS
837  *  pFlags   [I] Flags. See notes.
838  *  pBuffer  [I] Buffer to marshal the clip format from.
839  *  phPal    [O] Address that receive the unmarshaled palette.
840  *
841  * RETURNS
842  *  The end of the marshaled data in the buffer.
843  *
844  * NOTES
845  *  Even though the function is documented to take a pointer to an ULONG in
846  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
847  *  the first parameter is an ULONG.
848  *  This function is only intended to be called by the RPC runtime.
849  */
850 unsigned char * __RPC_USER HPALETTE_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, HPALETTE *phPal)
851 {
852     FIXME(":stub\n");
853     return pBuffer;
854 }
855 
856 /******************************************************************************
857  *           HPALETTE_UserFree [OLE32.@]
858  *
859  * Frees an unmarshaled palette.
860  *
861  * PARAMS
862  *  pFlags   [I] Flags. See notes.
863  *  phPal    [I] Palette to free.
864  *
865  * RETURNS
866  *  The end of the marshaled data in the buffer.
867  *
868  * NOTES
869  *  Even though the function is documented to take a pointer to a ULONG in
870  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
871  *  which the first parameter is a ULONG.
872  *  This function is only intended to be called by the RPC runtime.
873  */
874 void __RPC_USER HPALETTE_UserFree(ULONG *pFlags, HPALETTE *phPal)
875 {
876     FIXME(":stub\n");
877 }
878 
879 
880 /******************************************************************************
881  *           HMETAFILE_UserSize [OLE32.@]
882  *
883  * Calculates the buffer size required to marshal a metafile.
884  *
885  * PARAMS
886  *  pFlags       [I] Flags. See notes.
887  *  StartingSize [I] Starting size of the buffer. This value is added on to
888  *                   the buffer size required for the clip format.
889  *  phmf         [I] Metafile to size.
890  *
891  * RETURNS
892  *  The buffer size required to marshal a metafile plus the starting size.
893  *
894  * NOTES
895  *  Even though the function is documented to take a pointer to a ULONG in
896  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
897  *  the first parameter is a ULONG.
898  *  This function is only intended to be called by the RPC runtime.
899  */
900 ULONG __RPC_USER HMETAFILE_UserSize(ULONG *pFlags, ULONG StartingSize, HMETAFILE *phmf)
901 {
902     ULONG size = StartingSize;
903 
904     TRACE("(%s, %d, &%p\n", debugstr_user_flags(pFlags), StartingSize, *phmf);
905 
906     ALIGN_LENGTH(size, 3);
907 
908     size += sizeof(ULONG);
909     if (LOWORD(*pFlags) == MSHCTX_INPROC)
910         size += sizeof(ULONG_PTR);
911     else
912     {
913         size += sizeof(ULONG);
914 
915         if (*phmf)
916         {
917             UINT mfsize;
918 
919             size += 2 * sizeof(ULONG);
920             mfsize = GetMetaFileBitsEx(*phmf, 0, NULL);
921             size += mfsize;
922         }
923     }
924 
925     return size;
926 }
927 
928 /******************************************************************************
929  *           HMETAFILE_UserMarshal [OLE32.@]
930  *
931  * Marshals a metafile into a buffer.
932  *
933  * PARAMS
934  *  pFlags  [I] Flags. See notes.
935  *  pBuffer [I] Buffer to marshal the clip format into.
936  *  phEmf   [I] Metafile to marshal.
937  *
938  * RETURNS
939  *  The end of the marshaled data in the buffer.
940  *
941  * NOTES
942  *  Even though the function is documented to take a pointer to a ULONG in
943  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
944  *  the first parameter is a ULONG.
945  *  This function is only intended to be called by the RPC runtime.
946  */
947 unsigned char * __RPC_USER HMETAFILE_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, HMETAFILE *phmf)
948 {
949     TRACE("(%s, %p, &%p\n", debugstr_user_flags(pFlags), pBuffer, *phmf);
950 
951     ALIGN_POINTER(pBuffer, 3);
952 
953     if (LOWORD(*pFlags) == MSHCTX_INPROC)
954     {
955         if (sizeof(*phmf) == 8)
956             *(ULONG *)pBuffer = WDT_INPROC64_CALL;
957         else
958             *(ULONG *)pBuffer = WDT_INPROC_CALL;
959         pBuffer += sizeof(ULONG);
960         *(HMETAFILE *)pBuffer = *phmf;
961         pBuffer += sizeof(HMETAFILE);
962     }
963     else
964     {
965         *(ULONG *)pBuffer = WDT_REMOTE_CALL;
966         pBuffer += sizeof(ULONG);
967         *(ULONG *)pBuffer = (ULONG)(ULONG_PTR)*phmf;
968         pBuffer += sizeof(ULONG);
969 
970         if (*phmf)
971         {
972             UINT mfsize = GetMetaFileBitsEx(*phmf, 0, NULL);
973 
974             *(ULONG *)pBuffer = mfsize;
975             pBuffer += sizeof(ULONG);
976             *(ULONG *)pBuffer = mfsize;
977             pBuffer += sizeof(ULONG);
978             GetMetaFileBitsEx(*phmf, mfsize, pBuffer);
979             pBuffer += mfsize;
980         }
981     }
982 
983     return pBuffer;
984 }
985 
986 /******************************************************************************
987  *           HMETAFILE_UserUnmarshal [OLE32.@]
988  *
989  * Unmarshals a metafile from a buffer.
990  *
991  * PARAMS
992  *  pFlags   [I] Flags. See notes.
993  *  pBuffer  [I] Buffer to marshal the clip format from.
994  *  phmf     [O] Address that receive the unmarshaled metafile.
995  *
996  * RETURNS
997  *  The end of the marshaled data in the buffer.
998  *
999  * NOTES
1000  *  Even though the function is documented to take a pointer to an ULONG in
1001  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1002  *  the first parameter is an ULONG.
1003  *  This function is only intended to be called by the RPC runtime.
1004  */
1005 unsigned char * __RPC_USER HMETAFILE_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, HMETAFILE *phmf)
1006 {
1007     ULONG fContext;
1008 
1009     TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, phmf);
1010 
1011     ALIGN_POINTER(pBuffer, 3);
1012 
1013     fContext = *(ULONG *)pBuffer;
1014     pBuffer += sizeof(ULONG);
1015 
1016     if (((fContext == WDT_INPROC_CALL) && (sizeof(*phmf) < 8)) ||
1017         ((fContext == WDT_INPROC64_CALL) && (sizeof(*phmf) == 8)))
1018     {
1019         *phmf = *(HMETAFILE *)pBuffer;
1020         pBuffer += sizeof(*phmf);
1021     }
1022     else if (fContext == WDT_REMOTE_CALL)
1023     {
1024         ULONG handle;
1025 
1026         handle = *(ULONG *)pBuffer;
1027         pBuffer += sizeof(ULONG);
1028 
1029         if (handle)
1030         {
1031             ULONG size;
1032             size = *(ULONG *)pBuffer;
1033             pBuffer += sizeof(ULONG);
1034             if (size != *(ULONG *)pBuffer)
1035             {
1036                 RaiseException(RPC_X_BAD_STUB_DATA, 0, 0, NULL);
1037                 return pBuffer;
1038             }
1039             pBuffer += sizeof(ULONG);
1040             *phmf = SetMetaFileBitsEx(size, pBuffer);
1041             pBuffer += size;
1042         }
1043         else
1044             *phmf = NULL;
1045     }
1046     else
1047         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
1048 
1049     return pBuffer;
1050 }
1051 
1052 /******************************************************************************
1053  *           HMETAFILE_UserFree [OLE32.@]
1054  *
1055  * Frees an unmarshaled metafile.
1056  *
1057  * PARAMS
1058  *  pFlags   [I] Flags. See notes.
1059  *  phmf     [I] Metafile to free.
1060  *
1061  * RETURNS
1062  *  The end of the marshaled data in the buffer.
1063  *
1064  * NOTES
1065  *  Even though the function is documented to take a pointer to a ULONG in
1066  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
1067  *  which the first parameter is a ULONG.
1068  *  This function is only intended to be called by the RPC runtime.
1069  */
1070 void __RPC_USER HMETAFILE_UserFree(ULONG *pFlags, HMETAFILE *phmf)
1071 {
1072     TRACE("(%s, &%p\n", debugstr_user_flags(pFlags), *phmf);
1073 
1074     if (LOWORD(*pFlags) != MSHCTX_INPROC)
1075         DeleteMetaFile(*phmf);
1076 }
1077 
1078 /******************************************************************************
1079 *           HENHMETAFILE_UserSize [OLE32.@]
1080 *
1081 * Calculates the buffer size required to marshal an enhanced metafile.
1082 *
1083 * PARAMS
1084 *  pFlags       [I] Flags. See notes.
1085 *  StartingSize [I] Starting size of the buffer. This value is added on to
1086 *                   the buffer size required for the clip format.
1087 *  phEmf        [I] Enhanced metafile to size.
1088 *
1089 * RETURNS
1090 *  The buffer size required to marshal an enhanced metafile plus the starting size.
1091 *
1092 * NOTES
1093 *  Even though the function is documented to take a pointer to a ULONG in
1094 *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1095 *  the first parameter is a ULONG.
1096 *  This function is only intended to be called by the RPC runtime.
1097 */
1098 ULONG __RPC_USER HENHMETAFILE_UserSize(ULONG *pFlags, ULONG size, HENHMETAFILE *phEmf)
1099 {
1100     TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), size, *phEmf);
1101 
1102     ALIGN_LENGTH(size, 3);
1103 
1104     size += sizeof(ULONG);
1105     if (LOWORD(*pFlags) == MSHCTX_INPROC)
1106         size += sizeof(ULONG_PTR);
1107     else
1108     {
1109         size += sizeof(ULONG);
1110 
1111         if (*phEmf)
1112         {
1113             UINT emfsize;
1114 
1115             size += 2 * sizeof(ULONG);
1116             emfsize = GetEnhMetaFileBits(*phEmf, 0, NULL);
1117             size += emfsize;
1118         }
1119     }
1120 
1121     return size;
1122 }
1123 
1124 /******************************************************************************
1125  *           HENHMETAFILE_UserMarshal [OLE32.@]
1126  *
1127  * Marshals an enhance metafile into a buffer.
1128  *
1129  * PARAMS
1130  *  pFlags  [I] Flags. See notes.
1131  *  pBuffer [I] Buffer to marshal the clip format into.
1132  *  phEmf   [I] Enhanced metafile to marshal.
1133  *
1134  * RETURNS
1135  *  The end of the marshaled data in the buffer.
1136  *
1137  * NOTES
1138  *  Even though the function is documented to take a pointer to a ULONG in
1139  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1140  *  the first parameter is a ULONG.
1141  *  This function is only intended to be called by the RPC runtime.
1142  */
1143 unsigned char * __RPC_USER HENHMETAFILE_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, HENHMETAFILE *phEmf)
1144 {
1145     TRACE("(%s, %p, &%p\n", debugstr_user_flags(pFlags), pBuffer, *phEmf);
1146 
1147     ALIGN_POINTER(pBuffer, 3);
1148 
1149     if (LOWORD(*pFlags) == MSHCTX_INPROC)
1150     {
1151         if (sizeof(*phEmf) == 8)
1152             *(ULONG *)pBuffer = WDT_INPROC64_CALL;
1153         else
1154             *(ULONG *)pBuffer = WDT_INPROC_CALL;
1155         pBuffer += sizeof(ULONG);
1156         *(HENHMETAFILE *)pBuffer = *phEmf;
1157         pBuffer += sizeof(HENHMETAFILE);
1158     }
1159     else
1160     {
1161         *(ULONG *)pBuffer = WDT_REMOTE_CALL;
1162         pBuffer += sizeof(ULONG);
1163         *(ULONG *)pBuffer = (ULONG)(ULONG_PTR)*phEmf;
1164         pBuffer += sizeof(ULONG);
1165 
1166         if (*phEmf)
1167         {
1168             UINT emfsize = GetEnhMetaFileBits(*phEmf, 0, NULL);
1169 
1170             *(ULONG *)pBuffer = emfsize;
1171             pBuffer += sizeof(ULONG);
1172             *(ULONG *)pBuffer = emfsize;
1173             pBuffer += sizeof(ULONG);
1174             GetEnhMetaFileBits(*phEmf, emfsize, pBuffer);
1175             pBuffer += emfsize;
1176         }
1177     }
1178 
1179     return pBuffer;
1180 }
1181 
1182 /******************************************************************************
1183  *           HENHMETAFILE_UserUnmarshal [OLE32.@]
1184  *
1185  * Unmarshals an enhanced metafile from a buffer.
1186  *
1187  * PARAMS
1188  *  pFlags   [I] Flags. See notes.
1189  *  pBuffer  [I] Buffer to marshal the clip format from.
1190  *  phEmf    [O] Address that receive the unmarshaled enhanced metafile.
1191  *
1192  * RETURNS
1193  *  The end of the marshaled data in the buffer.
1194  *
1195  * NOTES
1196  *  Even though the function is documented to take a pointer to an ULONG in
1197  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1198  *  the first parameter is an ULONG.
1199  *  This function is only intended to be called by the RPC runtime.
1200  */
1201 unsigned char * __RPC_USER HENHMETAFILE_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, HENHMETAFILE *phEmf)
1202 {
1203     ULONG fContext;
1204 
1205     TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, phEmf);
1206 
1207     ALIGN_POINTER(pBuffer, 3);
1208 
1209     fContext = *(ULONG *)pBuffer;
1210     pBuffer += sizeof(ULONG);
1211 
1212     if (((fContext == WDT_INPROC_CALL) && (sizeof(*phEmf) < 8)) ||
1213         ((fContext == WDT_INPROC64_CALL) && (sizeof(*phEmf) == 8)))
1214     {
1215         *phEmf = *(HENHMETAFILE *)pBuffer;
1216         pBuffer += sizeof(*phEmf);
1217     }
1218     else if (fContext == WDT_REMOTE_CALL)
1219     {
1220         ULONG handle;
1221 
1222         handle = *(ULONG *)pBuffer;
1223         pBuffer += sizeof(ULONG);
1224 
1225         if (handle)
1226         {
1227             ULONG size;
1228             size = *(ULONG *)pBuffer;
1229             pBuffer += sizeof(ULONG);
1230             if (size != *(ULONG *)pBuffer)
1231             {
1232                 RaiseException(RPC_X_BAD_STUB_DATA, 0, 0, NULL);
1233                 return pBuffer;
1234             }
1235             pBuffer += sizeof(ULONG);
1236             *phEmf = SetEnhMetaFileBits(size, pBuffer);
1237             pBuffer += size;
1238         }
1239         else
1240             *phEmf = NULL;
1241     }
1242     else
1243         RaiseException(RPC_S_INVALID_TAG, 0, 0, NULL);
1244 
1245     return pBuffer;
1246 }
1247 
1248 /******************************************************************************
1249  *           HENHMETAFILE_UserFree [OLE32.@]
1250  *
1251  * Frees an unmarshaled enhanced metafile.
1252  *
1253  * PARAMS
1254  *  pFlags   [I] Flags. See notes.
1255  *  phEmf    [I] Enhanced metafile to free.
1256  *
1257  * RETURNS
1258  *  The end of the marshaled data in the buffer.
1259  *
1260  * NOTES
1261  *  Even though the function is documented to take a pointer to a ULONG in
1262  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
1263  *  which the first parameter is a ULONG.
1264  *  This function is only intended to be called by the RPC runtime.
1265  */
1266 void __RPC_USER HENHMETAFILE_UserFree(ULONG *pFlags, HENHMETAFILE *phEmf)
1267 {
1268     TRACE("(%s, &%p\n", debugstr_user_flags(pFlags), *phEmf);
1269 
1270     if (LOWORD(*pFlags) != MSHCTX_INPROC)
1271         DeleteEnhMetaFile(*phEmf);
1272 }
1273 
1274 /******************************************************************************
1275  *           HMETAFILEPICT_UserSize [OLE32.@]
1276  *
1277  * Calculates the buffer size required to marshal an metafile pict.
1278  *
1279  * PARAMS
1280  *  pFlags       [I] Flags. See notes.
1281  *  StartingSize [I] Starting size of the buffer. This value is added on to
1282  *                   the buffer size required for the clip format.
1283  *  phMfp        [I] Metafile pict to size.
1284  *
1285  * RETURNS
1286  *  The buffer size required to marshal a metafile pict plus the starting size.
1287  *
1288  * NOTES
1289  *  Even though the function is documented to take a pointer to a ULONG in
1290  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1291  *  the first parameter is a ULONG.
1292  *  This function is only intended to be called by the RPC runtime.
1293  */
1294 ULONG __RPC_USER HMETAFILEPICT_UserSize(ULONG *pFlags, ULONG size, HMETAFILEPICT *phMfp)
1295 {
1296     TRACE("(%s, %d, &%p)\n", debugstr_user_flags(pFlags), size, *phMfp);
1297 
1298     ALIGN_LENGTH(size, 3);
1299 
1300     size += sizeof(ULONG);
1301 
1302     if(LOWORD(*pFlags) == MSHCTX_INPROC)
1303         size += sizeof(HMETAFILEPICT);
1304     else
1305     {
1306         size += sizeof(ULONG);
1307 
1308         if (*phMfp)
1309         {
1310             METAFILEPICT *mfpict = GlobalLock(*phMfp);
1311 
1312             /* FIXME: raise an exception if mfpict is NULL? */
1313             size += 3 * sizeof(ULONG);
1314             size += sizeof(ULONG);
1315 
1316             size = HMETAFILE_UserSize(pFlags, size, &mfpict->hMF);
1317 
1318             GlobalUnlock(*phMfp);
1319         }
1320     }
1321 
1322     return size;
1323 }
1324 
1325 /******************************************************************************
1326  *           HMETAFILEPICT_UserMarshal [OLE32.@]
1327  *
1328  * Marshals a metafile pict into a buffer.
1329  *
1330  * PARAMS
1331  *  pFlags  [I] Flags. See notes.
1332  *  pBuffer [I] Buffer to marshal the clip format into.
1333  *  phMfp   [I] Metafile pict to marshal.
1334  *
1335  * RETURNS
1336  *  The end of the marshaled data in the buffer.
1337  *
1338  * NOTES
1339  *  Even though the function is documented to take a pointer to a ULONG in
1340  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1341  *  the first parameter is a ULONG.
1342  *  This function is only intended to be called by the RPC runtime.
1343  */
1344 unsigned char * __RPC_USER HMETAFILEPICT_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, HMETAFILEPICT *phMfp)
1345 {
1346     TRACE("(%s, %p, &%p)\n", debugstr_user_flags(pFlags), pBuffer, *phMfp);
1347 
1348     ALIGN_POINTER(pBuffer, 3);
1349 
1350     if (LOWORD(*pFlags) == MSHCTX_INPROC)
1351     {
1352         if (sizeof(HMETAFILEPICT) == 8)
1353             *(ULONG *)pBuffer = WDT_INPROC64_CALL;
1354         else
1355             *(ULONG *)pBuffer = WDT_INPROC_CALL;
1356         pBuffer += sizeof(ULONG);
1357         *(HMETAFILEPICT *)pBuffer = *phMfp;
1358         pBuffer += sizeof(HMETAFILEPICT);
1359     }
1360     else
1361     {
1362         *(ULONG *)pBuffer = WDT_REMOTE_CALL;
1363         pBuffer += sizeof(ULONG);
1364         *(ULONG *)pBuffer = (ULONG)(ULONG_PTR)*phMfp;
1365         pBuffer += sizeof(ULONG);
1366 
1367         if (*phMfp)
1368         {
1369             METAFILEPICT *mfpict = GlobalLock(*phMfp);
1370             remoteMETAFILEPICT * remmfpict = (remoteMETAFILEPICT *)pBuffer;
1371 
1372             /* FIXME: raise an exception if mfpict is NULL? */
1373             remmfpict->mm = mfpict->mm;
1374             remmfpict->xExt = mfpict->xExt;
1375             remmfpict->yExt = mfpict->yExt;
1376             pBuffer += 3 * sizeof(ULONG);
1377             *(ULONG *)pBuffer = USER_MARSHAL_PTR_PREFIX;
1378             pBuffer += sizeof(ULONG);
1379 
1380             pBuffer = HMETAFILE_UserMarshal(pFlags, pBuffer, &mfpict->hMF);
1381 
1382             GlobalUnlock(*phMfp);
1383         }
1384     }
1385     return pBuffer;
1386 }
1387 
1388 /******************************************************************************
1389  *           HMETAFILEPICT_UserUnmarshal [OLE32.@]
1390  *
1391  * Unmarshals an metafile pict from a buffer.
1392  *
1393  * PARAMS
1394  *  pFlags   [I] Flags. See notes.
1395  *  pBuffer  [I] Buffer to marshal the clip format from.
1396  *  phMfp    [O] Address that receive the unmarshaled metafile pict.
1397  *
1398  * RETURNS
1399  *  The end of the marshaled data in the buffer.
1400  *
1401  * NOTES
1402  *  Even though the function is documented to take a pointer to an ULONG in
1403  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1404  *  the first parameter is an ULONG.
1405  *  This function is only intended to be called by the RPC runtime.
1406  */
1407 unsigned char * __RPC_USER HMETAFILEPICT_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, HMETAFILEPICT *phMfp)
1408 {
1409     ULONG fContext;
1410 
1411     TRACE("(%s, %p, %p)\n", debugstr_user_flags(pFlags), pBuffer, phMfp);
1412 
1413     ALIGN_POINTER(pBuffer, 3);
1414 
1415     fContext = *(ULONG *)pBuffer;
1416     pBuffer += sizeof(ULONG);
1417 
1418     if ((fContext == WDT_INPROC_CALL) || fContext == WDT_INPROC64_CALL)
1419     {
1420         *phMfp = *(HMETAFILEPICT *)pBuffer;
1421         pBuffer += sizeof(HMETAFILEPICT);
1422     }
1423     else
1424     {
1425         ULONG handle = *(ULONG *)pBuffer;
1426         pBuffer += sizeof(ULONG);
1427         *phMfp = NULL;
1428 
1429         if(handle)
1430         {
1431             METAFILEPICT *mfpict;
1432             const remoteMETAFILEPICT *remmfpict;
1433             ULONG user_marshal_prefix;
1434 
1435             remmfpict = (const remoteMETAFILEPICT *)pBuffer;
1436 
1437             *phMfp = GlobalAlloc(GMEM_MOVEABLE, sizeof(METAFILEPICT));
1438             if (!*phMfp)
1439                 RpcRaiseException(E_OUTOFMEMORY);
1440 
1441             mfpict = GlobalLock(*phMfp);
1442             mfpict->mm = remmfpict->mm;
1443             mfpict->xExt = remmfpict->xExt;
1444             mfpict->yExt = remmfpict->yExt;
1445             pBuffer += 3 * sizeof(ULONG);
1446             user_marshal_prefix = *(ULONG *)pBuffer;
1447             pBuffer += sizeof(ULONG);
1448 
1449             if (user_marshal_prefix != USER_MARSHAL_PTR_PREFIX)
1450                 RpcRaiseException(RPC_X_INVALID_TAG);
1451 
1452             pBuffer = HMETAFILE_UserUnmarshal(pFlags, pBuffer, &mfpict->hMF);
1453 
1454             GlobalUnlock(*phMfp);
1455         }
1456     }
1457     return pBuffer;
1458 }
1459 
1460 /******************************************************************************
1461  *           HMETAFILEPICT_UserFree [OLE32.@]
1462  *
1463  * Frees an unmarshaled metafile pict.
1464  *
1465  * PARAMS
1466  *  pFlags   [I] Flags. See notes.
1467  *  phMfp    [I] Metafile pict to free.
1468  *
1469  * RETURNS
1470  *  The end of the marshaled data in the buffer.
1471  *
1472  * NOTES
1473  *  Even though the function is documented to take a pointer to a ULONG in
1474  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
1475  *  which the first parameter is a ULONG.
1476  *  This function is only intended to be called by the RPC runtime.
1477  */
1478 void __RPC_USER HMETAFILEPICT_UserFree(ULONG *pFlags, HMETAFILEPICT *phMfp)
1479 {
1480     TRACE("(%s, &%p)\n", debugstr_user_flags(pFlags), *phMfp);
1481 
1482     if ((LOWORD(*pFlags) != MSHCTX_INPROC) && *phMfp)
1483     {
1484         METAFILEPICT *mfpict;
1485 
1486         mfpict = GlobalLock(*phMfp);
1487         /* FIXME: raise an exception if mfpict is NULL? */
1488         HMETAFILE_UserFree(pFlags, &mfpict->hMF);
1489         GlobalUnlock(*phMfp);
1490 
1491         GlobalFree(*phMfp);
1492     }
1493 }
1494 
1495 /******************************************************************************
1496  *           WdtpInterfacePointer_UserSize [OLE32.@]
1497  *
1498  * Calculates the buffer size required to marshal an interface pointer.
1499  *
1500  * PARAMS
1501  *  pFlags       [I] Flags. See notes.
1502  *  RealFlags    [I] The MSHCTX to use when marshaling the interface.
1503  *  punk         [I] Interface pointer to size.
1504  *  StartingSize [I] Starting size of the buffer. This value is added on to
1505  *                   the buffer size required for the clip format.
1506  *  riid         [I] ID of interface to size.
1507  *
1508  * RETURNS
1509  *  The buffer size required to marshal an interface pointer plus the starting size.
1510  *
1511  * NOTES
1512  *  Even though the function is documented to take a pointer to a ULONG in
1513  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1514  *  the first parameter is a ULONG.
1515  */
1516 ULONG __RPC_USER WdtpInterfacePointer_UserSize(ULONG *pFlags, ULONG RealFlags, ULONG StartingSize, IUnknown *punk, REFIID riid)
1517 {
1518     DWORD marshal_size = 0;
1519     HRESULT hr;
1520 
1521     TRACE("(%s, 0%x, %d, %p, %s)\n", debugstr_user_flags(pFlags), RealFlags, StartingSize, punk, debugstr_guid(riid));
1522 
1523     hr = CoGetMarshalSizeMax(&marshal_size, riid, punk, LOWORD(RealFlags), NULL, MSHLFLAGS_NORMAL);
1524     if(FAILED(hr)) return StartingSize;
1525 
1526     ALIGN_LENGTH(StartingSize, 3);
1527     StartingSize += 2 * sizeof(DWORD);
1528     return StartingSize + marshal_size;
1529 }
1530 
1531 /******************************************************************************
1532  *           WdtpInterfacePointer_UserMarshal [OLE32.@]
1533  *
1534  * Marshals an interface pointer into a buffer.
1535  *
1536  * PARAMS
1537  *  pFlags    [I] Flags. See notes.
1538  *  RealFlags [I] The MSHCTX to use when marshaling the interface.
1539  *  pBuffer   [I] Buffer to marshal the clip format into.
1540  *  punk      [I] Interface pointer to marshal.
1541  *  riid      [I] ID of interface to marshal.
1542  *
1543  * RETURNS
1544  *  The end of the marshaled data in the buffer.
1545  *
1546  * NOTES
1547  *  Even though the function is documented to take a pointer to a ULONG in
1548  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1549  *  the first parameter is a ULONG.
1550  */
1551 unsigned char * WINAPI WdtpInterfacePointer_UserMarshal(ULONG *pFlags, ULONG RealFlags, unsigned char *pBuffer, IUnknown *punk, REFIID riid)
1552 {
1553     HGLOBAL h = GlobalAlloc(GMEM_MOVEABLE, 0);
1554     IStream *stm;
1555     DWORD size;
1556     void *ptr;
1557 
1558     TRACE("(%s, 0x%x, %p, &%p, %s)\n", debugstr_user_flags(pFlags), RealFlags, pBuffer, punk, debugstr_guid(riid));
1559 
1560     if(!h) return NULL;
1561     if(CreateStreamOnHGlobal(h, TRUE, &stm) != S_OK)
1562     {
1563         GlobalFree(h);
1564         return NULL;
1565     }
1566 
1567     if(CoMarshalInterface(stm, riid, punk, LOWORD(RealFlags), NULL, MSHLFLAGS_NORMAL) != S_OK)
1568     {
1569         IStream_Release(stm);
1570         return pBuffer;
1571     }
1572 
1573     ALIGN_POINTER(pBuffer, 3);
1574     size = GlobalSize(h);
1575 
1576     *(DWORD *)pBuffer = size;
1577     pBuffer += sizeof(DWORD);
1578     *(DWORD *)pBuffer = size;
1579     pBuffer += sizeof(DWORD);
1580 
1581     ptr = GlobalLock(h);
1582     memcpy(pBuffer, ptr, size);
1583     GlobalUnlock(h);
1584 
1585     IStream_Release(stm);
1586     return pBuffer + size;
1587 }
1588 
1589 /******************************************************************************
1590  *           WdtpInterfacePointer_UserUnmarshal [OLE32.@]
1591  *
1592  * Unmarshals an interface pointer from a buffer.
1593  *
1594  * PARAMS
1595  *  pFlags   [I] Flags. See notes.
1596  *  pBuffer  [I] Buffer to marshal the clip format from.
1597  *  ppunk    [I/O] Address that receives the unmarshaled interface pointer.
1598  *  riid     [I] ID of interface to unmarshal.
1599  *
1600  * RETURNS
1601  *  The end of the marshaled data in the buffer.
1602  *
1603  * NOTES
1604  *  Even though the function is documented to take a pointer to an ULONG in
1605  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1606  *  the first parameter is an ULONG.
1607  */
1608 unsigned char * WINAPI WdtpInterfacePointer_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, IUnknown **ppunk, REFIID riid)
1609 {
1610     HRESULT hr;
1611     HGLOBAL h;
1612     IStream *stm;
1613     DWORD size;
1614     void *ptr;
1615     IUnknown *orig;
1616 
1617     TRACE("(%s, %p, %p, %s)\n", debugstr_user_flags(pFlags), pBuffer, ppunk, debugstr_guid(riid));
1618 
1619     ALIGN_POINTER(pBuffer, 3);
1620 
1621     size = *(DWORD *)pBuffer;
1622     pBuffer += sizeof(DWORD);
1623     if(size != *(DWORD *)pBuffer)
1624         RaiseException(RPC_X_BAD_STUB_DATA, 0, 0, NULL);
1625 
1626     pBuffer += sizeof(DWORD);
1627 
1628     /* FIXME: sanity check on size */
1629 
1630     h = GlobalAlloc(GMEM_MOVEABLE, size);
1631     if(!h) RaiseException(RPC_X_NO_MEMORY, 0, 0, NULL);
1632 
1633     if(CreateStreamOnHGlobal(h, TRUE, &stm) != S_OK)
1634     {
1635         GlobalFree(h);
1636         RaiseException(RPC_X_NO_MEMORY, 0, 0, NULL);
1637     }
1638 
1639     ptr = GlobalLock(h);
1640     memcpy(ptr, pBuffer, size);
1641     GlobalUnlock(h);
1642 
1643     orig = *ppunk;
1644     hr = CoUnmarshalInterface(stm, riid, (void**)ppunk);
1645     IStream_Release(stm);
1646 
1647     if(hr != S_OK) RaiseException(hr, 0, 0, NULL);
1648 
1649     if(orig) IUnknown_Release(orig);
1650 
1651     return pBuffer + size;
1652 }
1653 
1654 /******************************************************************************
1655  *           WdtpInterfacePointer_UserFree [OLE32.@]
1656  *
1657  * Releases an unmarshaled interface pointer.
1658  *
1659  * PARAMS
1660  *  punk    [I] Interface pointer to release.
1661  *
1662  * RETURNS
1663  *  Nothing.
1664  */
1665 void WINAPI WdtpInterfacePointer_UserFree(IUnknown *punk)
1666 {
1667     TRACE("(%p)\n", punk);
1668     if(punk) IUnknown_Release(punk);
1669 }
1670 
1671 /******************************************************************************
1672 *           STGMEDIUM_UserSize [OLE32.@]
1673 *
1674 * Calculates the buffer size required to marshal an STGMEDIUM.
1675 *
1676 * PARAMS
1677 *  pFlags       [I] Flags. See notes.
1678 *  StartingSize [I] Starting size of the buffer. This value is added on to
1679 *                   the buffer size required for the clip format.
1680 *  pStgMedium   [I] STGMEDIUM to size.
1681 *
1682 * RETURNS
1683 *  The buffer size required to marshal an STGMEDIUM plus the starting size.
1684 *
1685 * NOTES
1686 *  Even though the function is documented to take a pointer to a ULONG in
1687 *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1688 *  the first parameter is a ULONG.
1689 *  This function is only intended to be called by the RPC runtime.
1690 */
1691 ULONG __RPC_USER STGMEDIUM_UserSize(ULONG *pFlags, ULONG StartingSize, STGMEDIUM *pStgMedium)
1692 {
1693     ULONG size = StartingSize;
1694 
1695     TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), StartingSize, pStgMedium);
1696 
1697     ALIGN_LENGTH(size, 3);
1698 
1699     size += 2 * sizeof(DWORD);
1700     if (pStgMedium->tymed != TYMED_NULL)
1701         size += sizeof(DWORD);
1702 
1703     switch (pStgMedium->tymed)
1704     {
1705     case TYMED_NULL:
1706         TRACE("TYMED_NULL\n");
1707         break;
1708     case TYMED_HGLOBAL:
1709         TRACE("TYMED_HGLOBAL\n");
1710         if (pStgMedium->u.hGlobal)
1711             size = HGLOBAL_UserSize(pFlags, size, &pStgMedium->u.hGlobal);
1712         break;
1713     case TYMED_FILE:
1714         TRACE("TYMED_FILE\n");
1715         if (pStgMedium->u.lpszFileName)
1716         {
1717             TRACE("file name is %s\n", debugstr_w(pStgMedium->u.lpszFileName));
1718             size += 3 * sizeof(DWORD) +
1719                 (strlenW(pStgMedium->u.lpszFileName) + 1) * sizeof(WCHAR);
1720         }
1721         break;
1722     case TYMED_ISTREAM:
1723         TRACE("TYMED_ISTREAM\n");
1724         if (pStgMedium->u.pstm)
1725         {
1726             IUnknown *unk;
1727             IStream_QueryInterface(pStgMedium->u.pstm, &IID_IUnknown, (void**)&unk);
1728             size = WdtpInterfacePointer_UserSize(pFlags, LOWORD(*pFlags), size, unk, &IID_IStream);
1729             IUnknown_Release(unk);
1730         }
1731         break;
1732     case TYMED_ISTORAGE:
1733         TRACE("TYMED_ISTORAGE\n");
1734         if (pStgMedium->u.pstg)
1735         {
1736             IUnknown *unk;
1737             IStorage_QueryInterface(pStgMedium->u.pstg, &IID_IUnknown, (void**)&unk);
1738             size = WdtpInterfacePointer_UserSize(pFlags, LOWORD(*pFlags), size, unk, &IID_IStorage);
1739             IUnknown_Release(unk);
1740         }
1741         break;
1742     case TYMED_GDI:
1743         TRACE("TYMED_GDI\n");
1744         if (pStgMedium->u.hBitmap)
1745             size = HBITMAP_UserSize(pFlags, size, &pStgMedium->u.hBitmap);
1746         break;
1747     case TYMED_MFPICT:
1748         TRACE("TYMED_MFPICT\n");
1749         if (pStgMedium->u.hMetaFilePict)
1750             size = HMETAFILEPICT_UserSize(pFlags, size, &pStgMedium->u.hMetaFilePict);
1751         break;
1752     case TYMED_ENHMF:
1753         TRACE("TYMED_ENHMF\n");
1754         if (pStgMedium->u.hEnhMetaFile)
1755             size = HENHMETAFILE_UserSize(pFlags, size, &pStgMedium->u.hEnhMetaFile);
1756         break;
1757     default:
1758         RaiseException(DV_E_TYMED, 0, 0, NULL);
1759     }
1760 
1761     if (pStgMedium->pUnkForRelease)
1762         size = WdtpInterfacePointer_UserSize(pFlags, LOWORD(*pFlags), size, pStgMedium->pUnkForRelease, &IID_IUnknown);
1763 
1764     return size;
1765 }
1766 
1767 /******************************************************************************
1768  *           STGMEDIUM_UserMarshal [OLE32.@]
1769  *
1770  * Marshals a STGMEDIUM into a buffer.
1771  *
1772  * PARAMS
1773  *  pFlags  [I] Flags. See notes.
1774  *  pBuffer [I] Buffer to marshal the clip format into.
1775  *  pCF     [I] STGMEDIUM to marshal.
1776  *
1777  * RETURNS
1778  *  The end of the marshaled data in the buffer.
1779  *
1780  * NOTES
1781  *  Even though the function is documented to take a pointer to a ULONG in
1782  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1783  *  the first parameter is a ULONG.
1784  *  This function is only intended to be called by the RPC runtime.
1785  */
1786 unsigned char * __RPC_USER STGMEDIUM_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, STGMEDIUM *pStgMedium)
1787 {
1788     TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, pStgMedium);
1789 
1790     ALIGN_POINTER(pBuffer, 3);
1791 
1792     *(DWORD *)pBuffer = pStgMedium->tymed;
1793     pBuffer += sizeof(DWORD);
1794     if (pStgMedium->tymed != TYMED_NULL)
1795     {
1796         *(DWORD *)pBuffer = (DWORD)(DWORD_PTR)pStgMedium->u.pstg;
1797         pBuffer += sizeof(DWORD);
1798     }
1799     *(DWORD *)pBuffer = (DWORD)(DWORD_PTR)pStgMedium->pUnkForRelease;
1800     pBuffer += sizeof(DWORD);
1801 
1802     switch (pStgMedium->tymed)
1803     {
1804     case TYMED_NULL:
1805         TRACE("TYMED_NULL\n");
1806         break;
1807     case TYMED_HGLOBAL:
1808         TRACE("TYMED_HGLOBAL\n");
1809         if (pStgMedium->u.hGlobal)
1810             pBuffer = HGLOBAL_UserMarshal(pFlags, pBuffer, &pStgMedium->u.hGlobal);
1811         break;
1812     case TYMED_FILE:
1813         TRACE("TYMED_FILE\n");
1814         if (pStgMedium->u.lpszFileName)
1815         {
1816             DWORD len;
1817             len = strlenW(pStgMedium->u.lpszFileName);
1818             /* conformance */
1819             *(DWORD *)pBuffer = len + 1;
1820             pBuffer += sizeof(DWORD);
1821             /* offset */
1822             *(DWORD *)pBuffer = 0;
1823             pBuffer += sizeof(DWORD);
1824             /* variance */
1825             *(DWORD *)pBuffer = len + 1;
1826             pBuffer += sizeof(DWORD);
1827 
1828             TRACE("file name is %s\n", debugstr_w(pStgMedium->u.lpszFileName));
1829             memcpy(pBuffer, pStgMedium->u.lpszFileName, (len + 1) * sizeof(WCHAR));
1830         }
1831         break;
1832     case TYMED_ISTREAM:
1833         TRACE("TYMED_ISTREAM\n");
1834         if (pStgMedium->u.pstm)
1835         {
1836             IUnknown *unk;
1837             IStream_QueryInterface(pStgMedium->u.pstm, &IID_IUnknown, (void**)&unk);
1838             pBuffer = WdtpInterfacePointer_UserMarshal(pFlags, LOWORD(*pFlags), pBuffer, unk, &IID_IStream);
1839             IUnknown_Release(unk);
1840         }
1841         break;
1842     case TYMED_ISTORAGE:
1843         TRACE("TYMED_ISTORAGE\n");
1844         if (pStgMedium->u.pstg)
1845         {
1846             IUnknown *unk;
1847             IStorage_QueryInterface(pStgMedium->u.pstg, &IID_IUnknown, (void**)&unk);
1848             pBuffer = WdtpInterfacePointer_UserMarshal(pFlags, LOWORD(*pFlags), pBuffer, unk, &IID_IStorage);
1849             IUnknown_Release(unk);
1850         }
1851         break;
1852     case TYMED_GDI:
1853         TRACE("TYMED_GDI\n");
1854         if (pStgMedium->u.hBitmap)
1855             pBuffer = HBITMAP_UserMarshal(pFlags, pBuffer, &pStgMedium->u.hBitmap);
1856         break;
1857     case TYMED_MFPICT:
1858         TRACE("TYMED_MFPICT\n");
1859         if (pStgMedium->u.hMetaFilePict)
1860             pBuffer = HMETAFILEPICT_UserMarshal(pFlags, pBuffer, &pStgMedium->u.hMetaFilePict);
1861         break;
1862     case TYMED_ENHMF:
1863         TRACE("TYMED_ENHMF\n");
1864         if (pStgMedium->u.hEnhMetaFile)
1865             pBuffer = HENHMETAFILE_UserMarshal(pFlags, pBuffer, &pStgMedium->u.hEnhMetaFile);
1866         break;
1867     default:
1868         RaiseException(DV_E_TYMED, 0, 0, NULL);
1869     }
1870 
1871     if (pStgMedium->pUnkForRelease)
1872         pBuffer = WdtpInterfacePointer_UserMarshal(pFlags, LOWORD(*pFlags), pBuffer, pStgMedium->pUnkForRelease, &IID_IUnknown);
1873 
1874     return pBuffer;
1875 }
1876 
1877 /******************************************************************************
1878  *           STGMEDIUM_UserUnmarshal [OLE32.@]
1879  *
1880  * Unmarshals a STGMEDIUM from a buffer.
1881  *
1882  * PARAMS
1883  *  pFlags     [I] Flags. See notes.
1884  *  pBuffer    [I] Buffer to marshal the clip format from.
1885  *  pStgMedium [O] Address that receive the unmarshaled STGMEDIUM.
1886  *
1887  * RETURNS
1888  *  The end of the marshaled data in the buffer.
1889  *
1890  * NOTES
1891  *  Even though the function is documented to take a pointer to an ULONG in
1892  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of which
1893  *  the first parameter is an ULONG.
1894  *  This function is only intended to be called by the RPC runtime.
1895  */
1896 unsigned char * __RPC_USER STGMEDIUM_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, STGMEDIUM *pStgMedium)
1897 {
1898     DWORD content = 0;
1899     DWORD releaseunk;
1900 
1901     ALIGN_POINTER(pBuffer, 3);
1902 
1903     TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, pStgMedium);
1904 
1905     pStgMedium->tymed = *(DWORD *)pBuffer;
1906     pBuffer += sizeof(DWORD);
1907     if (pStgMedium->tymed != TYMED_NULL)
1908     {
1909         content = *(DWORD *)pBuffer;
1910         pBuffer += sizeof(DWORD);
1911     }
1912     releaseunk = *(DWORD *)pBuffer;
1913     pBuffer += sizeof(DWORD);
1914 
1915     switch (pStgMedium->tymed)
1916     {
1917     case TYMED_NULL:
1918         TRACE("TYMED_NULL\n");
1919         break;
1920     case TYMED_HGLOBAL:
1921         TRACE("TYMED_HGLOBAL\n");
1922         if (content)
1923             pBuffer = HGLOBAL_UserUnmarshal(pFlags, pBuffer, &pStgMedium->u.hGlobal);
1924         break;
1925     case TYMED_FILE:
1926         TRACE("TYMED_FILE\n");
1927         if (content)
1928         {
1929             DWORD conformance;
1930             DWORD variance;
1931             conformance = *(DWORD *)pBuffer;
1932             pBuffer += sizeof(DWORD);
1933             if (*(DWORD *)pBuffer != 0)
1934             {
1935                 ERR("invalid offset %d\n", *(DWORD *)pBuffer);
1936                 RpcRaiseException(RPC_S_INVALID_BOUND);
1937                 return NULL;
1938             }
1939             pBuffer += sizeof(DWORD);
1940             variance = *(DWORD *)pBuffer;
1941             pBuffer += sizeof(DWORD);
1942             if (conformance != variance)
1943             {
1944                 ERR("conformance (%d) and variance (%d) should be equal\n",
1945                     conformance, variance);
1946                 RpcRaiseException(RPC_S_INVALID_BOUND);
1947                 return NULL;
1948             }
1949             if (conformance > 0x7fffffff)
1950             {
1951                 ERR("conformance 0x%x too large\n", conformance);
1952                 RpcRaiseException(RPC_S_INVALID_BOUND);
1953                 return NULL;
1954             }
1955             pStgMedium->u.lpszFileName = CoTaskMemAlloc(conformance * sizeof(WCHAR));
1956             if (!pStgMedium->u.lpszFileName) RpcRaiseException(ERROR_OUTOFMEMORY);
1957             TRACE("unmarshalled file name is %s\n", debugstr_wn((const WCHAR *)pBuffer, variance));
1958             memcpy(pStgMedium->u.lpszFileName, pBuffer, variance * sizeof(WCHAR));
1959             pBuffer += variance * sizeof(WCHAR);
1960         }
1961         else
1962             pStgMedium->u.lpszFileName = NULL;
1963         break;
1964     case TYMED_ISTREAM:
1965         TRACE("TYMED_ISTREAM\n");
1966         if (content)
1967         {
1968             pBuffer = WdtpInterfacePointer_UserUnmarshal(pFlags, pBuffer, (IUnknown**)&pStgMedium->u.pstm, &IID_IStream);
1969         }
1970         else
1971         {
1972             if (pStgMedium->u.pstm) IStream_Release( pStgMedium->u.pstm );
1973             pStgMedium->u.pstm = NULL;
1974         }
1975         break;
1976     case TYMED_ISTORAGE:
1977         TRACE("TYMED_ISTORAGE\n");
1978         if (content)
1979         {
1980             pBuffer = WdtpInterfacePointer_UserUnmarshal(pFlags, pBuffer, (IUnknown**)&pStgMedium->u.pstg, &IID_IStorage);
1981         }
1982         else
1983         {
1984             if (pStgMedium->u.pstg) IStorage_Release( pStgMedium->u.pstg );
1985             pStgMedium->u.pstg = NULL;
1986         }
1987         break;
1988     case TYMED_GDI:
1989         TRACE("TYMED_GDI\n");
1990         if (content)
1991             pBuffer = HBITMAP_UserUnmarshal(pFlags, pBuffer, &pStgMedium->u.hBitmap);
1992         else
1993             pStgMedium->u.hBitmap = NULL;
1994         break;
1995     case TYMED_MFPICT:
1996         TRACE("TYMED_MFPICT\n");
1997         if (content)
1998             pBuffer = HMETAFILEPICT_UserUnmarshal(pFlags, pBuffer, &pStgMedium->u.hMetaFilePict);
1999         else
2000             pStgMedium->u.hMetaFilePict = NULL;
2001         break;
2002     case TYMED_ENHMF:
2003         TRACE("TYMED_ENHMF\n");
2004         if (content)
2005             pBuffer = HENHMETAFILE_UserUnmarshal(pFlags, pBuffer, &pStgMedium->u.hEnhMetaFile);
2006         else
2007             pStgMedium->u.hEnhMetaFile = NULL;
2008         break;
2009     default:
2010         RaiseException(DV_E_TYMED, 0, 0, NULL);
2011     }
2012 
2013     if (releaseunk)
2014         pBuffer = WdtpInterfacePointer_UserUnmarshal(pFlags, pBuffer, &pStgMedium->pUnkForRelease, &IID_IUnknown);
2015     /* Unlike the IStream / IStorage ifaces, the existing pUnkForRelease
2016        is left intact if a NULL ptr is unmarshalled - see the tests. */
2017 
2018     return pBuffer;
2019 }
2020 
2021 /******************************************************************************
2022  *           STGMEDIUM_UserFree [OLE32.@]
2023  *
2024  * Frees an unmarshaled STGMEDIUM.
2025  *
2026  * PARAMS
2027  *  pFlags     [I] Flags. See notes.
2028  *  pStgmedium [I] STGMEDIUM to free.
2029  *
2030  * RETURNS
2031  *  The end of the marshaled data in the buffer.
2032  *
2033  * NOTES
2034  *  Even though the function is documented to take a pointer to a ULONG in
2035  *  pFlags, it actually takes a pointer to a USER_MARSHAL_CB structure, of
2036  *  which the first parameter is a ULONG.
2037  *  This function is only intended to be called by the RPC runtime.
2038  */
2039 void __RPC_USER STGMEDIUM_UserFree(ULONG *pFlags, STGMEDIUM *pStgMedium)
2040 {
2041     TRACE("(%s, %p\n", debugstr_user_flags(pFlags), pStgMedium);
2042 
2043     ReleaseStgMedium(pStgMedium);
2044 }
2045 
2046 ULONG __RPC_USER ASYNC_STGMEDIUM_UserSize(ULONG *pFlags, ULONG StartingSize, ASYNC_STGMEDIUM *pStgMedium)
2047 {
2048     TRACE("\n");
2049     return STGMEDIUM_UserSize(pFlags, StartingSize, pStgMedium);
2050 }
2051 
2052 unsigned char * __RPC_USER ASYNC_STGMEDIUM_UserMarshal(  ULONG *pFlags, unsigned char *pBuffer, ASYNC_STGMEDIUM *pStgMedium)
2053 {
2054     TRACE("\n");
2055     return STGMEDIUM_UserMarshal(pFlags, pBuffer, pStgMedium);
2056 }
2057 
2058 unsigned char * __RPC_USER ASYNC_STGMEDIUM_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, ASYNC_STGMEDIUM *pStgMedium)
2059 {
2060     TRACE("\n");
2061     return STGMEDIUM_UserUnmarshal(pFlags, pBuffer, pStgMedium);
2062 }
2063 
2064 void __RPC_USER ASYNC_STGMEDIUM_UserFree(ULONG *pFlags, ASYNC_STGMEDIUM *pStgMedium)
2065 {
2066     TRACE("\n");
2067     STGMEDIUM_UserFree(pFlags, pStgMedium);
2068 }
2069 
2070 ULONG __RPC_USER FLAG_STGMEDIUM_UserSize(ULONG *pFlags, ULONG StartingSize, FLAG_STGMEDIUM *pStgMedium)
2071 {
2072     FIXME(":stub\n");
2073     return StartingSize;
2074 }
2075 
2076 unsigned char * __RPC_USER FLAG_STGMEDIUM_UserMarshal(  ULONG *pFlags, unsigned char *pBuffer, FLAG_STGMEDIUM *pStgMedium)
2077 {
2078     FIXME(":stub\n");
2079     return pBuffer;
2080 }
2081 
2082 unsigned char * __RPC_USER FLAG_STGMEDIUM_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, FLAG_STGMEDIUM *pStgMedium)
2083 {
2084     FIXME(":stub\n");
2085     return pBuffer;
2086 }
2087 
2088 void __RPC_USER FLAG_STGMEDIUM_UserFree(ULONG *pFlags, FLAG_STGMEDIUM *pStgMedium)
2089 {
2090     FIXME(":stub\n");
2091 }
2092 
2093 ULONG __RPC_USER SNB_UserSize(ULONG *pFlags, ULONG StartingSize, SNB *pSnb)
2094 {
2095     ULONG size = StartingSize;
2096 
2097     TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), StartingSize, pSnb);
2098 
2099     ALIGN_LENGTH(size, 3);
2100 
2101     /* two counters from RemSNB header, plus one more ULONG */
2102     size += 3*sizeof(ULONG);
2103 
2104     /* now actual data length */
2105     if (*pSnb)
2106     {
2107         WCHAR **ptrW = *pSnb;
2108 
2109         while (*ptrW)
2110         {
2111             size += (strlenW(*ptrW) + 1)*sizeof(WCHAR);
2112             ptrW++;
2113         }
2114     }
2115 
2116     return size;
2117 }
2118 
2119 struct SNB_wire {
2120     ULONG charcnt;
2121     ULONG strcnt;
2122     ULONG datalen;
2123     WCHAR data[1];
2124 };
2125 
2126 unsigned char * __RPC_USER SNB_UserMarshal(ULONG *pFlags, unsigned char *pBuffer, SNB *pSnb)
2127 {
2128     struct SNB_wire *wire;
2129     ULONG size;
2130 
2131     TRACE("(%s, %p, %p)\n", debugstr_user_flags(pFlags), pBuffer, pSnb);
2132 
2133     ALIGN_POINTER(pBuffer, 3);
2134 
2135     wire = (struct SNB_wire*)pBuffer;
2136     wire->charcnt = wire->strcnt = 0;
2137     size = 3*sizeof(ULONG);
2138 
2139     if (*pSnb)
2140     {
2141         WCHAR **ptrW = *pSnb;
2142         WCHAR *dataW = wire->data;
2143 
2144         while (*ptrW)
2145         {
2146             ULONG len = strlenW(*ptrW) + 1;
2147 
2148             wire->strcnt++;
2149             wire->charcnt += len;
2150             memcpy(dataW, *ptrW, len*sizeof(WCHAR));
2151             dataW += len;
2152 
2153             size += len*sizeof(WCHAR);
2154             ptrW++;
2155         }
2156     }
2157 
2158     wire->datalen = wire->charcnt;
2159     return pBuffer + size;
2160 }
2161 
2162 unsigned char * __RPC_USER SNB_UserUnmarshal(ULONG *pFlags, unsigned char *pBuffer, SNB *pSnb)
2163 {
2164     USER_MARSHAL_CB *umcb = (USER_MARSHAL_CB*)pFlags;
2165     struct SNB_wire *wire;
2166 
2167     TRACE("(%s, %p, %p)\n", debugstr_user_flags(pFlags), pBuffer, pSnb);
2168 
2169     wire = (struct SNB_wire*)pBuffer;
2170 
2171     if (*pSnb)
2172         umcb->pStubMsg->pfnFree(*pSnb);
2173 
2174     if (wire->datalen == 0)
2175         *pSnb = NULL;
2176     else
2177     {
2178         WCHAR *src = wire->data, *dest;
2179         WCHAR **ptrW;
2180         ULONG i;
2181 
2182         ptrW = *pSnb = umcb->pStubMsg->pfnAllocate((wire->strcnt+1)*sizeof(WCHAR*) + wire->datalen*sizeof(WCHAR));
2183         dest = (WCHAR*)(*pSnb + wire->strcnt + 1);
2184 
2185         for (i = 0; i < wire->strcnt; i++)
2186         {
2187             ULONG len = strlenW(src);
2188             memcpy(dest, src, (len + 1)*sizeof(WCHAR));
2189             *ptrW = dest;
2190             src += len + 1;
2191             dest += len + 1;
2192             ptrW++;
2193         }
2194         *ptrW = NULL;
2195     }
2196 
2197     return pBuffer + 3*sizeof(ULONG) + wire->datalen*sizeof(WCHAR);
2198 }
2199 
2200 void __RPC_USER SNB_UserFree(ULONG *pFlags, SNB *pSnb)
2201 {
2202     USER_MARSHAL_CB *umcb = (USER_MARSHAL_CB*)pFlags;
2203     TRACE("(%p)\n", pSnb);
2204     if (*pSnb)
2205         umcb->pStubMsg->pfnFree(*pSnb);
2206 }
2207 
2208 /* call_as/local stubs for unknwn.idl */
2209 
2210 HRESULT CALLBACK IClassFactory_CreateInstance_Proxy(
2211     IClassFactory* This,
2212     IUnknown *pUnkOuter,
2213     REFIID riid,
2214     void **ppvObject)
2215 {
2216     TRACE("(%p, %s, %p)\n", pUnkOuter, debugstr_guid(riid), ppvObject);
2217     *ppvObject = NULL;
2218     if (pUnkOuter)
2219     {
2220         ERR("aggregation is not allowed on remote objects\n");
2221         return CLASS_E_NOAGGREGATION;
2222     }
2223     return IClassFactory_RemoteCreateInstance_Proxy(This, riid,
2224                                                     (IUnknown **) ppvObject);
2225 }
2226 
2227 HRESULT __RPC_STUB IClassFactory_CreateInstance_Stub(
2228     IClassFactory* This,
2229     REFIID riid,
2230     IUnknown **ppvObject)
2231 {
2232     TRACE("(%s, %p)\n", debugstr_guid(riid), ppvObject);
2233     return IClassFactory_CreateInstance(This, NULL, riid, (void **) ppvObject);
2234 }
2235 
2236 HRESULT CALLBACK IClassFactory_LockServer_Proxy(
2237     IClassFactory* This,
2238     BOOL fLock)
2239 {
2240     FIXME(":stub\n");
2241     return E_NOTIMPL;
2242 }
2243 
2244 HRESULT __RPC_STUB IClassFactory_LockServer_Stub(
2245     IClassFactory* This,
2246     BOOL fLock)
2247 {
2248     FIXME(":stub\n");
2249     return E_NOTIMPL;
2250 }
2251 
2252 /* call_as/local stubs for objidl.idl */
2253 
2254 HRESULT CALLBACK IEnumUnknown_Next_Proxy(
2255     IEnumUnknown* This,
2256     ULONG celt,
2257     IUnknown **rgelt,
2258     ULONG *pceltFetched)
2259 {
2260     ULONG fetched;
2261     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2262     if (!pceltFetched) pceltFetched = &fetched;
2263     return IEnumUnknown_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
2264 }
2265 
2266 HRESULT __RPC_STUB IEnumUnknown_Next_Stub(
2267     IEnumUnknown* This,
2268     ULONG celt,
2269     IUnknown **rgelt,
2270     ULONG *pceltFetched)
2271 {
2272     HRESULT hr;
2273     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2274     *pceltFetched = 0;
2275     hr = IEnumUnknown_Next(This, celt, rgelt, pceltFetched);
2276     if (hr == S_OK) *pceltFetched = celt;
2277     return hr;
2278 }
2279 
2280 HRESULT CALLBACK IBindCtx_SetBindOptions_Proxy(
2281     IBindCtx* This,
2282     BIND_OPTS *pbindopts)
2283 {
2284     FIXME(":stub\n");
2285     return E_NOTIMPL;
2286 }
2287 
2288 HRESULT __RPC_STUB IBindCtx_SetBindOptions_Stub(
2289     IBindCtx* This,
2290     BIND_OPTS2 *pbindopts)
2291 {
2292     FIXME(":stub\n");
2293     return E_NOTIMPL;
2294 }
2295 
2296 HRESULT CALLBACK IBindCtx_GetBindOptions_Proxy(
2297     IBindCtx* This,
2298     BIND_OPTS *pbindopts)
2299 {
2300     FIXME(":stub\n");
2301     return E_NOTIMPL;
2302 }
2303 
2304 HRESULT __RPC_STUB IBindCtx_GetBindOptions_Stub(
2305     IBindCtx* This,
2306     BIND_OPTS2 *pbindopts)
2307 {
2308     FIXME(":stub\n");
2309     return E_NOTIMPL;
2310 }
2311 
2312 HRESULT CALLBACK IEnumMoniker_Next_Proxy(
2313     IEnumMoniker* This,
2314     ULONG celt,
2315     IMoniker **rgelt,
2316     ULONG *pceltFetched)
2317 {
2318     ULONG fetched;
2319     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2320     if (!pceltFetched) pceltFetched = &fetched;
2321     return IEnumMoniker_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
2322 }
2323 
2324 HRESULT __RPC_STUB IEnumMoniker_Next_Stub(
2325     IEnumMoniker* This,
2326     ULONG celt,
2327     IMoniker **rgelt,
2328     ULONG *pceltFetched)
2329 {
2330     HRESULT hr;
2331     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2332     *pceltFetched = 0;
2333     hr = IEnumMoniker_Next(This, celt, rgelt, pceltFetched);
2334     if (hr == S_OK) *pceltFetched = celt;
2335     return hr;
2336 }
2337 
2338 BOOL CALLBACK IRunnableObject_IsRunning_Proxy(
2339     IRunnableObject* This)
2340 {
2341     BOOL rv;
2342     FIXME(":stub\n");
2343     memset(&rv, 0, sizeof rv);
2344     return rv;
2345 }
2346 
2347 HRESULT __RPC_STUB IRunnableObject_IsRunning_Stub(
2348     IRunnableObject* This)
2349 {
2350     FIXME(":stub\n");
2351     return E_NOTIMPL;
2352 }
2353 
2354 HRESULT CALLBACK IMoniker_BindToObject_Proxy(
2355     IMoniker* This,
2356     IBindCtx *pbc,
2357     IMoniker *pmkToLeft,
2358     REFIID riidResult,
2359     void **ppvResult)
2360 {
2361     FIXME(":stub\n");
2362     return E_NOTIMPL;
2363 }
2364 
2365 HRESULT __RPC_STUB IMoniker_BindToObject_Stub(
2366     IMoniker* This,
2367     IBindCtx *pbc,
2368     IMoniker *pmkToLeft,
2369     REFIID riidResult,
2370     IUnknown **ppvResult)
2371 {
2372     FIXME(":stub\n");
2373     return E_NOTIMPL;
2374 }
2375 
2376 HRESULT CALLBACK IMoniker_BindToStorage_Proxy(
2377     IMoniker* This,
2378     IBindCtx *pbc,
2379     IMoniker *pmkToLeft,
2380     REFIID riid,
2381     void **ppvObj)
2382 {
2383     TRACE("(%p)->(%p %p %s %p)\n", This, pbc, pmkToLeft, debugstr_guid(riid), ppvObj);
2384     return IMoniker_RemoteBindToStorage_Proxy(This, pbc, pmkToLeft, riid, (IUnknown**)ppvObj);
2385 }
2386 
2387 HRESULT __RPC_STUB IMoniker_BindToStorage_Stub(
2388     IMoniker* This,
2389     IBindCtx *pbc,
2390     IMoniker *pmkToLeft,
2391     REFIID riid,
2392     IUnknown **ppvObj)
2393 {
2394     TRACE("(%p)->(%p %p %s %p)\n", This, pbc, pmkToLeft, debugstr_guid(riid), ppvObj);
2395     return IMoniker_BindToStorage(This, pbc, pmkToLeft, riid, (void**)ppvObj);
2396 }
2397 
2398 HRESULT CALLBACK IEnumString_Next_Proxy(
2399     IEnumString* This,
2400     ULONG celt,
2401     LPOLESTR *rgelt,
2402     ULONG *pceltFetched)
2403 {
2404     ULONG fetched;
2405     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2406     if (!pceltFetched) pceltFetched = &fetched;
2407     return IEnumString_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
2408 }
2409 
2410 HRESULT __RPC_STUB IEnumString_Next_Stub(
2411     IEnumString* This,
2412     ULONG celt,
2413     LPOLESTR *rgelt,
2414     ULONG *pceltFetched)
2415 {
2416     HRESULT hr;
2417     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2418     *pceltFetched = 0;
2419     hr = IEnumString_Next(This, celt, rgelt, pceltFetched);
2420     if (hr == S_OK) *pceltFetched = celt;
2421     return hr;
2422 }
2423 
2424 HRESULT CALLBACK ISequentialStream_Read_Proxy(
2425     ISequentialStream* This,
2426     void *pv,
2427     ULONG cb,
2428     ULONG *pcbRead)
2429 {
2430     ULONG read;
2431     HRESULT hr;
2432 
2433     TRACE("(%p)->(%p, %d, %p)\n", This, pv, cb, pcbRead);
2434 
2435     hr = ISequentialStream_RemoteRead_Proxy(This, pv, cb, &read);
2436     if(pcbRead) *pcbRead = read;
2437 
2438     return hr;
2439 }
2440 
2441 HRESULT __RPC_STUB ISequentialStream_Read_Stub(
2442     ISequentialStream* This,
2443     byte *pv,
2444     ULONG cb,
2445     ULONG *pcbRead)
2446 {
2447     TRACE("(%p)->(%p, %d, %p)\n", This, pv, cb, pcbRead);
2448     return ISequentialStream_Read(This, pv, cb, pcbRead);
2449 }
2450 
2451 HRESULT CALLBACK ISequentialStream_Write_Proxy(
2452     ISequentialStream* This,
2453     const void *pv,
2454     ULONG cb,
2455     ULONG *pcbWritten)
2456 {
2457     ULONG written;
2458     HRESULT hr;
2459 
2460     TRACE("(%p)->(%p, %d, %p)\n", This, pv, cb, pcbWritten);
2461 
2462     hr = ISequentialStream_RemoteWrite_Proxy(This, pv, cb, &written);
2463     if(pcbWritten) *pcbWritten = written;
2464 
2465     return hr;
2466 }
2467 
2468 HRESULT __RPC_STUB ISequentialStream_Write_Stub(
2469     ISequentialStream* This,
2470     const byte *pv,
2471     ULONG cb,
2472     ULONG *pcbWritten)
2473 {
2474     TRACE("(%p)->(%p, %d, %p)\n", This, pv, cb, pcbWritten);
2475     return ISequentialStream_Write(This, pv, cb, pcbWritten);
2476 }
2477 
2478 HRESULT CALLBACK IStream_Seek_Proxy(
2479     IStream* This,
2480     LARGE_INTEGER dlibMove,
2481     DWORD dwOrigin,
2482     ULARGE_INTEGER *plibNewPosition)
2483 {
2484     ULARGE_INTEGER newpos;
2485     HRESULT hr;
2486 
2487     TRACE("(%p)->(%s, %d, %p)\n", This, wine_dbgstr_longlong(dlibMove.QuadPart), dwOrigin, plibNewPosition);
2488 
2489     hr = IStream_RemoteSeek_Proxy(This, dlibMove, dwOrigin, &newpos);
2490     if(plibNewPosition) *plibNewPosition = newpos;
2491 
2492     return hr;
2493 }
2494 
2495 HRESULT __RPC_STUB IStream_Seek_Stub(
2496     IStream* This,
2497     LARGE_INTEGER dlibMove,
2498     DWORD dwOrigin,
2499     ULARGE_INTEGER *plibNewPosition)
2500 {
2501     TRACE("(%p)->(%s, %d, %p)\n", This, wine_dbgstr_longlong(dlibMove.QuadPart), dwOrigin, plibNewPosition);
2502     return IStream_Seek(This, dlibMove, dwOrigin, plibNewPosition);
2503 }
2504 
2505 HRESULT CALLBACK IStream_CopyTo_Proxy(
2506     IStream* This,
2507     IStream *pstm,
2508     ULARGE_INTEGER cb,
2509     ULARGE_INTEGER *pcbRead,
2510     ULARGE_INTEGER *pcbWritten)
2511 {
2512     ULARGE_INTEGER read, written;
2513     HRESULT hr;
2514 
2515     TRACE("(%p)->(%p, %s, %p, %p)\n", This, pstm, wine_dbgstr_longlong(cb.QuadPart), pcbRead, pcbWritten);
2516 
2517     hr = IStream_RemoteCopyTo_Proxy(This, pstm, cb, &read, &written);
2518     if(pcbRead) *pcbRead = read;
2519     if(pcbWritten) *pcbWritten = written;
2520 
2521     return hr;
2522 }
2523 
2524 HRESULT __RPC_STUB IStream_CopyTo_Stub(
2525     IStream* This,
2526     IStream *pstm,
2527     ULARGE_INTEGER cb,
2528     ULARGE_INTEGER *pcbRead,
2529     ULARGE_INTEGER *pcbWritten)
2530 {
2531     TRACE("(%p)->(%p, %s, %p, %p)\n", This, pstm, wine_dbgstr_longlong(cb.QuadPart), pcbRead, pcbWritten);
2532 
2533     return IStream_CopyTo(This, pstm, cb, pcbRead, pcbWritten);
2534 }
2535 
2536 HRESULT CALLBACK IEnumSTATSTG_Next_Proxy(
2537     IEnumSTATSTG* This,
2538     ULONG celt,
2539     STATSTG *rgelt,
2540     ULONG *pceltFetched)
2541 {
2542     ULONG fetched;
2543     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2544     if (!pceltFetched) pceltFetched = &fetched;
2545     return IEnumSTATSTG_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
2546 }
2547 
2548 HRESULT __RPC_STUB IEnumSTATSTG_Next_Stub(
2549     IEnumSTATSTG* This,
2550     ULONG celt,
2551     STATSTG *rgelt,
2552     ULONG *pceltFetched)
2553 {
2554     HRESULT hr;
2555     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2556     *pceltFetched = 0;
2557     hr = IEnumSTATSTG_Next(This, celt, rgelt, pceltFetched);
2558     if (hr == S_OK) *pceltFetched = celt;
2559     return hr;
2560 }
2561 
2562 HRESULT CALLBACK IStorage_OpenStream_Proxy(
2563     IStorage* This,
2564     LPCOLESTR pwcsName,
2565     void *reserved1,
2566     DWORD grfMode,
2567     DWORD reserved2,
2568     IStream **ppstm)
2569 {
2570     TRACE("(%p)->(%s, %p, %08x, %d %p)\n", This, debugstr_w(pwcsName), reserved1, grfMode, reserved2, ppstm);
2571     if(reserved1) WARN("reserved1 %p\n", reserved1);
2572 
2573     return IStorage_RemoteOpenStream_Proxy(This, pwcsName, 0, NULL, grfMode, reserved2, ppstm);
2574 }
2575 
2576 HRESULT __RPC_STUB IStorage_OpenStream_Stub(
2577     IStorage* This,
2578     LPCOLESTR pwcsName,
2579     ULONG cbReserved1,
2580     byte *reserved1,
2581     DWORD grfMode,
2582     DWORD reserved2,
2583     IStream **ppstm)
2584 {
2585     TRACE("(%p)->(%s, %d, %p, %08x, %d %p)\n", This, debugstr_w(pwcsName), cbReserved1, reserved1, grfMode, reserved2, ppstm);
2586     if(cbReserved1 || reserved1) WARN("cbReserved1 %d reserved1 %p\n", cbReserved1, reserved1);
2587 
2588     return IStorage_OpenStream(This, pwcsName, NULL, grfMode, reserved2, ppstm);
2589 }
2590 
2591 HRESULT CALLBACK IStorage_EnumElements_Proxy(
2592     IStorage* This,
2593     DWORD reserved1,
2594     void *reserved2,
2595     DWORD reserved3,
2596     IEnumSTATSTG **ppenum)
2597 {
2598     TRACE("(%p)->(%d, %p, %d, %p)\n", This, reserved1, reserved2, reserved3, ppenum);
2599     if(reserved2) WARN("reserved2 %p\n", reserved2);
2600 
2601     return IStorage_RemoteEnumElements_Proxy(This, reserved1, 0, NULL, reserved3, ppenum);
2602 }
2603 
2604 HRESULT __RPC_STUB IStorage_EnumElements_Stub(
2605     IStorage* This,
2606     DWORD reserved1,
2607     ULONG cbReserved2,
2608     byte *reserved2,
2609     DWORD reserved3,
2610     IEnumSTATSTG **ppenum)
2611 {
2612     TRACE("(%p)->(%d, %d, %p, %d, %p)\n", This, reserved1, cbReserved2, reserved2, reserved3, ppenum);
2613     if(cbReserved2 || reserved2) WARN("cbReserved2 %d reserved2 %p\n", cbReserved2, reserved2);
2614 
2615     return IStorage_EnumElements(This, reserved1, NULL, reserved3, ppenum);
2616 }
2617 
2618 HRESULT CALLBACK ILockBytes_ReadAt_Proxy(
2619     ILockBytes* This,
2620     ULARGE_INTEGER ulOffset,
2621     void *pv,
2622     ULONG cb,
2623     ULONG *pcbRead)
2624 {
2625     ULONG read;
2626     HRESULT hr;
2627 
2628     TRACE("(%p)->(%s, %p, %d, %p)\n", This, wine_dbgstr_longlong(ulOffset.QuadPart), pv, cb, pcbRead);
2629 
2630     hr = ILockBytes_RemoteReadAt_Proxy(This, ulOffset, pv, cb, &read);
2631     if(pcbRead) *pcbRead = read;
2632 
2633     return hr;
2634 }
2635 
2636 HRESULT __RPC_STUB ILockBytes_ReadAt_Stub(
2637     ILockBytes* This,
2638     ULARGE_INTEGER ulOffset,
2639     byte *pv,
2640     ULONG cb,
2641     ULONG *pcbRead)
2642 {
2643     TRACE("(%p)->(%s, %p, %d, %p)\n", This, wine_dbgstr_longlong(ulOffset.QuadPart), pv, cb, pcbRead);
2644     return ILockBytes_ReadAt(This, ulOffset, pv, cb, pcbRead);
2645 }
2646 
2647 HRESULT CALLBACK ILockBytes_WriteAt_Proxy(
2648     ILockBytes* This,
2649     ULARGE_INTEGER ulOffset,
2650     const void *pv,
2651     ULONG cb,
2652     ULONG *pcbWritten)
2653 {
2654     ULONG written;
2655     HRESULT hr;
2656 
2657     TRACE("(%p)->(%s, %p, %d, %p)\n", This, wine_dbgstr_longlong(ulOffset.QuadPart), pv, cb, pcbWritten);
2658 
2659     hr = ILockBytes_RemoteWriteAt_Proxy(This, ulOffset, pv, cb, &written);
2660     if(pcbWritten) *pcbWritten = written;
2661 
2662     return hr;
2663 }
2664 
2665 HRESULT __RPC_STUB ILockBytes_WriteAt_Stub(
2666     ILockBytes* This,
2667     ULARGE_INTEGER ulOffset,
2668     const byte *pv,
2669     ULONG cb,
2670     ULONG *pcbWritten)
2671 {
2672     TRACE("(%p)->(%s, %p, %d, %p)\n", This, wine_dbgstr_longlong(ulOffset.QuadPart), pv, cb, pcbWritten);
2673     return ILockBytes_WriteAt(This, ulOffset, pv, cb, pcbWritten);
2674 }
2675 
2676 HRESULT CALLBACK IFillLockBytes_FillAppend_Proxy(
2677     IFillLockBytes* This,
2678     const void *pv,
2679     ULONG cb,
2680     ULONG *pcbWritten)
2681 {
2682     ULONG written;
2683     HRESULT hr;
2684 
2685     TRACE("(%p)->(%p, %d, %p)\n", This, pv, cb, pcbWritten);
2686 
2687     hr = IFillLockBytes_RemoteFillAppend_Proxy(This, pv, cb, &written);
2688     if(pcbWritten) *pcbWritten = written;
2689 
2690     return hr;
2691 }
2692 
2693 HRESULT __RPC_STUB IFillLockBytes_FillAppend_Stub(
2694     IFillLockBytes* This,
2695     const byte *pv,
2696     ULONG cb,
2697     ULONG *pcbWritten)
2698 {
2699     TRACE("(%p)->(%p, %d, %p)\n", This, pv, cb, pcbWritten);
2700     return IFillLockBytes_FillAppend(This, pv, cb, pcbWritten);
2701 }
2702 
2703 HRESULT CALLBACK IFillLockBytes_FillAt_Proxy(
2704     IFillLockBytes* This,
2705     ULARGE_INTEGER ulOffset,
2706     const void *pv,
2707     ULONG cb,
2708     ULONG *pcbWritten)
2709 {
2710     ULONG written;
2711     HRESULT hr;
2712 
2713     TRACE("(%p)->(%s, %p, %d, %p)\n", This, wine_dbgstr_longlong(ulOffset.QuadPart), pv, cb, pcbWritten);
2714 
2715     hr = IFillLockBytes_RemoteFillAt_Proxy(This, ulOffset, pv, cb, &written);
2716     if(pcbWritten) *pcbWritten = written;
2717 
2718     return hr;
2719 }
2720 
2721 HRESULT __RPC_STUB IFillLockBytes_FillAt_Stub(
2722     IFillLockBytes* This,
2723     ULARGE_INTEGER ulOffset,
2724     const byte *pv,
2725     ULONG cb,
2726     ULONG *pcbWritten)
2727 {
2728     TRACE("(%p)->(%s, %p, %d, %p)\n", This, wine_dbgstr_longlong(ulOffset.QuadPart), pv, cb, pcbWritten);
2729     return IFillLockBytes_FillAt(This, ulOffset, pv, cb, pcbWritten);
2730 }
2731 
2732 HRESULT CALLBACK IEnumFORMATETC_Next_Proxy(
2733     IEnumFORMATETC* This,
2734     ULONG celt,
2735     FORMATETC *rgelt,
2736     ULONG *pceltFetched)
2737 {
2738     ULONG fetched;
2739     if (!pceltFetched) pceltFetched = &fetched;
2740     return IEnumFORMATETC_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
2741 }
2742 
2743 HRESULT __RPC_STUB IEnumFORMATETC_Next_Stub(
2744     IEnumFORMATETC* This,
2745     ULONG celt,
2746     FORMATETC *rgelt,
2747     ULONG *pceltFetched)
2748 {
2749     HRESULT hr;
2750     *pceltFetched = 0;
2751     hr = IEnumFORMATETC_Next(This, celt, rgelt, pceltFetched);
2752     if (hr == S_OK) *pceltFetched = celt;
2753     return hr;
2754 }
2755 
2756 HRESULT CALLBACK IEnumSTATDATA_Next_Proxy(
2757     IEnumSTATDATA* This,
2758     ULONG celt,
2759     STATDATA *rgelt,
2760     ULONG *pceltFetched)
2761 {
2762     ULONG fetched;
2763     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2764     if (!pceltFetched) pceltFetched = &fetched;
2765     return IEnumSTATDATA_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
2766 }
2767 
2768 HRESULT __RPC_STUB IEnumSTATDATA_Next_Stub(
2769     IEnumSTATDATA* This,
2770     ULONG celt,
2771     STATDATA *rgelt,
2772     ULONG *pceltFetched)
2773 {
2774     HRESULT hr;
2775     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
2776     *pceltFetched = 0;
2777     hr = IEnumSTATDATA_Next(This, celt, rgelt, pceltFetched);
2778     if (hr == S_OK) *pceltFetched = celt;
2779     return hr;
2780 }
2781 
2782 void CALLBACK IAdviseSink_OnDataChange_Proxy(
2783     IAdviseSink* This,
2784     FORMATETC *pFormatetc,
2785     STGMEDIUM *pStgmed)
2786 {
2787     TRACE("(%p)->(%p, %p)\n", This, pFormatetc, pStgmed);
2788     IAdviseSink_RemoteOnDataChange_Proxy(This, pFormatetc, pStgmed);
2789 }
2790 
2791 HRESULT __RPC_STUB IAdviseSink_OnDataChange_Stub(
2792     IAdviseSink* This,
2793     FORMATETC *pFormatetc,
2794     ASYNC_STGMEDIUM *pStgmed)
2795 {
2796     TRACE("(%p)->(%p, %p)\n", This, pFormatetc, pStgmed);
2797     IAdviseSink_OnDataChange(This, pFormatetc, pStgmed);
2798     return S_OK;
2799 }
2800 
2801 void CALLBACK IAdviseSink_OnViewChange_Proxy(
2802     IAdviseSink* This,
2803     DWORD dwAspect,
2804     LONG lindex)
2805 {
2806     TRACE("(%p)->(%d, %d)\n", This, dwAspect, lindex);
2807     IAdviseSink_RemoteOnViewChange_Proxy(This, dwAspect, lindex);
2808 }
2809 
2810 HRESULT __RPC_STUB IAdviseSink_OnViewChange_Stub(
2811     IAdviseSink* This,
2812     DWORD dwAspect,
2813     LONG lindex)
2814 {
2815     TRACE("(%p)->(%d, %d)\n", This, dwAspect, lindex);
2816     IAdviseSink_OnViewChange(This, dwAspect, lindex);
2817     return S_OK;
2818 }
2819 
2820 void CALLBACK IAdviseSink_OnRename_Proxy(
2821     IAdviseSink* This,
2822     IMoniker *pmk)
2823 {
2824     TRACE("(%p)->(%p)\n", This, pmk);
2825     IAdviseSink_RemoteOnRename_Proxy(This, pmk);
2826 }
2827 
2828 HRESULT __RPC_STUB IAdviseSink_OnRename_Stub(
2829     IAdviseSink* This,
2830     IMoniker *pmk)
2831 {
2832     TRACE("(%p)->(%p)\n", This, pmk);
2833     IAdviseSink_OnRename(This, pmk);
2834     return S_OK;
2835 }
2836 
2837 void CALLBACK IAdviseSink_OnSave_Proxy(
2838     IAdviseSink* This)
2839 {
2840     TRACE("(%p)\n", This);
2841     IAdviseSink_RemoteOnSave_Proxy(This);
2842 }
2843 
2844 HRESULT __RPC_STUB IAdviseSink_OnSave_Stub(
2845     IAdviseSink* This)
2846 {
2847     TRACE("(%p)\n", This);
2848     IAdviseSink_OnSave(This);
2849     return S_OK;
2850 }
2851 
2852 void CALLBACK IAdviseSink_OnClose_Proxy(
2853     IAdviseSink* This)
2854 {
2855     TRACE("(%p)\n", This);
2856     IAdviseSink_RemoteOnClose_Proxy(This);
2857 }
2858 
2859 HRESULT __RPC_STUB IAdviseSink_OnClose_Stub(
2860     IAdviseSink* This)
2861 {
2862     TRACE("(%p)\n", This);
2863     IAdviseSink_OnClose(This);
2864     return S_OK;
2865 }
2866 
2867 void CALLBACK IAdviseSink2_OnLinkSrcChange_Proxy(
2868     IAdviseSink2* This,
2869     IMoniker *pmk)
2870 {
2871     TRACE("(%p)->(%p)\n", This, pmk);
2872     IAdviseSink2_RemoteOnLinkSrcChange_Proxy(This, pmk);
2873 }
2874 
2875 HRESULT __RPC_STUB IAdviseSink2_OnLinkSrcChange_Stub(
2876     IAdviseSink2* This,
2877     IMoniker *pmk)
2878 {
2879     TRACE("(%p)->(%p)\n", This, pmk);
2880     IAdviseSink2_OnLinkSrcChange(This, pmk);
2881     return S_OK;
2882 }
2883 
2884 HRESULT CALLBACK IDataObject_GetData_Proxy(
2885     IDataObject* This,
2886     FORMATETC *pformatetcIn,
2887     STGMEDIUM *pmedium)
2888 {
2889     TRACE("(%p)->(%p, %p)\n", This, pformatetcIn, pmedium);
2890     return IDataObject_RemoteGetData_Proxy(This, pformatetcIn, pmedium);
2891 }
2892 
2893 HRESULT __RPC_STUB IDataObject_GetData_Stub(
2894     IDataObject* This,
2895     FORMATETC *pformatetcIn,
2896     STGMEDIUM *pRemoteMedium)
2897 {
2898     TRACE("(%p)->(%p, %p)\n", This, pformatetcIn, pRemoteMedium);
2899     return IDataObject_GetData(This, pformatetcIn, pRemoteMedium);
2900 }
2901 
2902 HRESULT CALLBACK IDataObject_GetDataHere_Proxy(IDataObject *iface, FORMATETC *fmt, STGMEDIUM *med)
2903 {
2904     IUnknown *release;
2905     IStorage *stg = NULL;
2906     HRESULT hr;
2907 
2908     TRACE("(%p)->(%p, %p)\n", iface, fmt, med);
2909 
2910     if ((med->tymed & (TYMED_HGLOBAL | TYMED_FILE | TYMED_ISTREAM | TYMED_ISTORAGE)) == 0)
2911         return DV_E_TYMED;
2912     if (med->tymed != fmt->tymed)
2913         return DV_E_TYMED;
2914 
2915     release = med->pUnkForRelease;
2916     med->pUnkForRelease = NULL;
2917 
2918     if (med->tymed == TYMED_ISTREAM || med->tymed == TYMED_ISTORAGE)
2919     {
2920         stg = med->u.pstg; /* This may actually be a stream, but that's ok */
2921         if (stg) IStorage_AddRef( stg );
2922     }
2923 
2924     hr = IDataObject_RemoteGetDataHere_Proxy(iface, fmt, med);
2925 
2926     med->pUnkForRelease = release;
2927     if (stg)
2928     {
2929         if (med->u.pstg)
2930             IStorage_Release( med->u.pstg );
2931         med->u.pstg = stg;
2932     }
2933 
2934     return hr;
2935 }
2936 
2937 HRESULT __RPC_STUB IDataObject_GetDataHere_Stub(
2938     IDataObject* This,
2939     FORMATETC *pformatetc,
2940     STGMEDIUM *pRemoteMedium)
2941 {
2942     TRACE("(%p)->(%p, %p)\n", This, pformatetc, pRemoteMedium);
2943     return IDataObject_GetDataHere(This, pformatetc, pRemoteMedium);
2944 }
2945 
2946 HRESULT CALLBACK IDataObject_SetData_Proxy(
2947     IDataObject* This,
2948     FORMATETC *pformatetc,
2949     STGMEDIUM *pmedium,
2950     BOOL fRelease)
2951 {
2952     FIXME(":stub\n");
2953     return E_NOTIMPL;
2954 }
2955 
2956 HRESULT __RPC_STUB IDataObject_SetData_Stub(
2957     IDataObject* This,
2958     FORMATETC *pformatetc,
2959     FLAG_STGMEDIUM *pmedium,
2960     BOOL fRelease)
2961 {
2962     FIXME(":stub\n");
2963     return E_NOTIMPL;
2964 }
2965 
2966 /* call_as/local stubs for oleidl.idl */
2967 
2968 HRESULT CALLBACK IOleInPlaceActiveObject_TranslateAccelerator_Proxy(
2969     IOleInPlaceActiveObject* This,
2970     LPMSG lpmsg)
2971 {
2972     TRACE("(%p %p)\n", This, lpmsg);
2973     return IOleInPlaceActiveObject_RemoteTranslateAccelerator_Proxy(This);
2974 }
2975 
2976 HRESULT __RPC_STUB IOleInPlaceActiveObject_TranslateAccelerator_Stub(
2977     IOleInPlaceActiveObject* This)
2978 {
2979     TRACE("(%p)\n", This);
2980     return S_FALSE;
2981 }
2982 
2983 HRESULT CALLBACK IOleInPlaceActiveObject_ResizeBorder_Proxy(
2984     IOleInPlaceActiveObject* This,
2985     LPCRECT prcBorder,
2986     IOleInPlaceUIWindow *pUIWindow,
2987     BOOL fFrameWindow)
2988 {
2989     FIXME(":stub\n");
2990     return E_NOTIMPL;
2991 }
2992 
2993 HRESULT __RPC_STUB IOleInPlaceActiveObject_ResizeBorder_Stub(
2994     IOleInPlaceActiveObject* This,
2995     LPCRECT prcBorder,
2996     REFIID riid,
2997     IOleInPlaceUIWindow *pUIWindow,
2998     BOOL fFrameWindow)
2999 {
3000     FIXME(":stub\n");
3001     return E_NOTIMPL;
3002 }
3003 
3004 HRESULT CALLBACK IOleCache2_UpdateCache_Proxy(
3005     IOleCache2* This,
3006     LPDATAOBJECT pDataObject,
3007     DWORD grfUpdf,
3008     LPVOID pReserved)
3009 {
3010     TRACE("(%p, %p, 0x%08x, %p)\n", This, pDataObject, grfUpdf, pReserved);
3011     return IOleCache2_RemoteUpdateCache_Proxy(This, pDataObject, grfUpdf, (LONG_PTR)pReserved);
3012 }
3013 
3014 HRESULT __RPC_STUB IOleCache2_UpdateCache_Stub(
3015     IOleCache2* This,
3016     LPDATAOBJECT pDataObject,
3017     DWORD grfUpdf,
3018     LONG_PTR pReserved)
3019 {
3020     TRACE("(%p, %p, 0x%08x, %li)\n", This, pDataObject, grfUpdf, pReserved);
3021     return IOleCache2_UpdateCache(This, pDataObject, grfUpdf, (void*)pReserved);
3022 }
3023 
3024 HRESULT CALLBACK IEnumOLEVERB_Next_Proxy(
3025     IEnumOLEVERB* This,
3026     ULONG celt,
3027     LPOLEVERB rgelt,
3028     ULONG *pceltFetched)
3029 {
3030     ULONG fetched;
3031     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
3032     if (!pceltFetched) pceltFetched = &fetched;
3033     return IEnumOLEVERB_RemoteNext_Proxy(This, celt, rgelt, pceltFetched);
3034 }
3035 
3036 HRESULT __RPC_STUB IEnumOLEVERB_Next_Stub(
3037     IEnumOLEVERB* This,
3038     ULONG celt,
3039     LPOLEVERB rgelt,
3040     ULONG *pceltFetched)
3041 {
3042     HRESULT hr;
3043     TRACE("(%p)->(%d, %p, %p)\n", This, celt, rgelt, pceltFetched);
3044     *pceltFetched = 0;
3045     hr = IEnumOLEVERB_Next(This, celt, rgelt, pceltFetched);
3046     if (hr == S_OK) *pceltFetched = celt;
3047     return hr;
3048 }
3049 
3050 HRESULT CALLBACK IViewObject_Draw_Proxy(
3051     IViewObject* This,
3052     DWORD dwDrawAspect,
3053     LONG lindex,
3054     void *pvAspect,
3055     DVTARGETDEVICE *ptd,
3056     HDC hdcTargetDev,
3057     HDC hdcDraw,
3058     LPCRECTL lprcBounds,
3059     LPCRECTL lprcWBounds,
3060     BOOL (STDMETHODCALLTYPE *pfnContinue)(ULONG_PTR dwContinue),
3061     ULONG_PTR dwContinue)
3062 {
3063     FIXME(":stub\n");
3064     return E_NOTIMPL;
3065 }
3066 
3067 HRESULT __RPC_STUB IViewObject_Draw_Stub(
3068     IViewObject* This,
3069     DWORD dwDrawAspect,
3070     LONG lindex,
3071     ULONG_PTR pvAspect,
3072     DVTARGETDEVICE *ptd,
3073     ULONG_PTR hdcTargetDev,
3074     ULONG_PTR hdcDraw,
3075     LPCRECTL lprcBounds,
3076     LPCRECTL lprcWBounds,
3077     IContinue *pContinue)
3078 {
3079     FIXME(":stub\n");
3080     return E_NOTIMPL;
3081 }
3082 
3083 HRESULT CALLBACK IViewObject_GetColorSet_Proxy(
3084     IViewObject* This,
3085     DWORD dwDrawAspect,
3086     LONG lindex,
3087     void *pvAspect,
3088     DVTARGETDEVICE *ptd,
3089     HDC hicTargetDev,
3090     LOGPALETTE **ppColorSet)
3091 {
3092     FIXME(":stub\n");
3093     return E_NOTIMPL;
3094 }
3095 
3096 HRESULT __RPC_STUB IViewObject_GetColorSet_Stub(
3097     IViewObject* This,
3098     DWORD dwDrawAspect,
3099     LONG lindex,
3100     ULONG_PTR pvAspect,
3101     DVTARGETDEVICE *ptd,
3102     ULONG_PTR hicTargetDev,
3103     LOGPALETTE **ppColorSet)
3104 {
3105     FIXME(":stub\n");
3106     return E_NOTIMPL;
3107 }
3108 
3109 HRESULT CALLBACK IViewObject_Freeze_Proxy(
3110     IViewObject* This,
3111     DWORD dwDrawAspect,
3112     LONG lindex,
3113     void *pvAspect,
3114     DWORD *pdwFreeze)
3115 {
3116     FIXME(":stub\n");
3117     return E_NOTIMPL;
3118 }
3119 
3120 HRESULT __RPC_STUB IViewObject_Freeze_Stub(
3121     IViewObject* This,
3122     DWORD dwDrawAspect,
3123     LONG lindex,
3124     ULONG_PTR pvAspect,
3125     DWORD *pdwFreeze)
3126 {
3127     FIXME(":stub\n");
3128     return E_NOTIMPL;
3129 }
3130 
3131 HRESULT CALLBACK IViewObject_GetAdvise_Proxy(
3132     IViewObject* This,
3133     DWORD *pAspects,
3134     DWORD *pAdvf,
3135     IAdviseSink **ppAdvSink)
3136 {
3137     FIXME(":stub\n");
3138     return E_NOTIMPL;
3139 }
3140 
3141 HRESULT __RPC_STUB IViewObject_GetAdvise_Stub(
3142     IViewObject* This,
3143     DWORD *pAspects,
3144     DWORD *pAdvf,
3145     IAdviseSink **ppAdvSink)
3146 {
3147     FIXME(":stub\n");
3148     return E_NOTIMPL;
3149 }
3150