~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~ [ freetext search ] ~ [ file search ] ~

Wine Cross Reference
wine/dlls/rpcrt4/ndr_marshall.c

Version: ~ [ wine-1.1.33 ] ~ [ wine-1.1.32 ] ~ [ wine-1.1.31 ] ~ [ wine-1.1.30 ] ~ [ wine-1.1.29 ] ~ [ wine-1.1.28 ] ~ [ wine-1.1.27 ] ~ [ wine-1.1.26 ] ~ [ wine-1.1.25 ] ~ [ wine-1.1.24 ] ~ [ wine-1.1.23 ] ~ [ wine-1.1.22 ] ~ [ wine-1.1.21 ] ~ [ wine-1.1.20 ] ~ [ wine-1.1.19 ] ~ [ wine-1.1.18 ] ~ [ wine-1.1.17 ] ~ [ wine-1.1.16 ] ~ [ wine-1.1.15 ] ~ [ wine-1.1.14 ] ~ [ wine-1.1.13 ] ~ [ wine-1.1.12 ] ~ [ wine-1.1.11 ] ~ [ wine-1.1.10 ] ~ [ wine-1.1.9 ] ~ [ wine-1.1.8 ] ~ [ wine-1.1.7 ] ~ [ wine-1.0.1 ] ~ [ wine-1.1.6 ] ~ [ wine-1.1.5 ] ~ [ wine-1.1.4 ] ~ [ wine-1.1.3 ] ~ [ wine-1.1.2 ] ~ [ wine-1.1.1 ] ~ [ wine-1.1.0 ] ~ [ wine-1.0 ] ~

  1 /*
  2  * NDR data marshalling
  3  *
  4  * Copyright 2002 Greg Turner
  5  * Copyright 2003-2006 CodeWeavers
  6  *
  7  * This library is free software; you can redistribute it and/or
  8  * modify it under the terms of the GNU Lesser General Public
  9  * License as published by the Free Software Foundation; either
 10  * version 2.1 of the License, or (at your option) any later version.
 11  *
 12  * This library is distributed in the hope that it will be useful,
 13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 15  * Lesser General Public License for more details.
 16  *
 17  * You should have received a copy of the GNU Lesser General Public
 18  * License along with this library; if not, write to the Free Software
 19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 20  *
 21  * TODO:
 22  *  - String structs
 23  *  - Byte count pointers
 24  *  - transmit_as/represent as
 25  *  - Multi-dimensional arrays
 26  *  - Conversion functions (NdrConvert)
 27  *  - Checks for integer addition overflow in user marshall functions
 28  */
 29 
 30 #include <stdarg.h>
 31 #include <stdio.h>
 32 #include <string.h>
 33 #include <limits.h>
 34 
 35 #define NONAMELESSUNION
 36 #include "windef.h"
 37 #include "winbase.h"
 38 #include "winerror.h"
 39 
 40 #include "ndr_misc.h"
 41 #include "rpcndr.h"
 42 
 43 #include "wine/unicode.h"
 44 #include "wine/rpcfc.h"
 45 
 46 #include "wine/debug.h"
 47 
 48 WINE_DEFAULT_DEBUG_CHANNEL(ole);
 49 
 50 #if defined(__i386__)
 51 # define LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32) \
 52     (*((UINT32 *)(pchar)) = (uint32))
 53 
 54 # define LITTLE_ENDIAN_UINT32_READ(pchar) \
 55     (*((UINT32 *)(pchar)))
 56 #else
 57   /* these would work for i386 too, but less efficient */
 58 # define LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32) \
 59     (*(pchar)     = LOBYTE(LOWORD(uint32)), \
 60      *((pchar)+1) = HIBYTE(LOWORD(uint32)), \
 61      *((pchar)+2) = LOBYTE(HIWORD(uint32)), \
 62      *((pchar)+3) = HIBYTE(HIWORD(uint32)))
 63 
 64 # define LITTLE_ENDIAN_UINT32_READ(pchar) \
 65     (MAKELONG( \
 66       MAKEWORD(*(pchar), *((pchar)+1)), \
 67       MAKEWORD(*((pchar)+2), *((pchar)+3))))
 68 #endif
 69 
 70 #define BIG_ENDIAN_UINT32_WRITE(pchar, uint32) \
 71   (*((pchar)+3) = LOBYTE(LOWORD(uint32)), \
 72    *((pchar)+2) = HIBYTE(LOWORD(uint32)), \
 73    *((pchar)+1) = LOBYTE(HIWORD(uint32)), \
 74    *(pchar)     = HIBYTE(HIWORD(uint32)))
 75 
 76 #define BIG_ENDIAN_UINT32_READ(pchar) \
 77   (MAKELONG( \
 78     MAKEWORD(*((pchar)+3), *((pchar)+2)), \
 79     MAKEWORD(*((pchar)+1), *(pchar))))
 80 
 81 #ifdef NDR_LOCAL_IS_BIG_ENDIAN
 82 # define NDR_LOCAL_UINT32_WRITE(pchar, uint32) \
 83     BIG_ENDIAN_UINT32_WRITE(pchar, uint32)
 84 # define NDR_LOCAL_UINT32_READ(pchar) \
 85     BIG_ENDIAN_UINT32_READ(pchar)
 86 #else
 87 # define NDR_LOCAL_UINT32_WRITE(pchar, uint32) \
 88     LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32)
 89 # define NDR_LOCAL_UINT32_READ(pchar) \
 90     LITTLE_ENDIAN_UINT32_READ(pchar)
 91 #endif
 92 
 93 /* _Align must be the desired alignment,
 94  * e.g. ALIGN_LENGTH(len, 4) to align on a dword boundary. */
 95 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align)-1)&~((_Align)-1))
 96 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
 97 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
 98 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
 99 #define ALIGN_POINTER_CLEAR(_Ptr, _Align) \
100     do { \
101         memset((_Ptr), 0, ((_Align) - (ULONG_PTR)(_Ptr)) & ((_Align) - 1)); \
102         ALIGN_POINTER(_Ptr, _Align); \
103     } while(0)
104 
105 #define STD_OVERFLOW_CHECK(_Msg) do { \
106     TRACE("buffer=%d/%d\n", (ULONG)(_Msg->Buffer - (unsigned char *)_Msg->RpcMsg->Buffer), _Msg->BufferLength); \
107     if (_Msg->Buffer > (unsigned char *)_Msg->RpcMsg->Buffer + _Msg->BufferLength) \
108         ERR("buffer overflow %d bytes\n", (ULONG)(_Msg->Buffer - ((unsigned char *)_Msg->RpcMsg->Buffer + _Msg->BufferLength))); \
109   } while (0)
110 
111 #define NDR_POINTER_ID_BASE 0x20000
112 #define NDR_POINTER_ID(pStubMsg) (NDR_POINTER_ID_BASE + ((pStubMsg)->UniquePtrCount++) * 4)
113 #define NDR_TABLE_SIZE 128
114 #define NDR_TABLE_MASK 127
115 
116 static unsigned char *WINAPI NdrBaseTypeMarshall(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
117 static unsigned char *WINAPI NdrBaseTypeUnmarshall(PMIDL_STUB_MESSAGE, unsigned char **, PFORMAT_STRING, unsigned char);
118 static void WINAPI NdrBaseTypeBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
119 static void WINAPI NdrBaseTypeFree(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
120 static ULONG WINAPI NdrBaseTypeMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
121 
122 static unsigned char *WINAPI NdrContextHandleMarshall(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
123 static void WINAPI NdrContextHandleBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
124 static unsigned char *WINAPI NdrContextHandleUnmarshall(PMIDL_STUB_MESSAGE, unsigned char **, PFORMAT_STRING, unsigned char);
125 
126 static unsigned char *WINAPI NdrRangeMarshall(PMIDL_STUB_MESSAGE,unsigned char *, PFORMAT_STRING);
127 static void WINAPI NdrRangeBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
128 static ULONG WINAPI NdrRangeMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
129 static void WINAPI NdrRangeFree(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
130 
131 static ULONG WINAPI NdrByteCountPointerMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
132 
133 const NDR_MARSHALL NdrMarshaller[NDR_TABLE_SIZE] = {
134   0,
135   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
136   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
137   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
138   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
139   /* 0x10 */
140   NdrBaseTypeMarshall,
141   /* 0x11 */
142   NdrPointerMarshall, NdrPointerMarshall,
143   NdrPointerMarshall, NdrPointerMarshall,
144   /* 0x15 */
145   NdrSimpleStructMarshall, NdrSimpleStructMarshall,
146   NdrConformantStructMarshall, NdrConformantStructMarshall,
147   NdrConformantVaryingStructMarshall,
148   NdrComplexStructMarshall,
149   /* 0x1b */
150   NdrConformantArrayMarshall, 
151   NdrConformantVaryingArrayMarshall,
152   NdrFixedArrayMarshall, NdrFixedArrayMarshall,
153   NdrVaryingArrayMarshall, NdrVaryingArrayMarshall,
154   NdrComplexArrayMarshall,
155   /* 0x22 */
156   NdrConformantStringMarshall, 0, 0,
157   NdrConformantStringMarshall,
158   NdrNonConformantStringMarshall, 0, 0, 0,
159   /* 0x2a */
160   NdrEncapsulatedUnionMarshall,
161   NdrNonEncapsulatedUnionMarshall,
162   NdrByteCountPointerMarshall,
163   NdrXmitOrRepAsMarshall, NdrXmitOrRepAsMarshall,
164   /* 0x2f */
165   NdrInterfacePointerMarshall,
166   /* 0x30 */
167   NdrContextHandleMarshall,
168   /* 0xb1 */
169   0, 0, 0,
170   NdrUserMarshalMarshall,
171   0, 0,
172   /* 0xb7 */
173   NdrRangeMarshall
174 };
175 const NDR_UNMARSHALL NdrUnmarshaller[NDR_TABLE_SIZE] = {
176   0,
177   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
178   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
179   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
180   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
181   /* 0x10 */
182   NdrBaseTypeUnmarshall,
183   /* 0x11 */
184   NdrPointerUnmarshall, NdrPointerUnmarshall,
185   NdrPointerUnmarshall, NdrPointerUnmarshall,
186   /* 0x15 */
187   NdrSimpleStructUnmarshall, NdrSimpleStructUnmarshall,
188   NdrConformantStructUnmarshall, NdrConformantStructUnmarshall,
189   NdrConformantVaryingStructUnmarshall,
190   NdrComplexStructUnmarshall,
191   /* 0x1b */
192   NdrConformantArrayUnmarshall, 
193   NdrConformantVaryingArrayUnmarshall,
194   NdrFixedArrayUnmarshall, NdrFixedArrayUnmarshall,
195   NdrVaryingArrayUnmarshall, NdrVaryingArrayUnmarshall,
196   NdrComplexArrayUnmarshall,
197   /* 0x22 */
198   NdrConformantStringUnmarshall, 0, 0,
199   NdrConformantStringUnmarshall,
200   NdrNonConformantStringUnmarshall, 0, 0, 0,
201   /* 0x2a */
202   NdrEncapsulatedUnionUnmarshall,
203   NdrNonEncapsulatedUnionUnmarshall,
204   NdrByteCountPointerUnmarshall,
205   NdrXmitOrRepAsUnmarshall, NdrXmitOrRepAsUnmarshall,
206   /* 0x2f */
207   NdrInterfacePointerUnmarshall,
208   /* 0x30 */
209   NdrContextHandleUnmarshall,
210   /* 0xb1 */
211   0, 0, 0,
212   NdrUserMarshalUnmarshall,
213   0, 0,
214   /* 0xb7 */
215   NdrRangeUnmarshall
216 };
217 const NDR_BUFFERSIZE NdrBufferSizer[NDR_TABLE_SIZE] = {
218   0,
219   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
220   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
221   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
222   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
223   /* 0x10 */
224   NdrBaseTypeBufferSize,
225   /* 0x11 */
226   NdrPointerBufferSize, NdrPointerBufferSize,
227   NdrPointerBufferSize, NdrPointerBufferSize,
228   /* 0x15 */
229   NdrSimpleStructBufferSize, NdrSimpleStructBufferSize,
230   NdrConformantStructBufferSize, NdrConformantStructBufferSize,
231   NdrConformantVaryingStructBufferSize,
232   NdrComplexStructBufferSize,
233   /* 0x1b */
234   NdrConformantArrayBufferSize, 
235   NdrConformantVaryingArrayBufferSize,
236   NdrFixedArrayBufferSize, NdrFixedArrayBufferSize,
237   NdrVaryingArrayBufferSize, NdrVaryingArrayBufferSize,
238   NdrComplexArrayBufferSize,
239   /* 0x22 */
240   NdrConformantStringBufferSize, 0, 0,
241   NdrConformantStringBufferSize,
242   NdrNonConformantStringBufferSize, 0, 0, 0,
243   /* 0x2a */
244   NdrEncapsulatedUnionBufferSize,
245   NdrNonEncapsulatedUnionBufferSize,
246   NdrByteCountPointerBufferSize,
247   NdrXmitOrRepAsBufferSize, NdrXmitOrRepAsBufferSize,
248   /* 0x2f */
249   NdrInterfacePointerBufferSize,
250   /* 0x30 */
251   NdrContextHandleBufferSize,
252   /* 0xb1 */
253   0, 0, 0,
254   NdrUserMarshalBufferSize,
255   0, 0,
256   /* 0xb7 */
257   NdrRangeBufferSize
258 };
259 const NDR_MEMORYSIZE NdrMemorySizer[NDR_TABLE_SIZE] = {
260   0,
261   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
262   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
263   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
264   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
265   /* 0x10 */
266   NdrBaseTypeMemorySize,
267   /* 0x11 */
268   NdrPointerMemorySize, NdrPointerMemorySize,
269   NdrPointerMemorySize, NdrPointerMemorySize,
270   /* 0x15 */
271   NdrSimpleStructMemorySize, NdrSimpleStructMemorySize,
272   NdrConformantStructMemorySize, NdrConformantStructMemorySize,
273   NdrConformantVaryingStructMemorySize,
274   NdrComplexStructMemorySize,
275   /* 0x1b */
276   NdrConformantArrayMemorySize,
277   NdrConformantVaryingArrayMemorySize,
278   NdrFixedArrayMemorySize, NdrFixedArrayMemorySize,
279   NdrVaryingArrayMemorySize, NdrVaryingArrayMemorySize,
280   NdrComplexArrayMemorySize,
281   /* 0x22 */
282   NdrConformantStringMemorySize, 0, 0,
283   NdrConformantStringMemorySize,
284   NdrNonConformantStringMemorySize, 0, 0, 0,
285   /* 0x2a */
286   NdrEncapsulatedUnionMemorySize,
287   NdrNonEncapsulatedUnionMemorySize,
288   NdrByteCountPointerMemorySize,
289   NdrXmitOrRepAsMemorySize, NdrXmitOrRepAsMemorySize,
290   /* 0x2f */
291   NdrInterfacePointerMemorySize,
292   /* 0x30 */
293   0,
294   /* 0xb1 */
295   0, 0, 0,
296   NdrUserMarshalMemorySize,
297   0, 0,
298   /* 0xb7 */
299   NdrRangeMemorySize
300 };
301 const NDR_FREE NdrFreer[NDR_TABLE_SIZE] = {
302   0,
303   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
304   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
305   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
306   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
307   /* 0x10 */
308   NdrBaseTypeFree,
309   /* 0x11 */
310   NdrPointerFree, NdrPointerFree,
311   NdrPointerFree, NdrPointerFree,
312   /* 0x15 */
313   NdrSimpleStructFree, NdrSimpleStructFree,
314   NdrConformantStructFree, NdrConformantStructFree,
315   NdrConformantVaryingStructFree,
316   NdrComplexStructFree,
317   /* 0x1b */
318   NdrConformantArrayFree, 
319   NdrConformantVaryingArrayFree,
320   NdrFixedArrayFree, NdrFixedArrayFree,
321   NdrVaryingArrayFree, NdrVaryingArrayFree,
322   NdrComplexArrayFree,
323   /* 0x22 */
324   0, 0, 0,
325   0, 0, 0, 0, 0,
326   /* 0x2a */
327   NdrEncapsulatedUnionFree,
328   NdrNonEncapsulatedUnionFree,
329   0,
330   NdrXmitOrRepAsFree, NdrXmitOrRepAsFree,
331   /* 0x2f */
332   NdrInterfacePointerFree,
333   /* 0x30 */
334   0,
335   /* 0xb1 */
336   0, 0, 0,
337   NdrUserMarshalFree,
338   0, 0,
339   /* 0xb7 */
340   NdrRangeFree
341 };
342 
343 typedef struct _NDR_MEMORY_LIST
344 {
345     ULONG magic;
346     ULONG size;
347     ULONG reserved;
348     struct _NDR_MEMORY_LIST *next;
349 } NDR_MEMORY_LIST;
350 
351 #define MEML_MAGIC  ('M' << 24 | 'E' << 16 | 'M' << 8 | 'L')
352 
353 /***********************************************************************
354  *            NdrAllocate [RPCRT4.@]
355  *
356  * Allocates a block of memory using pStubMsg->pfnAllocate.
357  *
358  * PARAMS
359  *  pStubMsg [I/O] MIDL_STUB_MESSAGE structure.
360  *  len      [I]   Size of memory block to allocate.
361  *
362  * RETURNS
363  *  The memory block of size len that was allocated.
364  *
365  * NOTES
366  *  The memory block is always 8-byte aligned.
367  *  If the function is unable to allocate memory an ERROR_OUTOFMEMORY
368  *  exception is raised.
369  */
370 void * WINAPI NdrAllocate(MIDL_STUB_MESSAGE *pStubMsg, SIZE_T len)
371 {
372     SIZE_T aligned_len;
373     SIZE_T adjusted_len;
374     void *p;
375     NDR_MEMORY_LIST *mem_list;
376 
377     aligned_len = ALIGNED_LENGTH(len, 8);
378     adjusted_len = aligned_len + sizeof(NDR_MEMORY_LIST);
379     /* check for overflow */
380     if (adjusted_len < len)
381     {
382         ERR("overflow of adjusted_len %ld, len %ld\n", adjusted_len, len);
383         RpcRaiseException(RPC_X_BAD_STUB_DATA);
384     }
385 
386     p = pStubMsg->pfnAllocate(adjusted_len);
387     if (!p) RpcRaiseException(ERROR_OUTOFMEMORY);
388 
389     mem_list = (NDR_MEMORY_LIST *)((char *)p + aligned_len);
390     mem_list->magic = MEML_MAGIC;
391     mem_list->size = aligned_len;
392     mem_list->reserved = 0;
393     mem_list->next = pStubMsg->pMemoryList;
394     pStubMsg->pMemoryList = mem_list;
395 
396     TRACE("-- %p\n", p);
397     return p;
398 }
399 
400 static void NdrFree(MIDL_STUB_MESSAGE *pStubMsg, unsigned char *Pointer)
401 {
402     TRACE("(%p, %p)\n", pStubMsg, Pointer);
403 
404     pStubMsg->pfnFree(Pointer);
405 }
406 
407 static inline BOOL IsConformanceOrVariancePresent(PFORMAT_STRING pFormat)
408 {
409     return (*(const ULONG *)pFormat != -1);
410 }
411 
412 static PFORMAT_STRING ReadConformance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat)
413 {
414   ALIGN_POINTER(pStubMsg->Buffer, 4);
415   if (pStubMsg->Buffer + 4 > pStubMsg->BufferEnd)
416       RpcRaiseException(RPC_X_BAD_STUB_DATA);
417   pStubMsg->MaxCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
418   pStubMsg->Buffer += 4;
419   TRACE("unmarshalled conformance is %ld\n", pStubMsg->MaxCount);
420   if (pStubMsg->fHasNewCorrDesc)
421     return pFormat+6;
422   else
423     return pFormat+4;
424 }
425 
426 static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat, ULONG MaxValue)
427 {
428   if (pFormat && !IsConformanceOrVariancePresent(pFormat))
429   {
430     pStubMsg->Offset = 0;
431     pStubMsg->ActualCount = pStubMsg->MaxCount;
432     goto done;
433   }
434 
435   ALIGN_POINTER(pStubMsg->Buffer, 4);
436   if (pStubMsg->Buffer + 8 > pStubMsg->BufferEnd)
437     RpcRaiseException(RPC_X_BAD_STUB_DATA);
438   pStubMsg->Offset      = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
439   pStubMsg->Buffer += 4;
440   TRACE("offset is %d\n", pStubMsg->Offset);
441   pStubMsg->ActualCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
442   pStubMsg->Buffer += 4;
443   TRACE("variance is %d\n", pStubMsg->ActualCount);
444 
445   if ((pStubMsg->ActualCount > MaxValue) ||
446       (pStubMsg->ActualCount + pStubMsg->Offset > MaxValue))
447   {
448     ERR("invalid array bound(s): ActualCount = %d, Offset = %d, MaxValue = %d\n",
449         pStubMsg->ActualCount, pStubMsg->Offset, MaxValue);
450     RpcRaiseException(RPC_S_INVALID_BOUND);
451     return NULL;
452   }
453 
454 done:
455   if (pStubMsg->fHasNewCorrDesc)
456     return pFormat+6;
457   else
458     return pFormat+4;
459 }
460 
461 /* writes the conformance value to the buffer */
462 static inline void WriteConformance(MIDL_STUB_MESSAGE *pStubMsg)
463 {
464     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
465     if (pStubMsg->Buffer + 4 > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength)
466         RpcRaiseException(RPC_X_BAD_STUB_DATA);
467     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->MaxCount);
468     pStubMsg->Buffer += 4;
469 }
470 
471 /* writes the variance values to the buffer */
472 static inline void WriteVariance(MIDL_STUB_MESSAGE *pStubMsg)
473 {
474     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
475     if (pStubMsg->Buffer + 8 > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength)
476         RpcRaiseException(RPC_X_BAD_STUB_DATA);
477     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->Offset);
478     pStubMsg->Buffer += 4;
479     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->ActualCount);
480     pStubMsg->Buffer += 4;
481 }
482 
483 /* requests buffer space for the conformance value */
484 static inline void SizeConformance(MIDL_STUB_MESSAGE *pStubMsg)
485 {
486     ALIGN_LENGTH(pStubMsg->BufferLength, 4);
487     if (pStubMsg->BufferLength + 4 < pStubMsg->BufferLength)
488         RpcRaiseException(RPC_X_BAD_STUB_DATA);
489     pStubMsg->BufferLength += 4;
490 }
491 
492 /* requests buffer space for the variance values */
493 static inline void SizeVariance(MIDL_STUB_MESSAGE *pStubMsg)
494 {
495     ALIGN_LENGTH(pStubMsg->BufferLength, 4);
496     if (pStubMsg->BufferLength + 8 < pStubMsg->BufferLength)
497         RpcRaiseException(RPC_X_BAD_STUB_DATA);
498     pStubMsg->BufferLength += 8;
499 }
500 
501 PFORMAT_STRING ComputeConformanceOrVariance(
502     MIDL_STUB_MESSAGE *pStubMsg, unsigned char *pMemory,
503     PFORMAT_STRING pFormat, ULONG_PTR def, ULONG_PTR *pCount)
504 {
505   BYTE dtype = pFormat[0] & 0xf;
506   short ofs = *(const short *)&pFormat[2];
507   LPVOID ptr = NULL;
508   DWORD data = 0;
509 
510   if (!IsConformanceOrVariancePresent(pFormat)) {
511     /* null descriptor */
512     *pCount = def;
513     goto finish_conf;
514   }
515 
516   switch (pFormat[0] & 0xf0) {
517   case RPC_FC_NORMAL_CONFORMANCE:
518     TRACE("normal conformance, ofs=%d\n", ofs);
519     ptr = pMemory;
520     break;
521   case RPC_FC_POINTER_CONFORMANCE:
522     TRACE("pointer conformance, ofs=%d\n", ofs);
523     ptr = pStubMsg->Memory;
524     break;
525   case RPC_FC_TOP_LEVEL_CONFORMANCE:
526     TRACE("toplevel conformance, ofs=%d\n", ofs);
527     if (pStubMsg->StackTop) {
528       ptr = pStubMsg->StackTop;
529     }
530     else {
531       /* -Os mode, *pCount is already set */
532       goto finish_conf;
533     }
534     break;
535   case RPC_FC_CONSTANT_CONFORMANCE:
536     data = ofs | ((DWORD)pFormat[1] << 16);
537     TRACE("constant conformance, val=%d\n", data);
538     *pCount = data;
539     goto finish_conf;
540   case RPC_FC_TOP_LEVEL_MULTID_CONFORMANCE:
541     FIXME("toplevel multidimensional conformance, ofs=%d\n", ofs);
542     if (pStubMsg->StackTop) {
543       ptr = pStubMsg->StackTop;
544     }
545     else {
546       /* ? */
547       goto done_conf_grab;
548     }
549     break;
550   default:
551     FIXME("unknown conformance type %x\n", pFormat[0] & 0xf0);
552   }
553 
554   switch (pFormat[1]) {
555   case RPC_FC_DEREFERENCE:
556     ptr = *(LPVOID*)((char *)ptr + ofs);
557     break;
558   case RPC_FC_CALLBACK:
559   {
560     unsigned char *old_stack_top = pStubMsg->StackTop;
561     pStubMsg->StackTop = ptr;
562 
563     /* ofs is index into StubDesc->apfnExprEval */
564     TRACE("callback conformance into apfnExprEval[%d]\n", ofs);
565     pStubMsg->StubDesc->apfnExprEval[ofs](pStubMsg);
566 
567     pStubMsg->StackTop = old_stack_top;
568 
569     /* the callback function always stores the computed value in MaxCount */
570     *pCount = pStubMsg->MaxCount;
571     goto finish_conf;
572   }
573   default:
574     ptr = (char *)ptr + ofs;
575     break;
576   }
577 
578   switch (dtype) {
579   case RPC_FC_LONG:
580   case RPC_FC_ULONG:
581     data = *(DWORD*)ptr;
582     break;
583   case RPC_FC_SHORT:
584     data = *(SHORT*)ptr;
585     break;
586   case RPC_FC_USHORT:
587     data = *(USHORT*)ptr;
588     break;
589   case RPC_FC_CHAR:
590   case RPC_FC_SMALL:
591     data = *(CHAR*)ptr;
592     break;
593   case RPC_FC_BYTE:
594   case RPC_FC_USMALL:
595     data = *(UCHAR*)ptr;
596     break;
597   default:
598     FIXME("unknown conformance data type %x\n", dtype);
599     goto done_conf_grab;
600   }
601   TRACE("dereferenced data type %x at %p, got %d\n", dtype, ptr, data);
602 
603 done_conf_grab:
604   switch (pFormat[1]) {
605   case RPC_FC_DEREFERENCE: /* already handled */
606   case 0: /* no op */
607     *pCount = data;
608     break;
609   case RPC_FC_ADD_1:
610     *pCount = data + 1;
611     break;
612   case RPC_FC_SUB_1:
613     *pCount = data - 1;
614     break;
615   case RPC_FC_MULT_2:
616     *pCount = data * 2;
617     break;
618   case RPC_FC_DIV_2:
619     *pCount = data / 2;
620     break;
621   default:
622     FIXME("unknown conformance op %d\n", pFormat[1]);
623     goto finish_conf;
624   }
625 
626 finish_conf:
627   TRACE("resulting conformance is %ld\n", *pCount);
628   if (pStubMsg->fHasNewCorrDesc)
629     return pFormat+6;
630   else
631     return pFormat+4;
632 }
633 
634 static inline PFORMAT_STRING SkipConformance(PMIDL_STUB_MESSAGE pStubMsg,
635                                              PFORMAT_STRING pFormat)
636 {
637   if (IsConformanceOrVariancePresent(pFormat))
638   {
639     if (pStubMsg->fHasNewCorrDesc)
640       pFormat += 6;
641     else
642       pFormat += 4;
643   }
644   return pFormat;
645 }
646 
647 /* multiply two numbers together, raising an RPC_S_INVALID_BOUND exception if
648  * the result overflows 32-bits */
649 static inline ULONG safe_multiply(ULONG a, ULONG b)
650 {
651     ULONGLONG ret = (ULONGLONG)a * b;
652     if (ret > 0xffffffff)
653     {
654         RpcRaiseException(RPC_S_INVALID_BOUND);
655         return 0;
656     }
657     return ret;
658 }
659 
660 static inline void safe_buffer_increment(MIDL_STUB_MESSAGE *pStubMsg, ULONG size)
661 {
662     if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
663         (pStubMsg->Buffer + size > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength))
664         RpcRaiseException(RPC_X_BAD_STUB_DATA);
665     pStubMsg->Buffer += size;
666 }
667 
668 static inline void safe_buffer_length_increment(MIDL_STUB_MESSAGE *pStubMsg, ULONG size)
669 {
670     if (pStubMsg->BufferLength + size < pStubMsg->BufferLength) /* integer overflow of pStubMsg->BufferSize */
671     {
672         ERR("buffer length overflow - BufferLength = %u, size = %u\n",
673             pStubMsg->BufferLength, size);
674         RpcRaiseException(RPC_X_BAD_STUB_DATA);
675     }
676     pStubMsg->BufferLength += size;
677 }
678 
679 /* copies data from the buffer, checking that there is enough data in the buffer
680  * to do so */
681 static inline void safe_copy_from_buffer(MIDL_STUB_MESSAGE *pStubMsg, void *p, ULONG size)
682 {
683     if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
684         (pStubMsg->Buffer + size > pStubMsg->BufferEnd))
685     {
686         ERR("buffer overflow - Buffer = %p, BufferEnd = %p, size = %u\n",
687             pStubMsg->Buffer, pStubMsg->BufferEnd, size);
688         RpcRaiseException(RPC_X_BAD_STUB_DATA);
689     }
690     if (p == pStubMsg->Buffer)
691         ERR("pointer is the same as the buffer\n");
692     memcpy(p, pStubMsg->Buffer, size);
693     pStubMsg->Buffer += size;
694 }
695 
696 /* copies data to the buffer, checking that there is enough space to do so */
697 static inline void safe_copy_to_buffer(MIDL_STUB_MESSAGE *pStubMsg, const void *p, ULONG size)
698 {
699     if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
700         (pStubMsg->Buffer + size > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength))
701     {
702         ERR("buffer overflow - Buffer = %p, BufferEnd = %p, size = %u\n",
703             pStubMsg->Buffer, (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength,
704             size);
705         RpcRaiseException(RPC_X_BAD_STUB_DATA);
706     }
707     memcpy(pStubMsg->Buffer, p, size);
708     pStubMsg->Buffer += size;
709 }
710 
711 /* verify that string data sitting in the buffer is valid and safe to
712  * unmarshall */
713 static void validate_string_data(MIDL_STUB_MESSAGE *pStubMsg, ULONG bufsize, ULONG esize)
714 {
715     ULONG i;
716 
717     /* verify the buffer is safe to access */
718     if ((pStubMsg->Buffer + bufsize < pStubMsg->Buffer) ||
719         (pStubMsg->Buffer + bufsize > pStubMsg->BufferEnd))
720     {
721         ERR("bufsize 0x%x exceeded buffer end %p of buffer %p\n", bufsize,
722             pStubMsg->BufferEnd, pStubMsg->Buffer);
723         RpcRaiseException(RPC_X_BAD_STUB_DATA);
724     }
725 
726     /* strings must always have null terminating bytes */
727     if (bufsize < esize)
728     {
729         ERR("invalid string length of %d\n", bufsize / esize);
730         RpcRaiseException(RPC_S_INVALID_BOUND);
731     }
732 
733     for (i = bufsize - esize; i < bufsize; i++)
734         if (pStubMsg->Buffer[i] != 0)
735         {
736             ERR("string not null-terminated at byte position %d, data is 0x%x\n",
737                 i, pStubMsg->Buffer[i]);
738             RpcRaiseException(RPC_S_INVALID_BOUND);
739         }
740 }
741 
742 static inline void dump_pointer_attr(unsigned char attr)
743 {
744     if (attr & RPC_FC_P_ALLOCALLNODES)
745         TRACE(" RPC_FC_P_ALLOCALLNODES");
746     if (attr & RPC_FC_P_DONTFREE)
747         TRACE(" RPC_FC_P_DONTFREE");
748     if (attr & RPC_FC_P_ONSTACK)
749         TRACE(" RPC_FC_P_ONSTACK");
750     if (attr & RPC_FC_P_SIMPLEPOINTER)
751         TRACE(" RPC_FC_P_SIMPLEPOINTER");
752     if (attr & RPC_FC_P_DEREF)
753         TRACE(" RPC_FC_P_DEREF");
754     TRACE("\n");
755 }
756 
757 /***********************************************************************
758  *           PointerMarshall [internal]
759  */
760 static void PointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
761                             unsigned char *Buffer,
762                             unsigned char *Pointer,
763                             PFORMAT_STRING pFormat)
764 {
765   unsigned type = pFormat[0], attr = pFormat[1];
766   PFORMAT_STRING desc;
767   NDR_MARSHALL m;
768   ULONG pointer_id;
769   int pointer_needs_marshaling;
770 
771   TRACE("(%p,%p,%p,%p)\n", pStubMsg, Buffer, Pointer, pFormat);
772   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
773   pFormat += 2;
774   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
775   else desc = pFormat + *(const SHORT*)pFormat;
776 
777   switch (type) {
778   case RPC_FC_RP: /* ref pointer (always non-null) */
779     if (!Pointer)
780     {
781       ERR("NULL ref pointer is not allowed\n");
782       RpcRaiseException(RPC_X_NULL_REF_POINTER);
783     }
784     pointer_needs_marshaling = 1;
785     break;
786   case RPC_FC_UP: /* unique pointer */
787   case RPC_FC_OP: /* object pointer - same as unique here */
788     if (Pointer)
789       pointer_needs_marshaling = 1;
790     else
791       pointer_needs_marshaling = 0;
792     pointer_id = Pointer ? NDR_POINTER_ID(pStubMsg) : 0;
793     TRACE("writing 0x%08x to buffer\n", pointer_id);
794     NDR_LOCAL_UINT32_WRITE(Buffer, pointer_id);
795     break;
796   case RPC_FC_FP:
797     pointer_needs_marshaling = !NdrFullPointerQueryPointer(
798       pStubMsg->FullPtrXlatTables, Pointer, 1, &pointer_id);
799     TRACE("writing 0x%08x to buffer\n", pointer_id);
800     NDR_LOCAL_UINT32_WRITE(Buffer, pointer_id);
801     break;
802   default:
803     FIXME("unhandled ptr type=%02x\n", type);
804     RpcRaiseException(RPC_X_BAD_STUB_DATA);
805     return;
806   }
807 
808   TRACE("calling marshaller for type 0x%x\n", (int)*desc);
809 
810   if (pointer_needs_marshaling) {
811     if (attr & RPC_FC_P_DEREF) {
812       Pointer = *(unsigned char**)Pointer;
813       TRACE("deref => %p\n", Pointer);
814     }
815     m = NdrMarshaller[*desc & NDR_TABLE_MASK];
816     if (m) m(pStubMsg, Pointer, desc);
817     else FIXME("no marshaller for data type=%02x\n", *desc);
818   }
819 
820   STD_OVERFLOW_CHECK(pStubMsg);
821 }
822 
823 /***********************************************************************
824  *           PointerUnmarshall [internal]
825  */
826 static void PointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
827                               unsigned char *Buffer,
828                               unsigned char **pPointer,
829                               unsigned char *pSrcPointer,
830                               PFORMAT_STRING pFormat,
831                               unsigned char fMustAlloc)
832 {
833   unsigned type = pFormat[0], attr = pFormat[1];
834   PFORMAT_STRING desc;
835   NDR_UNMARSHALL m;
836   DWORD pointer_id = 0;
837   int pointer_needs_unmarshaling;
838 
839   TRACE("(%p,%p,%p,%p,%p,%d)\n", pStubMsg, Buffer, pPointer, pSrcPointer, pFormat, fMustAlloc);
840   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
841   pFormat += 2;
842   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
843   else desc = pFormat + *(const SHORT*)pFormat;
844 
845   switch (type) {
846   case RPC_FC_RP: /* ref pointer (always non-null) */
847     pointer_needs_unmarshaling = 1;
848     break;
849   case RPC_FC_UP: /* unique pointer */
850     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
851     TRACE("pointer_id is 0x%08x\n", pointer_id);
852     if (pointer_id)
853       pointer_needs_unmarshaling = 1;
854     else {
855       *pPointer = NULL;
856       pointer_needs_unmarshaling = 0;
857     }
858     break;
859   case RPC_FC_OP: /* object pointer - we must free data before overwriting it */
860     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
861     TRACE("pointer_id is 0x%08x\n", pointer_id);
862     if (!fMustAlloc && pSrcPointer)
863     {
864         FIXME("free object pointer %p\n", pSrcPointer);
865         fMustAlloc = TRUE;
866     }
867     if (pointer_id)
868       pointer_needs_unmarshaling = 1;
869     else
870     {
871       *pPointer = NULL;    
872       pointer_needs_unmarshaling = 0;
873     }
874     break;
875   case RPC_FC_FP:
876     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
877     TRACE("pointer_id is 0x%08x\n", pointer_id);
878     pointer_needs_unmarshaling = !NdrFullPointerQueryRefId(
879       pStubMsg->FullPtrXlatTables, pointer_id, 1, (void **)pPointer);
880     break;
881   default:
882     FIXME("unhandled ptr type=%02x\n", type);
883     RpcRaiseException(RPC_X_BAD_STUB_DATA);
884     return;
885   }
886 
887   if (pointer_needs_unmarshaling) {
888     unsigned char *base_ptr_val = *pPointer;
889     unsigned char **current_ptr = pPointer;
890     if (pStubMsg->IsClient) {
891       TRACE("client\n");
892       /* if we aren't forcing allocation of memory then try to use the existing
893        * (source) pointer to unmarshall the data into so that [in,out]
894        * parameters behave correctly. it doesn't matter if the parameter is
895        * [out] only since in that case the pointer will be NULL. we force
896        * allocation when the source pointer is NULL here instead of in the type
897        * unmarshalling routine for the benefit of the deref code below */
898       if (!fMustAlloc) {
899         if (pSrcPointer) {
900           TRACE("setting *pPointer to %p\n", pSrcPointer);
901           *pPointer = base_ptr_val = pSrcPointer;
902         } else
903           fMustAlloc = TRUE;
904       }
905     } else {
906       TRACE("server\n");
907       /* the memory in a stub is never initialised, so we have to work out here
908        * whether we have to initialise it so we can use the optimisation of
909        * setting the pointer to the buffer, if possible, or set fMustAlloc to
910        * TRUE. */
911       if (attr & RPC_FC_P_DEREF) {
912         fMustAlloc = TRUE;
913       } else {
914         base_ptr_val = NULL;
915         *current_ptr = NULL;
916       }
917     }
918 
919     if (attr & RPC_FC_P_ALLOCALLNODES)
920         FIXME("RPC_FC_P_ALLOCALLNODES not implemented\n");
921 
922     if (attr & RPC_FC_P_DEREF) {
923       if (fMustAlloc) {
924         base_ptr_val = NdrAllocate(pStubMsg, sizeof(void *));
925         *pPointer = base_ptr_val;
926         current_ptr = (unsigned char **)base_ptr_val;
927       } else
928         current_ptr = *(unsigned char***)current_ptr;
929       TRACE("deref => %p\n", current_ptr);
930       if (!fMustAlloc && !*current_ptr) fMustAlloc = TRUE;
931     }
932     m = NdrUnmarshaller[*desc & NDR_TABLE_MASK];
933     if (m) m(pStubMsg, current_ptr, desc, fMustAlloc);
934     else FIXME("no unmarshaller for data type=%02x\n", *desc);
935 
936     if (type == RPC_FC_FP)
937       NdrFullPointerInsertRefId(pStubMsg->FullPtrXlatTables, pointer_id,
938                                 base_ptr_val);
939   }
940 
941   TRACE("pointer=%p\n", *pPointer);
942 }
943 
944 /***********************************************************************
945  *           PointerBufferSize [internal]
946  */
947 static void PointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
948                               unsigned char *Pointer,
949                               PFORMAT_STRING pFormat)
950 {
951   unsigned type = pFormat[0], attr = pFormat[1];
952   PFORMAT_STRING desc;
953   NDR_BUFFERSIZE m;
954   int pointer_needs_sizing;
955   ULONG pointer_id;
956 
957   TRACE("(%p,%p,%p)\n", pStubMsg, Pointer, pFormat);
958   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
959   pFormat += 2;
960   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
961   else desc = pFormat + *(const SHORT*)pFormat;
962 
963   switch (type) {
964   case RPC_FC_RP: /* ref pointer (always non-null) */
965     if (!Pointer)
966     {
967       ERR("NULL ref pointer is not allowed\n");
968       RpcRaiseException(RPC_X_NULL_REF_POINTER);
969     }
970     break;
971   case RPC_FC_OP:
972   case RPC_FC_UP:
973     /* NULL pointer has no further representation */
974     if (!Pointer)
975         return;
976     break;
977   case RPC_FC_FP:
978     pointer_needs_sizing = !NdrFullPointerQueryPointer(
979       pStubMsg->FullPtrXlatTables, Pointer, 0, &pointer_id);
980     if (!pointer_needs_sizing)
981       return;
982     break;
983   default:
984     FIXME("unhandled ptr type=%02x\n", type);
985     RpcRaiseException(RPC_X_BAD_STUB_DATA);
986     return;
987   }
988 
989   if (attr & RPC_FC_P_DEREF) {
990     Pointer = *(unsigned char**)Pointer;
991     TRACE("deref => %p\n", Pointer);
992   }
993 
994   m = NdrBufferSizer[*desc & NDR_TABLE_MASK];
995   if (m) m(pStubMsg, Pointer, desc);
996   else FIXME("no buffersizer for data type=%02x\n", *desc);
997 }
998 
999 /***********************************************************************
1000  *           PointerMemorySize [internal]
1001  */
1002 static ULONG PointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1003                                unsigned char *Buffer, PFORMAT_STRING pFormat)
1004 {
1005   unsigned type = pFormat[0], attr = pFormat[1];
1006   PFORMAT_STRING desc;
1007   NDR_MEMORYSIZE m;
1008   DWORD pointer_id = 0;
1009   int pointer_needs_sizing;
1010 
1011   TRACE("(%p,%p,%p)\n", pStubMsg, Buffer, pFormat);
1012   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
1013   pFormat += 2;
1014   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
1015   else desc = pFormat + *(const SHORT*)pFormat;
1016 
1017   switch (type) {
1018   case RPC_FC_RP: /* ref pointer (always non-null) */
1019     pointer_needs_sizing = 1;
1020     break;
1021   case RPC_FC_UP: /* unique pointer */
1022   case RPC_FC_OP: /* object pointer - we must free data before overwriting it */
1023     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
1024     TRACE("pointer_id is 0x%08x\n", pointer_id);
1025     if (pointer_id)
1026       pointer_needs_sizing = 1;
1027     else
1028       pointer_needs_sizing = 0;
1029     break;
1030   case RPC_FC_FP:
1031   {
1032     void *pointer;
1033     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
1034     TRACE("pointer_id is 0x%08x\n", pointer_id);
1035     pointer_needs_sizing = !NdrFullPointerQueryRefId(
1036       pStubMsg->FullPtrXlatTables, pointer_id, 1, &pointer);
1037     break;
1038   }
1039   default:
1040     FIXME("unhandled ptr type=%02x\n", type);
1041     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1042     return 0;
1043   }
1044 
1045   if (attr & RPC_FC_P_DEREF) {
1046     ALIGN_LENGTH(pStubMsg->MemorySize, sizeof(void*));
1047     pStubMsg->MemorySize += sizeof(void*);
1048     TRACE("deref\n");
1049   }
1050 
1051   if (pointer_needs_sizing) {
1052     m = NdrMemorySizer[*desc & NDR_TABLE_MASK];
1053     if (m) m(pStubMsg, desc);
1054     else FIXME("no memorysizer for data type=%02x\n", *desc);
1055   }
1056 
1057   return pStubMsg->MemorySize;
1058 }
1059 
1060 /***********************************************************************
1061  *           PointerFree [internal]
1062  */
1063 static void PointerFree(PMIDL_STUB_MESSAGE pStubMsg,
1064                         unsigned char *Pointer,
1065                         PFORMAT_STRING pFormat)
1066 {
1067   unsigned type = pFormat[0], attr = pFormat[1];
1068   PFORMAT_STRING desc;
1069   NDR_FREE m;
1070   unsigned char *current_pointer = Pointer;
1071 
1072   TRACE("(%p,%p,%p)\n", pStubMsg, Pointer, pFormat);
1073   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
1074   if (attr & RPC_FC_P_DONTFREE) return;
1075   pFormat += 2;
1076   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
1077   else desc = pFormat + *(const SHORT*)pFormat;
1078 
1079   if (!Pointer) return;
1080 
1081   if (type == RPC_FC_FP) {
1082     int pointer_needs_freeing = NdrFullPointerFree(
1083       pStubMsg->FullPtrXlatTables, Pointer);
1084     if (!pointer_needs_freeing)
1085       return;
1086   }
1087 
1088   if (attr & RPC_FC_P_DEREF) {
1089     current_pointer = *(unsigned char**)Pointer;
1090     TRACE("deref => %p\n", current_pointer);
1091   }
1092 
1093   m = NdrFreer[*desc & NDR_TABLE_MASK];
1094   if (m) m(pStubMsg, current_pointer, desc);
1095 
1096   /* this check stops us from trying to free buffer memory. we don't have to
1097    * worry about clients, since they won't call this function.
1098    * we don't have to check for the buffer being reallocated because
1099    * BufferStart and BufferEnd won't be reset when allocating memory for
1100    * sending the response. we don't have to check for the new buffer here as
1101    * it won't be used a type memory, only for buffer memory */
1102   if (Pointer >= pStubMsg->BufferStart && Pointer < pStubMsg->BufferEnd)
1103       goto notfree;
1104 
1105   if (attr & RPC_FC_P_ONSTACK) {
1106     TRACE("not freeing stack ptr %p\n", Pointer);
1107     return;
1108   }
1109   TRACE("freeing %p\n", Pointer);
1110   NdrFree(pStubMsg, Pointer);
1111   return;
1112 notfree:
1113   TRACE("not freeing %p\n", Pointer);
1114 }
1115 
1116 /***********************************************************************
1117  *           EmbeddedPointerMarshall
1118  */
1119 static unsigned char * EmbeddedPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
1120                                                unsigned char *pMemory,
1121                                                PFORMAT_STRING pFormat)
1122 {
1123   unsigned char *Mark = pStubMsg->BufferMark;
1124   unsigned rep, count, stride;
1125   unsigned i;
1126   unsigned char *saved_buffer = NULL;
1127 
1128   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1129 
1130   if (*pFormat != RPC_FC_PP) return NULL;
1131   pFormat += 2;
1132 
1133   if (pStubMsg->PointerBufferMark)
1134   {
1135     saved_buffer = pStubMsg->Buffer;
1136     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
1137     pStubMsg->PointerBufferMark = NULL;
1138   }
1139 
1140   while (pFormat[0] != RPC_FC_END) {
1141     switch (pFormat[0]) {
1142     default:
1143       FIXME("unknown repeat type %d\n", pFormat[0]);
1144     case RPC_FC_NO_REPEAT:
1145       rep = 1;
1146       stride = 0;
1147       count = 1;
1148       pFormat += 2;
1149       break;
1150     case RPC_FC_FIXED_REPEAT:
1151       rep = *(const WORD*)&pFormat[2];
1152       stride = *(const WORD*)&pFormat[4];
1153       count = *(const WORD*)&pFormat[8];
1154       pFormat += 10;
1155       break;
1156     case RPC_FC_VARIABLE_REPEAT:
1157       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1158       stride = *(const WORD*)&pFormat[2];
1159       count = *(const WORD*)&pFormat[6];
1160       pFormat += 8;
1161       break;
1162     }
1163     for (i = 0; i < rep; i++) {
1164       PFORMAT_STRING info = pFormat;
1165       unsigned char *membase = pMemory + (i * stride);
1166       unsigned char *bufbase = Mark + (i * stride);
1167       unsigned u;
1168 
1169       for (u=0; u<count; u++,info+=8) {
1170         unsigned char *memptr = membase + *(const SHORT*)&info[0];
1171         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
1172         unsigned char *saved_memory = pStubMsg->Memory;
1173 
1174         pStubMsg->Memory = pMemory;
1175         PointerMarshall(pStubMsg, bufptr, *(unsigned char**)memptr, info+4);
1176         pStubMsg->Memory = saved_memory;
1177       }
1178     }
1179     pFormat += 8 * count;
1180   }
1181 
1182   if (saved_buffer)
1183   {
1184     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
1185     pStubMsg->Buffer = saved_buffer;
1186   }
1187 
1188   STD_OVERFLOW_CHECK(pStubMsg);
1189 
1190   return NULL;
1191 }
1192 
1193 /***********************************************************************
1194  *           EmbeddedPointerUnmarshall
1195  */
1196 static unsigned char * EmbeddedPointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
1197                                                  unsigned char *pDstBuffer,
1198                                                  unsigned char *pSrcMemoryPtrs,
1199                                                  PFORMAT_STRING pFormat,
1200                                                  unsigned char fMustAlloc)
1201 {
1202   unsigned char *Mark = pStubMsg->BufferMark;
1203   unsigned rep, count, stride;
1204   unsigned i;
1205   unsigned char *saved_buffer = NULL;
1206 
1207   TRACE("(%p,%p,%p,%p,%d)\n", pStubMsg, pDstBuffer, pSrcMemoryPtrs, pFormat, fMustAlloc);
1208 
1209   if (*pFormat != RPC_FC_PP) return NULL;
1210   pFormat += 2;
1211 
1212   if (pStubMsg->PointerBufferMark)
1213   {
1214     saved_buffer = pStubMsg->Buffer;
1215     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
1216     pStubMsg->PointerBufferMark = NULL;
1217   }
1218 
1219   while (pFormat[0] != RPC_FC_END) {
1220     TRACE("pFormat[0] = 0x%x\n", pFormat[0]);
1221     switch (pFormat[0]) {
1222     default:
1223       FIXME("unknown repeat type %d\n", pFormat[0]);
1224     case RPC_FC_NO_REPEAT:
1225       rep = 1;
1226       stride = 0;
1227       count = 1;
1228       pFormat += 2;
1229       break;
1230     case RPC_FC_FIXED_REPEAT:
1231       rep = *(const WORD*)&pFormat[2];
1232       stride = *(const WORD*)&pFormat[4];
1233       count = *(const WORD*)&pFormat[8];
1234       pFormat += 10;
1235       break;
1236     case RPC_FC_VARIABLE_REPEAT:
1237       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1238       stride = *(const WORD*)&pFormat[2];
1239       count = *(const WORD*)&pFormat[6];
1240       pFormat += 8;
1241       break;
1242     }
1243     for (i = 0; i < rep; i++) {
1244       PFORMAT_STRING info = pFormat;
1245       unsigned char *bufdstbase = pDstBuffer + (i * stride);
1246       unsigned char *memsrcbase = pSrcMemoryPtrs + (i * stride);
1247       unsigned char *bufbase = Mark + (i * stride);
1248       unsigned u;
1249 
1250       for (u=0; u<count; u++,info+=8) {
1251         unsigned char **bufdstptr = (unsigned char **)(bufdstbase + *(const SHORT*)&info[2]);
1252         unsigned char **memsrcptr = (unsigned char **)(memsrcbase + *(const SHORT*)&info[0]);
1253         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
1254         PointerUnmarshall(pStubMsg, bufptr, bufdstptr, *memsrcptr, info+4, fMustAlloc);
1255       }
1256     }
1257     pFormat += 8 * count;
1258   }
1259 
1260   if (saved_buffer)
1261   {
1262     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
1263     pStubMsg->Buffer = saved_buffer;
1264   }
1265 
1266   return NULL;
1267 }
1268 
1269 /***********************************************************************
1270  *           EmbeddedPointerBufferSize
1271  */
1272 static void EmbeddedPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
1273                                       unsigned char *pMemory,
1274                                       PFORMAT_STRING pFormat)
1275 {
1276   unsigned rep, count, stride;
1277   unsigned i;
1278   ULONG saved_buffer_length = 0;
1279 
1280   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1281 
1282   if (pStubMsg->IgnoreEmbeddedPointers) return;
1283 
1284   if (*pFormat != RPC_FC_PP) return;
1285   pFormat += 2;
1286 
1287   if (pStubMsg->PointerLength)
1288   {
1289     saved_buffer_length = pStubMsg->BufferLength;
1290     pStubMsg->BufferLength = pStubMsg->PointerLength;
1291     pStubMsg->PointerLength = 0;
1292   }
1293 
1294   while (pFormat[0] != RPC_FC_END) {
1295     switch (pFormat[0]) {
1296     default:
1297       FIXME("unknown repeat type %d\n", pFormat[0]);
1298     case RPC_FC_NO_REPEAT:
1299       rep = 1;
1300       stride = 0;
1301       count = 1;
1302       pFormat += 2;
1303       break;
1304     case RPC_FC_FIXED_REPEAT:
1305       rep = *(const WORD*)&pFormat[2];
1306       stride = *(const WORD*)&pFormat[4];
1307       count = *(const WORD*)&pFormat[8];
1308       pFormat += 10;
1309       break;
1310     case RPC_FC_VARIABLE_REPEAT:
1311       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1312       stride = *(const WORD*)&pFormat[2];
1313       count = *(const WORD*)&pFormat[6];
1314       pFormat += 8;
1315       break;
1316     }
1317     for (i = 0; i < rep; i++) {
1318       PFORMAT_STRING info = pFormat;
1319       unsigned char *membase = pMemory + (i * stride);
1320       unsigned u;
1321 
1322       for (u=0; u<count; u++,info+=8) {
1323         unsigned char *memptr = membase + *(const SHORT*)&info[0];
1324         unsigned char *saved_memory = pStubMsg->Memory;
1325 
1326         pStubMsg->Memory = pMemory;
1327         PointerBufferSize(pStubMsg, *(unsigned char**)memptr, info+4);
1328         pStubMsg->Memory = saved_memory;
1329       }
1330     }
1331     pFormat += 8 * count;
1332   }
1333 
1334   if (saved_buffer_length)
1335   {
1336     pStubMsg->PointerLength = pStubMsg->BufferLength;
1337     pStubMsg->BufferLength = saved_buffer_length;
1338   }
1339 }
1340 
1341 /***********************************************************************
1342  *           EmbeddedPointerMemorySize [internal]
1343  */
1344 static ULONG EmbeddedPointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1345                                        PFORMAT_STRING pFormat)
1346 {
1347   unsigned char *Mark = pStubMsg->BufferMark;
1348   unsigned rep, count, stride;
1349   unsigned i;
1350   unsigned char *saved_buffer = NULL;
1351 
1352   TRACE("(%p,%p)\n", pStubMsg, pFormat);
1353 
1354   if (pStubMsg->IgnoreEmbeddedPointers) return 0;
1355 
1356   if (pStubMsg->PointerBufferMark)
1357   {
1358     saved_buffer = pStubMsg->Buffer;
1359     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
1360     pStubMsg->PointerBufferMark = NULL;
1361   }
1362 
1363   if (*pFormat != RPC_FC_PP) return 0;
1364   pFormat += 2;
1365 
1366   while (pFormat[0] != RPC_FC_END) {
1367     switch (pFormat[0]) {
1368     default:
1369       FIXME("unknown repeat type %d\n", pFormat[0]);
1370     case RPC_FC_NO_REPEAT:
1371       rep = 1;
1372       stride = 0;
1373       count = 1;
1374       pFormat += 2;
1375       break;
1376     case RPC_FC_FIXED_REPEAT:
1377       rep = *(const WORD*)&pFormat[2];
1378       stride = *(const WORD*)&pFormat[4];
1379       count = *(const WORD*)&pFormat[8];
1380       pFormat += 10;
1381       break;
1382     case RPC_FC_VARIABLE_REPEAT:
1383       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1384       stride = *(const WORD*)&pFormat[2];
1385       count = *(const WORD*)&pFormat[6];
1386       pFormat += 8;
1387       break;
1388     }
1389     for (i = 0; i < rep; i++) {
1390       PFORMAT_STRING info = pFormat;
1391       unsigned char *bufbase = Mark + (i * stride);
1392       unsigned u;
1393       for (u=0; u<count; u++,info+=8) {
1394         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
1395         PointerMemorySize(pStubMsg, bufptr, info+4);
1396       }
1397     }
1398     pFormat += 8 * count;
1399   }
1400 
1401   if (saved_buffer)
1402   {
1403     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
1404     pStubMsg->Buffer = saved_buffer;
1405   }
1406 
1407   return 0;
1408 }
1409 
1410 /***********************************************************************
1411  *           EmbeddedPointerFree [internal]
1412  */
1413 static void EmbeddedPointerFree(PMIDL_STUB_MESSAGE pStubMsg,
1414                                 unsigned char *pMemory,
1415                                 PFORMAT_STRING pFormat)
1416 {
1417   unsigned rep, count, stride;
1418   unsigned i;
1419 
1420   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1421   if (*pFormat != RPC_FC_PP) return;
1422   pFormat += 2;
1423 
1424   while (pFormat[0] != RPC_FC_END) {
1425     switch (pFormat[0]) {
1426     default:
1427       FIXME("unknown repeat type %d\n", pFormat[0]);
1428     case RPC_FC_NO_REPEAT:
1429       rep = 1;
1430       stride = 0;
1431       count = 1;
1432       pFormat += 2;
1433       break;
1434     case RPC_FC_FIXED_REPEAT:
1435       rep = *(const WORD*)&pFormat[2];
1436       stride = *(const WORD*)&pFormat[4];
1437       count = *(const WORD*)&pFormat[8];
1438       pFormat += 10;
1439       break;
1440     case RPC_FC_VARIABLE_REPEAT:
1441       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1442       stride = *(const WORD*)&pFormat[2];
1443       count = *(const WORD*)&pFormat[6];
1444       pFormat += 8;
1445       break;
1446     }
1447     for (i = 0; i < rep; i++) {
1448       PFORMAT_STRING info = pFormat;
1449       unsigned char *membase = pMemory + (i * stride);
1450       unsigned u;
1451 
1452       for (u=0; u<count; u++,info+=8) {
1453         unsigned char *memptr = membase + *(const SHORT*)&info[0];
1454         unsigned char *saved_memory = pStubMsg->Memory;
1455 
1456         pStubMsg->Memory = pMemory;
1457         PointerFree(pStubMsg, *(unsigned char**)memptr, info+4);
1458         pStubMsg->Memory = saved_memory;
1459       }
1460     }
1461     pFormat += 8 * count;
1462   }
1463 }
1464 
1465 /***********************************************************************
1466  *           NdrPointerMarshall [RPCRT4.@]
1467  */
1468 unsigned char * WINAPI NdrPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
1469                                           unsigned char *pMemory,
1470                                           PFORMAT_STRING pFormat)
1471 {
1472   unsigned char *Buffer;
1473 
1474   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1475 
1476   /* Increment the buffer here instead of in PointerMarshall,
1477    * as that is used by embedded pointers which already handle the incrementing
1478    * the buffer, and shouldn't write any additional pointer data to the wire */
1479   if (*pFormat != RPC_FC_RP)
1480   {
1481     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
1482     Buffer = pStubMsg->Buffer;
1483     safe_buffer_increment(pStubMsg, 4);
1484   }
1485   else
1486     Buffer = pStubMsg->Buffer;
1487 
1488   PointerMarshall(pStubMsg, Buffer, pMemory, pFormat);
1489 
1490   return NULL;
1491 }
1492 
1493 /***********************************************************************
1494  *           NdrPointerUnmarshall [RPCRT4.@]
1495  */
1496 unsigned char * WINAPI NdrPointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
1497                                             unsigned char **ppMemory,
1498                                             PFORMAT_STRING pFormat,
1499                                             unsigned char fMustAlloc)
1500 {
1501   unsigned char *Buffer;
1502 
1503   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
1504 
1505   if (*pFormat == RPC_FC_RP)
1506   {
1507     Buffer = pStubMsg->Buffer;
1508     /* Do the NULL ref pointer check here because embedded pointers can be
1509      * NULL if the type the pointer is embedded in was allocated rather than
1510      * being passed in by the client */
1511     if (pStubMsg->IsClient && !*ppMemory)
1512     {
1513       ERR("NULL ref pointer is not allowed\n");
1514       RpcRaiseException(RPC_X_NULL_REF_POINTER);
1515     }
1516   }
1517   else
1518   {
1519     /* Increment the buffer here instead of in PointerUnmarshall,
1520      * as that is used by embedded pointers which already handle the incrementing
1521      * the buffer, and shouldn't read any additional pointer data from the
1522      * buffer */
1523     ALIGN_POINTER(pStubMsg->Buffer, 4);
1524     Buffer = pStubMsg->Buffer;
1525     safe_buffer_increment(pStubMsg, 4);
1526   }
1527 
1528   PointerUnmarshall(pStubMsg, Buffer, ppMemory, *ppMemory, pFormat, fMustAlloc);
1529 
1530   return NULL;
1531 }
1532 
1533 /***********************************************************************
1534  *           NdrPointerBufferSize [RPCRT4.@]
1535  */
1536 void WINAPI NdrPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
1537                                       unsigned char *pMemory,
1538                                       PFORMAT_STRING pFormat)
1539 {
1540   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1541 
1542   /* Increment the buffer length here instead of in PointerBufferSize,
1543    * as that is used by embedded pointers which already handle the buffer
1544    * length, and shouldn't write anything more to the wire */
1545   if (*pFormat != RPC_FC_RP)
1546   {
1547     ALIGN_LENGTH(pStubMsg->BufferLength, 4);
1548     safe_buffer_length_increment(pStubMsg, 4);
1549   }
1550 
1551   PointerBufferSize(pStubMsg, pMemory, pFormat);
1552 }
1553 
1554 /***********************************************************************
1555  *           NdrPointerMemorySize [RPCRT4.@]
1556  */
1557 ULONG WINAPI NdrPointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1558                                   PFORMAT_STRING pFormat)
1559 {
1560     unsigned char *Buffer = pStubMsg->Buffer;
1561     if (*pFormat != RPC_FC_RP)
1562     {
1563         ALIGN_POINTER(pStubMsg->Buffer, 4);
1564         safe_buffer_increment(pStubMsg, 4);
1565     }
1566     ALIGN_LENGTH(pStubMsg->MemorySize, sizeof(void *));
1567     return PointerMemorySize(pStubMsg, Buffer, pFormat);
1568 }
1569 
1570 /***********************************************************************
1571  *           NdrPointerFree [RPCRT4.@]
1572  */
1573 void WINAPI NdrPointerFree(PMIDL_STUB_MESSAGE pStubMsg,
1574                            unsigned char *pMemory,
1575                            PFORMAT_STRING pFormat)
1576 {
1577   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1578   PointerFree(pStubMsg, pMemory, pFormat);
1579 }
1580 
1581 /***********************************************************************
1582  *           NdrSimpleTypeMarshall [RPCRT4.@]
1583  */
1584 void WINAPI NdrSimpleTypeMarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory,
1585                                    unsigned char FormatChar )
1586 {
1587     NdrBaseTypeMarshall(pStubMsg, pMemory, &FormatChar);
1588 }
1589 
1590 /***********************************************************************
1591  *           NdrSimpleTypeUnmarshall [RPCRT4.@]
1592  *
1593  * Unmarshall a base type.
1594  *
1595  * NOTES
1596  *  Doesn't check that the buffer is long enough before copying, so the caller
1597  * should do this.
1598  */
1599 void WINAPI NdrSimpleTypeUnmarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory,
1600                                      unsigned char FormatChar )
1601 {
1602 #define BASE_TYPE_UNMARSHALL(type) \
1603         ALIGN_POINTER(pStubMsg->Buffer, sizeof(type)); \
1604         TRACE("pMemory: %p\n", pMemory); \
1605         *(type *)pMemory = *(type *)pStubMsg->Buffer; \
1606         pStubMsg->Buffer += sizeof(type);
1607 
1608     switch(FormatChar)
1609     {
1610     case RPC_FC_BYTE:
1611     case RPC_FC_CHAR:
1612     case RPC_FC_SMALL:
1613     case RPC_FC_USMALL:
1614         BASE_TYPE_UNMARSHALL(UCHAR);
1615         TRACE("value: 0x%02x\n", *pMemory);
1616         break;
1617     case RPC_FC_WCHAR:
1618     case RPC_FC_SHORT:
1619     case RPC_FC_USHORT:
1620         BASE_TYPE_UNMARSHALL(USHORT);
1621         TRACE("value: 0x%04x\n", *(USHORT *)pMemory);
1622         break;
1623     case RPC_FC_LONG:
1624     case RPC_FC_ULONG:
1625     case RPC_FC_ERROR_STATUS_T:
1626     case RPC_FC_ENUM32:
1627         BASE_TYPE_UNMARSHALL(ULONG);
1628         TRACE("value: 0x%08x\n", *(ULONG *)pMemory);
1629         break;
1630    case RPC_FC_FLOAT:
1631         BASE_TYPE_UNMARSHALL(float);
1632         TRACE("value: %f\n", *(float *)pMemory);
1633         break;
1634     case RPC_FC_DOUBLE:
1635         BASE_TYPE_UNMARSHALL(double);
1636         TRACE("value: %f\n", *(double *)pMemory);
1637         break;
1638     case RPC_FC_HYPER:
1639         BASE_TYPE_UNMARSHALL(ULONGLONG);
1640         TRACE("value: %s\n", wine_dbgstr_longlong(*(ULONGLONG *)pMemory));
1641         break;
1642     case RPC_FC_ENUM16:
1643         ALIGN_POINTER(pStubMsg->Buffer, sizeof(USHORT));
1644         TRACE("pMemory: %p\n", pMemory);
1645         /* 16-bits on the wire, but int in memory */
1646         *(UINT *)pMemory = *(USHORT *)pStubMsg->Buffer;
1647         pStubMsg->Buffer += sizeof(USHORT);
1648         TRACE("value: 0x%08x\n", *(UINT *)pMemory);
1649         break;
1650     case RPC_FC_IGNORE:
1651         break;
1652     default:
1653         FIXME("Unhandled base type: 0x%02x\n", FormatChar);
1654     }
1655 #undef BASE_TYPE_UNMARSHALL
1656 }
1657 
1658 /***********************************************************************
1659  *           NdrSimpleStructMarshall [RPCRT4.@]
1660  */
1661 unsigned char * WINAPI NdrSimpleStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
1662                                                unsigned char *pMemory,
1663                                                PFORMAT_STRING pFormat)
1664 {
1665   unsigned size = *(const WORD*)(pFormat+2);
1666   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1667 
1668   ALIGN_POINTER_CLEAR(pStubMsg->Buffer, pFormat[1] + 1);
1669 
1670   pStubMsg->BufferMark = pStubMsg->Buffer;
1671   safe_copy_to_buffer(pStubMsg, pMemory, size);
1672 
1673   if (pFormat[0] != RPC_FC_STRUCT)
1674     EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat+4);
1675 
1676   return NULL;
1677 }
1678 
1679 /***********************************************************************
1680  *           NdrSimpleStructUnmarshall [RPCRT4.@]
1681  */
1682 unsigned char * WINAPI NdrSimpleStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
1683                                                  unsigned char **ppMemory,
1684                                                  PFORMAT_STRING pFormat,
1685                                                  unsigned char fMustAlloc)
1686 {
1687   unsigned size = *(const WORD*)(pFormat+2);
1688   unsigned char *saved_buffer;
1689   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
1690 
1691   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
1692 
1693   if (fMustAlloc)
1694     *ppMemory = NdrAllocate(pStubMsg, size);
1695   else
1696   {
1697     if (!pStubMsg->IsClient && !*ppMemory)
1698       /* for servers, we just point straight into the RPC buffer */
1699       *ppMemory = pStubMsg->Buffer;
1700   }
1701 
1702   saved_buffer = pStubMsg->BufferMark = pStubMsg->Buffer;
1703   safe_buffer_increment(pStubMsg, size);
1704   if (pFormat[0] == RPC_FC_PSTRUCT)
1705       EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat+4, fMustAlloc);
1706 
1707   TRACE("copying %p to %p\n", saved_buffer, *ppMemory);
1708   if (*ppMemory != saved_buffer)
1709       memcpy(*ppMemory, saved_buffer, size);
1710 
1711   return NULL;
1712 }
1713 
1714 /***********************************************************************
1715  *           NdrSimpleStructBufferSize [RPCRT4.@]
1716  */
1717 void WINAPI NdrSimpleStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
1718                                       unsigned char *pMemory,
1719                                       PFORMAT_STRING pFormat)
1720 {
1721   unsigned size = *(const WORD*)(pFormat+2);
1722   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1723 
1724   ALIGN_LENGTH(pStubMsg->BufferLength, pFormat[1] + 1);
1725 
1726   safe_buffer_length_increment(pStubMsg, size);
1727   if (pFormat[0] != RPC_FC_STRUCT)
1728     EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat+4);
1729 }
1730 
1731 /***********************************************************************
1732  *           NdrSimpleStructMemorySize [RPCRT4.@]
1733  */
1734 ULONG WINAPI NdrSimpleStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1735                                        PFORMAT_STRING pFormat)
1736 {
1737   unsigned short size = *(const WORD *)(pFormat+2);
1738 
1739   TRACE("(%p,%p)\n", pStubMsg, pFormat);
1740 
1741   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
1742   pStubMsg->MemorySize += size;
1743   safe_buffer_increment(pStubMsg, size);
1744 
1745   if (pFormat[0] != RPC_FC_STRUCT)
1746     EmbeddedPointerMemorySize(pStubMsg, pFormat+4);
1747   return pStubMsg->MemorySize;
1748 }
1749 
1750 /***********************************************************************
1751  *           NdrSimpleStructFree [RPCRT4.@]
1752  */
1753 void WINAPI NdrSimpleStructFree(PMIDL_STUB_MESSAGE pStubMsg,
1754                                 unsigned char *pMemory,
1755                                 PFORMAT_STRING pFormat)
1756 {
1757   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1758   if (pFormat[0] != RPC_FC_STRUCT)
1759     EmbeddedPointerFree(pStubMsg, pMemory, pFormat+4);
1760 }
1761 
1762 /* Array helpers */
1763 
1764 static inline void array_compute_and_size_conformance(
1765     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1766     PFORMAT_STRING pFormat)
1767 {
1768   switch (fc)
1769   {
1770   case RPC_FC_CARRAY:
1771     ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
1772     SizeConformance(pStubMsg);
1773     break;
1774   case RPC_FC_CVARRAY:
1775     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, 0);
1776     pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
1777     SizeConformance(pStubMsg);
1778     break;
1779   case RPC_FC_C_CSTRING:
1780   case RPC_FC_C_WSTRING:
1781     if (pFormat[0] == RPC_FC_C_CSTRING)
1782     {
1783       TRACE("string=%s\n", debugstr_a((const char *)pMemory));
1784       pStubMsg->ActualCount = strlen((const char *)pMemory)+1;
1785     }
1786     else
1787     {
1788       TRACE("string=%s\n", debugstr_w((LPCWSTR)pMemory));
1789       pStubMsg->ActualCount = strlenW((LPCWSTR)pMemory)+1;
1790     }
1791 
1792     if (fc == RPC_FC_STRING_SIZED)
1793       pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0);
1794     else
1795       pStubMsg->MaxCount = pStubMsg->ActualCount;
1796 
1797     SizeConformance(pStubMsg);
1798     break;
1799   default:
1800     ERR("unknown array format 0x%x\n", fc);
1801     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1802   }
1803 }
1804 
1805 static inline void array_buffer_size(
1806     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1807     PFORMAT_STRING pFormat, unsigned char fHasPointers)
1808 {
1809   DWORD size;
1810   DWORD esize;
1811   unsigned char alignment;
1812 
1813   switch (fc)
1814   {
1815   case RPC_FC_CARRAY:
1816     esize = *(const WORD*)(pFormat+2);
1817     alignment = pFormat[1] + 1;
1818 
1819     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1820 
1821     ALIGN_LENGTH(pStubMsg->BufferLength, alignment);
1822 
1823     size = safe_multiply(esize, pStubMsg->MaxCount);
1824     /* conformance value plus array */
1825     safe_buffer_length_increment(pStubMsg, size);
1826 
1827     if (fHasPointers)
1828       EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat);
1829     break;
1830   case RPC_FC_CVARRAY:
1831     esize = *(const WORD*)(pFormat+2);
1832     alignment = pFormat[1] + 1;
1833 
1834     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1835     pFormat = SkipConformance(pStubMsg, pFormat);
1836 
1837     SizeVariance(pStubMsg);
1838 
1839     ALIGN_LENGTH(pStubMsg->BufferLength, alignment);
1840 
1841     size = safe_multiply(esize, pStubMsg->ActualCount);
1842     safe_buffer_length_increment(pStubMsg, size);
1843 
1844     if (fHasPointers)
1845       EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat);
1846     break;
1847   case RPC_FC_C_CSTRING:
1848   case RPC_FC_C_WSTRING:
1849     if (fc == RPC_FC_C_CSTRING)
1850       esize = 1;
1851     else
1852       esize = 2;
1853 
1854     SizeVariance(pStubMsg);
1855 
1856     size = safe_multiply(esize, pStubMsg->ActualCount);
1857     safe_buffer_length_increment(pStubMsg, size);
1858     break;
1859   default:
1860     ERR("unknown array format 0x%x\n", fc);
1861     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1862   }
1863 }
1864 
1865 static inline void array_compute_and_write_conformance(
1866     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1867     PFORMAT_STRING pFormat)
1868 {
1869   switch (fc)
1870   {
1871   case RPC_FC_CARRAY:
1872     ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
1873     WriteConformance(pStubMsg);
1874     break;
1875   case RPC_FC_CVARRAY:
1876     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, 0);
1877     pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
1878     WriteConformance(pStubMsg);
1879     break;
1880   case RPC_FC_C_CSTRING:
1881   case RPC_FC_C_WSTRING:
1882     if (fc == RPC_FC_C_CSTRING)
1883     {
1884       TRACE("string=%s\n", debugstr_a((const char *)pMemory));
1885       pStubMsg->ActualCount = strlen((const char *)pMemory)+1;
1886     }
1887     else
1888     {
1889       TRACE("string=%s\n", debugstr_w((LPCWSTR)pMemory));
1890       pStubMsg->ActualCount = strlenW((LPCWSTR)pMemory)+1;
1891     }
1892     if (pFormat[1] == RPC_FC_STRING_SIZED)
1893       pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0);
1894     else
1895       pStubMsg->MaxCount = pStubMsg->ActualCount;
1896     pStubMsg->Offset = 0;
1897     WriteConformance(pStubMsg);
1898     break;
1899   default:
1900     ERR("unknown array format 0x%x\n", fc);
1901     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1902   }
1903 }
1904 
1905 static inline void array_write_variance_and_marshall(
1906     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1907     PFORMAT_STRING pFormat, unsigned char fHasPointers)
1908 {
1909   DWORD size;
1910   DWORD esize;
1911   unsigned char alignment;
1912 
1913   switch (fc)
1914   {
1915   case RPC_FC_CARRAY:
1916     esize = *(const WORD*)(pFormat+2);
1917     alignment = pFormat[1] + 1;
1918 
1919     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1920 
1921     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, alignment);
1922 
1923     size = safe_multiply(esize, pStubMsg->MaxCount);
1924     if (fHasPointers)
1925       pStubMsg->BufferMark = pStubMsg->Buffer;
1926     safe_copy_to_buffer(pStubMsg, pMemory, size);
1927 
1928     if (fHasPointers)
1929       EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat);
1930     break;
1931   case RPC_FC_CVARRAY:
1932     esize = *(const WORD*)(pFormat+2);
1933     alignment = pFormat[1] + 1;
1934 
1935     /* conformance */
1936     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1937     /* variance */
1938     pFormat = SkipConformance(pStubMsg, pFormat);
1939 
1940     WriteVariance(pStubMsg);
1941 
1942     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, alignment);
1943 
1944     size = safe_multiply(esize, pStubMsg->ActualCount);
1945 
1946     if (fHasPointers)
1947       pStubMsg->BufferMark = pStubMsg->Buffer;
1948     safe_copy_to_buffer(pStubMsg, pMemory + pStubMsg->Offset, size);
1949 
1950     if (fHasPointers)
1951       EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat);
1952     break;
1953   case RPC_FC_C_CSTRING:
1954   case RPC_FC_C_WSTRING:
1955     if (fc == RPC_FC_C_CSTRING)
1956       esize = 1;
1957     else
1958       esize = 2;
1959 
1960     WriteVariance(pStubMsg);
1961 
1962     size = safe_multiply(esize, pStubMsg->ActualCount);
1963     safe_copy_to_buffer(pStubMsg, pMemory, size); /* the string itself */
1964     break;
1965   default:
1966     ERR("unknown array format 0x%x\n", fc);
1967     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1968   }
1969 }
1970 
1971 static inline ULONG array_read_conformance(
1972     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
1973 {
1974   DWORD esize;
1975 
1976   switch (fc)
1977   {
1978   case RPC_FC_CARRAY:
1979     esize = *(const WORD*)(pFormat+2);
1980     pFormat = ReadConformance(pStubMsg, pFormat+4);
1981     return safe_multiply(esize, pStubMsg->MaxCount);
1982   case RPC_FC_CVARRAY:
1983     esize = *(const WORD*)(pFormat+2);
1984     pFormat = ReadConformance(pStubMsg, pFormat+4);
1985     return safe_multiply(esize, pStubMsg->MaxCount);
1986   case RPC_FC_C_CSTRING:
1987   case RPC_FC_C_WSTRING:
1988     if (fc == RPC_FC_C_CSTRING)
1989       esize = 1;
1990     else
1991       esize = 2;
1992 
1993     if (pFormat[1] == RPC_FC_STRING_SIZED)
1994       ReadConformance(pStubMsg, pFormat + 2);
1995     else
1996       ReadConformance(pStubMsg, NULL);
1997     return safe_multiply(esize, pStubMsg->MaxCount);
1998   default:
1999     ERR("unknown array format 0x%x\n", fc);
2000     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2001   }
2002 }
2003 
2004 static inline ULONG array_read_variance_and_unmarshall(
2005     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char **ppMemory,
2006     PFORMAT_STRING pFormat, unsigned char fMustAlloc,
2007     unsigned char fUseBufferMemoryServer, unsigned char fUnmarshall)
2008 {
2009   ULONG bufsize, memsize;
2010   WORD esize;
2011   unsigned char alignment;
2012   unsigned char *saved_buffer;
2013   ULONG offset;
2014 
2015   switch (fc)
2016   {
2017   case RPC_FC_CARRAY:
2018     esize = *(const WORD*)(pFormat+2);
2019     alignment = pFormat[1] + 1;
2020 
2021     bufsize = memsize = safe_multiply(esize, pStubMsg->MaxCount);
2022 
2023     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2024 
2025     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2026 
2027     if (fUnmarshall)
2028     {
2029       if (fMustAlloc)
2030         *ppMemory = NdrAllocate(pStubMsg, memsize);
2031       else
2032       {
2033         if (fUseBufferMemoryServer && !pStubMsg->IsClient && !*ppMemory)
2034           /* for servers, we just point straight into the RPC buffer */
2035           *ppMemory = pStubMsg->Buffer;
2036       }
2037 
2038       saved_buffer = pStubMsg->Buffer;
2039       safe_buffer_increment(pStubMsg, bufsize);
2040 
2041       pStubMsg->BufferMark = saved_buffer;
2042       EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat, fMustAlloc);
2043 
2044       TRACE("copying %p to %p\n", saved_buffer, *ppMemory);
2045       if (*ppMemory != saved_buffer)
2046         memcpy(*ppMemory, saved_buffer, bufsize);
2047     }
2048     return bufsize;
2049   case RPC_FC_CVARRAY:
2050     esize = *(const WORD*)(pFormat+2);
2051     alignment = pFormat[1] + 1;
2052 
2053     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2054 
2055     pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
2056 
2057     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2058 
2059     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2060     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2061 
2062     if (fUnmarshall)
2063     {
2064       offset = pStubMsg->Offset;
2065 
2066       if (!fMustAlloc && !*ppMemory)
2067         fMustAlloc = TRUE;
2068       if (fMustAlloc)
2069         *ppMemory = NdrAllocate(pStubMsg, memsize);
2070       saved_buffer = pStubMsg->Buffer;
2071       safe_buffer_increment(pStubMsg, bufsize);
2072 
2073       pStubMsg->BufferMark = saved_buffer;
2074       EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat,
2075                                 fMustAlloc);
2076 
2077       memcpy(*ppMemory + offset, saved_buffer, bufsize);
2078     }
2079     return bufsize;
2080   case RPC_FC_C_CSTRING:
2081   case RPC_FC_C_WSTRING:
2082     if (fc == RPC_FC_C_CSTRING)
2083       esize = 1;
2084     else
2085       esize = 2;
2086 
2087     ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount);
2088 
2089     if (pFormat[1] != RPC_FC_STRING_SIZED && (pStubMsg->MaxCount != pStubMsg->ActualCount))
2090     {
2091       ERR("buffer size %d must equal memory size %ld for non-sized conformant strings\n",
2092           pStubMsg->ActualCount, pStubMsg->MaxCount);
2093       RpcRaiseException(RPC_S_INVALID_BOUND);
2094     }
2095     if (pStubMsg->Offset)
2096     {
2097       ERR("conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2098       RpcRaiseException(RPC_S_INVALID_BOUND);
2099     }
2100 
2101     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2102     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2103 
2104     validate_string_data(pStubMsg, bufsize, esize);
2105 
2106     if (fUnmarshall)
2107     {
2108       if (fMustAlloc)
2109         *ppMemory = NdrAllocate(pStubMsg, memsize);
2110       else
2111       {
2112         if (fUseBufferMemoryServer && !pStubMsg->IsClient &&
2113             !*ppMemory && (pStubMsg->MaxCount == pStubMsg->ActualCount))
2114           /* if the data in the RPC buffer is big enough, we just point
2115            * straight into it */
2116           *ppMemory = pStubMsg->Buffer;
2117         else if (!*ppMemory)
2118           *ppMemory = NdrAllocate(pStubMsg, memsize);
2119       }
2120 
2121       if (*ppMemory == pStubMsg->Buffer)
2122         safe_buffer_increment(pStubMsg, bufsize);
2123       else
2124         safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);
2125 
2126       if (*pFormat == RPC_FC_C_CSTRING)
2127         TRACE("string=%s\n", debugstr_a((char*)*ppMemory));
2128       else
2129         TRACE("string=%s\n", debugstr_w((LPWSTR)*ppMemory));
2130     }
2131     return bufsize;
2132   default:
2133     ERR("unknown array format 0x%x\n", fc);
2134     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2135   }
2136 }
2137 
2138 static inline void array_memory_size(
2139     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat,
2140     unsigned char fHasPointers)
2141 {
2142   ULONG bufsize, memsize;
2143   DWORD esize;
2144   unsigned char alignment;
2145 
2146   switch (fc)
2147   {
2148   case RPC_FC_CARRAY:
2149     esize = *(const WORD*)(pFormat+2);
2150     alignment = pFormat[1] + 1;
2151 
2152     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2153 
2154     bufsize = memsize = safe_multiply(esize, pStubMsg->MaxCount);
2155     pStubMsg->MemorySize += memsize;
2156 
2157     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2158     if (fHasPointers)
2159       pStubMsg->BufferMark = pStubMsg->Buffer;
2160     safe_buffer_increment(pStubMsg, bufsize);
2161 
2162     if (fHasPointers)
2163       EmbeddedPointerMemorySize(pStubMsg, pFormat);
2164     break;
2165   case RPC_FC_CVARRAY:
2166     esize = *(const WORD*)(pFormat+2);
2167     alignment = pFormat[1] + 1;
2168 
2169     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2170 
2171     pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
2172 
2173     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2174     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2175     pStubMsg->MemorySize += memsize;
2176 
2177     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2178     if (fHasPointers)
2179       pStubMsg->BufferMark = pStubMsg->Buffer;
2180     safe_buffer_increment(pStubMsg, bufsize);
2181 
2182     if (fHasPointers)
2183       EmbeddedPointerMemorySize(pStubMsg, pFormat);
2184     break;
2185   case RPC_FC_C_CSTRING:
2186   case RPC_FC_C_WSTRING:
2187     if (fc == RPC_FC_C_CSTRING)
2188       esize = 1;
2189     else
2190       esize = 2;
2191 
2192     ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount);
2193 
2194     if (pFormat[1] != RPC_FC_STRING_SIZED && (pStubMsg->MaxCount != pStubMsg->ActualCount))
2195     {
2196       ERR("buffer size %d must equal memory size %ld for non-sized conformant strings\n",
2197           pStubMsg->ActualCount, pStubMsg->MaxCount);
2198       RpcRaiseException(RPC_S_INVALID_BOUND);
2199     }
2200     if (pStubMsg->Offset)
2201     {
2202       ERR("conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2203       RpcRaiseException(RPC_S_INVALID_BOUND);
2204     }
2205 
2206     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2207     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2208 
2209     validate_string_data(pStubMsg, bufsize, esize);
2210 
2211     safe_buffer_increment(pStubMsg, bufsize);
2212     pStubMsg->MemorySize += memsize;
2213     break;
2214   default:
2215     ERR("unknown array format 0x%x\n", fc);
2216     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2217   }
2218 }
2219 
2220 static inline void array_free(
2221     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg,
2222     unsigned char *pMemory, PFORMAT_STRING pFormat, unsigned char fHasPointers)
2223 {
2224   switch (fc)
2225   {
2226   case RPC_FC_CARRAY:
2227     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
2228     if (fHasPointers)
2229       EmbeddedPointerFree(pStubMsg, pMemory, pFormat);
2230     break;
2231   case RPC_FC_CVARRAY:
2232     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
2233     pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
2234     if (fHasPointers)
2235       EmbeddedPointerFree(pStubMsg, pMemory, pFormat);
2236     break;
2237   case RPC_FC_C_CSTRING:
2238   case RPC_FC_C_WSTRING:
2239     /* No embedded pointers so nothing to do */
2240     break;
2241   default:
2242     ERR("unknown array format 0x%x\n", fc);
2243     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2244   }
2245 }
2246 
2247 /*
2248  * NdrConformantString:
2249  *
2250  * What MS calls a ConformantString is, in DCE terminology,
2251  * a Varying-Conformant String.
2252  * [
2253  *   maxlen: DWORD (max # of CHARTYPE characters, inclusive of '\0')
2254  *   offset: DWORD (actual string data begins at (offset) CHARTYPE's
2255  *           into unmarshalled string)
2256  *   length: DWORD (# of CHARTYPE characters, inclusive of '\0')
2257  *   [
2258  *     data: CHARTYPE[maxlen]
2259  *   ]
2260  * ], where CHARTYPE is the appropriate character type (specified externally)
2261  *
2262  */
2263 
2264 /***********************************************************************
2265  *            NdrConformantStringMarshall [RPCRT4.@]
2266  */
2267 unsigned char *WINAPI NdrConformantStringMarshall(MIDL_STUB_MESSAGE *pStubMsg,
2268   unsigned char *pszMessage, PFORMAT_STRING pFormat)
2269 {
2270   TRACE("(pStubMsg == ^%p, pszMessage == ^%p, pFormat == ^%p)\n", pStubMsg, pszMessage, pFormat);
2271 
2272   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2273     ERR("Unhandled string type: %#x\n", pFormat[0]);
2274     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2275   }
2276 
2277   /* allow compiler to optimise inline function by passing constant into
2278    * these functions */
2279   if (pFormat[0] == RPC_FC_C_CSTRING) {
2280     array_compute_and_write_conformance(RPC_FC_C_CSTRING, pStubMsg, pszMessage,
2281                                         pFormat);
2282     array_write_variance_and_marshall(RPC_FC_C_CSTRING, pStubMsg, pszMessage,
2283                                       pFormat, TRUE /* fHasPointers */);
2284   } else {
2285     array_compute_and_write_conformance(RPC_FC_C_WSTRING, pStubMsg, pszMessage,
2286                                         pFormat);
2287     array_write_variance_and_marshall(RPC_FC_C_WSTRING, pStubMsg, pszMessage,
2288                                       pFormat, TRUE /* fHasPointers */);
2289   }
2290 
2291   return NULL;
2292 }
2293 
2294 /***********************************************************************
2295  *           NdrConformantStringBufferSize [RPCRT4.@]
2296  */
2297 void WINAPI NdrConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
2298   unsigned char* pMemory, PFORMAT_STRING pFormat)
2299 {
2300   TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
2301 
2302   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2303     ERR("Unhandled string type: %#x\n", pFormat[0]);
2304     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2305   }
2306 
2307   /* allow compiler to optimise inline function by passing constant into
2308    * these functions */
2309   if (pFormat[0] == RPC_FC_C_CSTRING) {
2310     array_compute_and_size_conformance(RPC_FC_C_CSTRING, pStubMsg, pMemory,
2311                                        pFormat);
2312     array_buffer_size(RPC_FC_C_CSTRING, pStubMsg, pMemory, pFormat,
2313                       TRUE /* fHasPointers */);
2314   } else {
2315     array_compute_and_size_conformance(RPC_FC_C_WSTRING, pStubMsg, pMemory,
2316                                        pFormat);
2317     array_buffer_size(RPC_FC_C_WSTRING, pStubMsg, pMemory, pFormat,
2318                       TRUE /* fHasPointers */);
2319   }
2320 }
2321 
2322 /************************************************************************
2323  *            NdrConformantStringMemorySize [RPCRT4.@]
2324  */
2325 ULONG WINAPI NdrConformantStringMemorySize( PMIDL_STUB_MESSAGE pStubMsg,
2326   PFORMAT_STRING pFormat )
2327 {
2328   TRACE("(pStubMsg == ^%p, pFormat == ^%p)\n", pStubMsg, pFormat);
2329 
2330   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2331     ERR("Unhandled string type: %#x\n", pFormat[0]);
2332     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2333   }
2334 
2335   /* allow compiler to optimise inline function by passing constant into
2336    * these functions */
2337   if (pFormat[0] == RPC_FC_C_CSTRING) {
2338     array_read_conformance(RPC_FC_C_CSTRING, pStubMsg, pFormat);
2339     array_memory_size(RPC_FC_C_CSTRING, pStubMsg, pFormat,
2340                       TRUE /* fHasPointers */);
2341   } else {
2342     array_read_conformance(RPC_FC_C_WSTRING, pStubMsg, pFormat);
2343     array_memory_size(RPC_FC_C_WSTRING, pStubMsg, pFormat,
2344                       TRUE /* fHasPointers */);
2345   }
2346 
2347   return pStubMsg->MemorySize;
2348 }
2349 
2350 /************************************************************************
2351  *           NdrConformantStringUnmarshall [RPCRT4.@]
2352  */
2353 unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg,
2354   unsigned char** ppMemory, PFORMAT_STRING pFormat, unsigned char fMustAlloc )
2355 {
2356   TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n",
2357     pStubMsg, *ppMemory, pFormat, fMustAlloc);
2358 
2359   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2360     ERR("Unhandled string type: %#x\n", *pFormat);
2361     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2362   }
2363 
2364   /* allow compiler to optimise inline function by passing constant into
2365    * these functions */
2366   if (pFormat[0] == RPC_FC_C_CSTRING) {
2367     array_read_conformance(RPC_FC_C_CSTRING, pStubMsg, pFormat);
2368     array_read_variance_and_unmarshall(RPC_FC_C_CSTRING, pStubMsg, ppMemory,
2369                                        pFormat, fMustAlloc,
2370                                        TRUE /* fUseBufferMemoryServer */,
2371                                        TRUE /* fUnmarshall */);
2372   } else {
2373     array_read_conformance(RPC_FC_C_WSTRING, pStubMsg, pFormat);
2374     array_read_variance_and_unmarshall(RPC_FC_C_WSTRING, pStubMsg, ppMemory,
2375                                        pFormat, fMustAlloc,
2376                                        TRUE /* fUseBufferMemoryServer */,
2377                                        TRUE /* fUnmarshall */);
2378   }
2379 
2380   return NULL;
2381 }
2382 
2383 /***********************************************************************
2384  *           NdrNonConformantStringMarshall [RPCRT4.@]
2385  */
2386 unsigned char *  WINAPI NdrNonConformantStringMarshall(PMIDL_STUB_MESSAGE pStubMsg,
2387                                 unsigned char *pMemory,
2388                                 PFORMAT_STRING pFormat)
2389 {
2390   ULONG esize, size, maxsize;
2391 
2392   TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
2393 
2394   maxsize = *(USHORT *)&pFormat[2];
2395 
2396   if (*pFormat == RPC_FC_CSTRING)
2397   {
2398     ULONG i;
2399     const char *str = (const char *)pMemory;
2400     for (i = 0; i < maxsize && *str; i++, str++)
2401         ;
2402     TRACE("string=%s\n", debugstr_an(str, i));
2403     pStubMsg->ActualCount = i + 1;
2404     esize = 1;
2405   }
2406   else if (*pFormat == RPC_FC_WSTRING)
2407   {
2408     ULONG i;
2409     const WCHAR *str = (const WCHAR *)pMemory;
2410     for (i = 0; i < maxsize && *str; i++, str++)
2411         ;
2412     TRACE("string=%s\n", debugstr_wn(str, i));
2413     pStubMsg->ActualCount = i + 1;
2414     esize = 2;
2415   }
2416   else
2417   {
2418     ERR("Unhandled string type: %#x\n", *pFormat);
2419     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2420   }
2421 
2422   pStubMsg->Offset = 0;
2423   WriteVariance(pStubMsg);
2424 
2425   size = safe_multiply(esize, pStubMsg->ActualCount);
2426   safe_copy_to_buffer(pStubMsg, pMemory, size); /* the string itself */
2427 
2428   return NULL;
2429 }
2430 
2431 /***********************************************************************
2432  *           NdrNonConformantStringUnmarshall [RPCRT4.@]
2433  */
2434 unsigned char *  WINAPI NdrNonConformantStringUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
2435                                 unsigned char **ppMemory,
2436                                 PFORMAT_STRING pFormat,
2437                                 unsigned char fMustAlloc)
2438 {
2439   ULONG bufsize, memsize, esize, maxsize;
2440 
2441   TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n",
2442     pStubMsg, *ppMemory, pFormat, fMustAlloc);
2443 
2444   maxsize = *(USHORT *)&pFormat[2];
2445 
2446   ReadVariance(pStubMsg, NULL, maxsize);
2447   if (pStubMsg->Offset)
2448   {
2449     ERR("non-conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2450     RpcRaiseException(RPC_S_INVALID_BOUND);
2451   }
2452 
2453   if (*pFormat == RPC_FC_CSTRING) esize = 1;
2454   else if (*pFormat == RPC_FC_WSTRING) esize = 2;
2455   else
2456   {
2457     ERR("Unhandled string type: %#x\n", *pFormat);
2458     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2459   }
2460 
2461   memsize = esize * maxsize;
2462   bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2463 
2464   validate_string_data(pStubMsg, bufsize, esize);
2465 
2466   if (!fMustAlloc && !*ppMemory)
2467     fMustAlloc = TRUE;
2468   if (fMustAlloc)
2469     *ppMemory = NdrAllocate(pStubMsg, memsize);
2470 
2471   safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);
2472 
2473   if (*pFormat == RPC_FC_CSTRING) {
2474     TRACE("string=%s\n", debugstr_an((char*)*ppMemory, pStubMsg->ActualCount));
2475   }
2476   else if (*pFormat == RPC_FC_WSTRING) {
2477     TRACE("string=%s\n", debugstr_wn((LPWSTR)*ppMemory, pStubMsg->ActualCount));
2478   }
2479 
2480   return NULL;
2481 }
2482 
2483 /***********************************************************************
2484  *           NdrNonConformantStringBufferSize [RPCRT4.@]
2485  */
2486 void WINAPI NdrNonConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
2487                                 unsigned char *pMemory,
2488                                 PFORMAT_STRING pFormat)
2489 {
2490   ULONG esize, maxsize;
2491 
2492   TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
2493 
2494   maxsize = *(USHORT *)&pFormat[2];
2495 
2496   SizeVariance(pStubMsg);
2497 
2498   if (*pFormat == RPC_FC_CSTRING)
2499   {
2500     ULONG i;
2501     const char *str = (const char *)pMemory;
2502     for (i = 0; i < maxsize && *str; i++, str++)
2503         ;
2504     TRACE("string=%s\n", debugstr_an(str, i));
2505     pStubMsg->ActualCount = i + 1;
2506     esize = 1;
2507   }
2508   else if (*pFormat == RPC_FC_WSTRING)
2509   {
2510     ULONG i;
2511     const WCHAR *str = (const WCHAR *)pMemory;
2512     for (i = 0; i < maxsize && *str; i++, str++)
2513         ;
2514     TRACE("string=%s\n", debugstr_wn(str, i));
2515     pStubMsg->ActualCount = i + 1;
2516     esize = 2;
2517   }
2518   else
2519   {
2520     ERR("Unhandled string type: %#x\n", *pFormat);
2521     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2522   }
2523 
2524   safe_buffer_length_increment(pStubMsg, safe_multiply(esize, pStubMsg->ActualCount));
2525 }
2526 
2527 /***********************************************************************
2528  *           NdrNonConformantStringMemorySize [RPCRT4.@]
2529  */
2530 ULONG WINAPI NdrNonConformantStringMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
2531                                 PFORMAT_STRING pFormat)
2532 {
2533   ULONG bufsize, memsize, esize, maxsize;
2534 
2535   TRACE("(pStubMsg == ^%p, pFormat == ^%p)\n", pStubMsg, pFormat);
2536 
2537   maxsize = *(USHORT *)&pFormat[2];
2538 
2539   ReadVariance(pStubMsg, NULL, maxsize);
2540 
2541   if (pStubMsg->Offset)
2542   {
2543     ERR("non-conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2544     RpcRaiseException(RPC_S_INVALID_BOUND);
2545   }
2546 
2547   if (*pFormat == RPC_FC_CSTRING) esize = 1;
2548   else if (*pFormat == RPC_FC_WSTRING) esize = 2;
2549   else
2550   {
2551     ERR("Unhandled string type: %#x\n", *pFormat);
2552     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2553   }
2554 
2555   memsize = esize * maxsize;
2556   bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2557 
2558   validate_string_data(pStubMsg, bufsize, esize);
2559 
2560   safe_buffer_increment(pStubMsg, bufsize);
2561   pStubMsg->MemorySize += memsize;
2562 
2563   return pStubMsg->MemorySize;
2564 }
2565 
2566 /* Complex types */
2567 
2568 #include "pshpack1.h"
2569 typedef struct
2570 {
2571     unsigned char type;
2572     unsigned char flags_type; /* flags in upper nibble, type in lower nibble */
2573     ULONG low_value;
2574     ULONG high_value;
2575 } NDR_RANGE;
2576 #include "poppack.h"
2577 
2578 static ULONG EmbeddedComplexSize(MIDL_STUB_MESSAGE *pStubMsg,
2579                                  PFORMAT_STRING pFormat)
2580 {
2581   switch (*pFormat) {
2582   case RPC_FC_STRUCT:
2583   case RPC_FC_PSTRUCT:
2584   case RPC_FC_CSTRUCT:
2585   case RPC_FC_BOGUS_STRUCT:
2586   case RPC_FC_SMFARRAY:
2587   case RPC_FC_SMVARRAY:
2588   case RPC_FC_CSTRING:
2589     return *(const WORD*)&pFormat[2];
2590   case RPC_FC_USER_MARSHAL:
2591     return *(const WORD*)&pFormat[4];
2592   case RPC_FC_RANGE: {
2593     switch (((const NDR_RANGE *)pFormat)->flags_type & 0xf) {
2594     case RPC_FC_BYTE:
2595     case RPC_FC_CHAR:
2596     case RPC_FC_SMALL:
2597     case RPC_FC_USMALL:
2598         return sizeof(UCHAR);
2599     case RPC_FC_WCHAR:
2600     case RPC_FC_SHORT:
2601     case RPC_FC_USHORT:
2602         return sizeof(USHORT);
2603     case RPC_FC_LONG:
2604     case RPC_FC_ULONG:
2605     case RPC_FC_ENUM32:
2606         return sizeof(ULONG);
2607     case RPC_FC_FLOAT:
2608         return sizeof(float);
2609     case RPC_FC_DOUBLE:
2610         return sizeof(double);
2611     case RPC_FC_HYPER:
2612         return sizeof(ULONGLONG);
2613     case RPC_FC_ENUM16:
2614         return sizeof(UINT);
2615     default:
2616         ERR("unknown type 0x%x\n", ((const NDR_RANGE *)pFormat)->flags_type & 0xf);
2617         RpcRaiseException(RPC_X_BAD_STUB_DATA);
2618     }
2619   }
2620   case RPC_FC_NON_ENCAPSULATED_UNION:
2621     pFormat += 2;
2622     if (pStubMsg->fHasNewCorrDesc)
2623         pFormat += 6;
2624     else
2625         pFormat += 4;
2626 
2627     pFormat += *(const SHORT*)pFormat;
2628     return *(const SHORT*)pFormat;
2629   case RPC_FC_IP:
2630     return sizeof(void *);
2631   case RPC_FC_WSTRING:
2632     return *(const WORD*)&pFormat[2] * 2;
2633   default:
2634     FIXME("unhandled embedded type %02x\n", *pFormat);
2635   }
2636   return 0;
2637 }
2638 
2639 
2640 static ULONG EmbeddedComplexMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
2641                                        PFORMAT_STRING pFormat)
2642 {
2643   NDR_MEMORYSIZE m = NdrMemorySizer[*pFormat & NDR_TABLE_MASK];
2644 
2645   if (!m)
2646   {
2647     FIXME("no memorysizer for data type=%02x\n", *pFormat);
2648     return 0;
2649   }
2650 
2651   return m(pStubMsg, pFormat);
2652 }
2653 
2654 
2655 static unsigned char * ComplexMarshall(PMIDL_STUB_MESSAGE pStubMsg,
2656                                        unsigned char *pMemory,
2657                                        PFORMAT_STRING pFormat,
2658                                        PFORMAT_STRING pPointer)
2659 {
2660   PFORMAT_STRING desc;
2661   NDR_MARSHALL m;
2662   ULONG size;
2663 
2664   while (*pFormat != RPC_FC_END) {
2665     switch (*pFormat) {
2666     case RPC_FC_BYTE:
2667     case RPC_FC_CHAR:
2668     case RPC_FC_SMALL:
2669     case RPC_FC_USMALL:
2670       TRACE("byte=%d <= %p\n", *(WORD*)pMemory, pMemory);
2671       safe_copy_to_buffer(pStubMsg, pMemory, 1);
2672       pMemory += 1;
2673       break;
2674     case RPC_FC_WCHAR:
2675     case RPC_FC_SHORT:
2676     case RPC_FC_USHORT:
2677       TRACE("short=%d <= %p\n", *(WORD*)pMemory, pMemory);
2678       safe_copy_to_buffer(pStubMsg, pMemory, 2);
2679       pMemory += 2;
2680       break;
2681     case RPC_FC_ENUM16:
2682       TRACE("enum16=%d <= %p\n", *(DWORD*)pMemory, pMemory);
2683       if (32767 < *(DWORD*)pMemory)
2684         RpcRaiseException(RPC_X_ENUM_VALUE_OUT_OF_RANGE);
2685       safe_copy_to_buffer(pStubMsg, pMemory, 2);
2686       pMemory += 4;
2687       break;
2688     case RPC_FC_LONG:
2689     case RPC_FC_ULONG:
2690     case RPC_FC_ENUM32:
2691       TRACE("long=%d <= %p\n", *(DWORD*)pMemory, pMemory);
2692       safe_copy_to_buffer(pStubMsg, pMemory, 4);
2693       pMemory += 4;
2694       break;
2695     case RPC_FC_HYPER:
2696       TRACE("longlong=%s <= %p\n", wine_dbgstr_longlong(*(ULONGLONG*)pMemory), pMemory);
2697       safe_copy_to_buffer(pStubMsg, pMemory, 8);
2698       pMemory += 8;
2699       break;
2700     case RPC_FC_POINTER:
2701     {
2702       unsigned char *saved_buffer;
2703       int pointer_buffer_mark_set = 0;
2704       TRACE("pointer=%p <= %p\n", *(unsigned char**)pMemory, pMemory);
2705       TRACE("pStubMsg->Buffer before %p\n", pStubMsg->Buffer);
2706       if (*pPointer != RPC_FC_RP)
2707         ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
2708       saved_buffer = pStubMsg->Buffer;
2709       if (pStubMsg->PointerBufferMark)
2710       {
2711         pStubMsg->Buffer = pStubMsg->PointerBufferMark;
2712         pStubMsg->PointerBufferMark = NULL;
2713         pointer_buffer_mark_set = 1;
2714       }
2715       else if (*pPointer != RPC_FC_RP)
2716         safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2717       PointerMarshall(pStubMsg, saved_buffer, *(unsigned char**)pMemory, pPointer);
2718       if (pointer_buffer_mark_set)
2719       {
2720         STD_OVERFLOW_CHECK(pStubMsg);
2721         pStubMsg->PointerBufferMark = pStubMsg->Buffer;
2722         pStubMsg->Buffer = saved_buffer;
2723         if (*pPointer != RPC_FC_RP)
2724           safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2725       }
2726       TRACE("pStubMsg->Buffer after %p\n", pStubMsg->Buffer);
2727       pPointer += 4;
2728       pMemory += sizeof(void *);
2729       break;
2730     }
2731     case RPC_FC_ALIGNM2:
2732       ALIGN_POINTER(pMemory, 2);
2733       break;
2734     case RPC_FC_ALIGNM4:
2735       ALIGN_POINTER(pMemory, 4);
2736       break;
2737     case RPC_FC_ALIGNM8:
2738       ALIGN_POINTER(pMemory, 8);
2739       break;
2740     case RPC_FC_STRUCTPAD1:
2741     case RPC_FC_STRUCTPAD2:
2742     case RPC_FC_STRUCTPAD3:
2743     case RPC_FC_STRUCTPAD4:
2744     case RPC_FC_STRUCTPAD5:
2745     case RPC_FC_STRUCTPAD6:
2746     case RPC_FC_STRUCTPAD7:
2747       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
2748       break;
2749     case RPC_FC_EMBEDDED_COMPLEX:
2750       pMemory += pFormat[1];
2751       pFormat += 2;
2752       desc = pFormat + *(const SHORT*)pFormat;
2753       size = EmbeddedComplexSize(pStubMsg, desc);
2754       TRACE("embedded complex (size=%d) <= %p\n", size, pMemory);
2755       m = NdrMarshaller[*desc & NDR_TABLE_MASK];
2756       if (m)
2757       {
2758         /* for some reason interface pointers aren't generated as
2759          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
2760          * they still need the derefencing treatment that pointers are
2761          * given */
2762         if (*desc == RPC_FC_IP)
2763           m(pStubMsg, *(unsigned char **)pMemory, desc);
2764         else
2765           m(pStubMsg, pMemory, desc);
2766       }
2767       else FIXME("no marshaller for embedded type %02x\n", *desc);
2768       pMemory += size;
2769       pFormat += 2;
2770       continue;
2771     case RPC_FC_PAD:
2772       break;
2773     default:
2774       FIXME("unhandled format 0x%02x\n", *pFormat);
2775     }
2776     pFormat++;
2777   }
2778 
2779   return pMemory;
2780 }
2781 
2782 static unsigned char * ComplexUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
2783                                          unsigned char *pMemory,
2784                                          PFORMAT_STRING pFormat,
2785                                          PFORMAT_STRING pPointer,
2786                                          unsigned char fMustAlloc)
2787 {
2788   PFORMAT_STRING desc;
2789   NDR_UNMARSHALL m;
2790   ULONG size;
2791 
2792   while (*pFormat != RPC_FC_END) {
2793     switch (*pFormat) {
2794     case RPC_FC_BYTE:
2795     case RPC_FC_CHAR:
2796     case RPC_FC_SMALL:
2797     case RPC_FC_USMALL:
2798       safe_copy_from_buffer(pStubMsg, pMemory, 1);
2799       TRACE("byte=%d => %p\n", *(WORD*)pMemory, pMemory);
2800       pMemory += 1;
2801       break;
2802     case RPC_FC_WCHAR:
2803     case RPC_FC_SHORT:
2804     case RPC_FC_USHORT:
2805       safe_copy_from_buffer(pStubMsg, pMemory, 2);
2806       TRACE("short=%d => %p\n", *(WORD*)pMemory, pMemory);
2807       pMemory += 2;
2808       break;
2809     case RPC_FC_ENUM16:
2810       safe_copy_from_buffer(pStubMsg, pMemory, 2);
2811       *(DWORD*)pMemory &= 0xffff;
2812       TRACE("enum16=%d => %p\n", *(DWORD*)pMemory, pMemory);
2813       if (32767 < *(DWORD*)pMemory)
2814         RpcRaiseException(RPC_X_ENUM_VALUE_OUT_OF_RANGE);
2815       pMemory += 4;
2816       break;
2817     case RPC_FC_LONG:
2818     case RPC_FC_ULONG:
2819     case RPC_FC_ENUM32:
2820       safe_copy_from_buffer(pStubMsg, pMemory, 4);
2821       TRACE("long=%d => %p\n", *(DWORD*)pMemory, pMemory);
2822       pMemory += 4;
2823       break;
2824     case RPC_FC_HYPER:
2825       safe_copy_from_buffer(pStubMsg, pMemory, 8);
2826       TRACE("longlong=%s => %p\n", wine_dbgstr_longlong(*(ULONGLONG*)pMemory), pMemory);
2827       pMemory += 8;
2828       break;
2829     case RPC_FC_POINTER:
2830     {
2831       unsigned char *saved_buffer;
2832       int pointer_buffer_mark_set = 0;
2833       TRACE("pointer => %p\n", pMemory);
2834       if (*pPointer != RPC_FC_RP)
2835         ALIGN_POINTER(pStubMsg->Buffer, 4);
2836       saved_buffer = pStubMsg->Buffer;
2837       if (pStubMsg->PointerBufferMark)
2838       {
2839         pStubMsg->Buffer = pStubMsg->PointerBufferMark;
2840         pStubMsg->PointerBufferMark = NULL;
2841         pointer_buffer_mark_set = 1;
2842       }
2843       else if (*pPointer != RPC_FC_RP)
2844         safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2845 
2846       PointerUnmarshall(pStubMsg, saved_buffer, (unsigned char**)pMemory, *(unsigned char**)pMemory, pPointer, fMustAlloc);
2847       if (pointer_buffer_mark_set)
2848       {
2849         STD_OVERFLOW_CHECK(pStubMsg);
2850         pStubMsg->PointerBufferMark = pStubMsg->Buffer;
2851         pStubMsg->Buffer = saved_buffer;
2852         if (*pPointer != RPC_FC_RP)
2853           safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2854       }
2855       pPointer += 4;
2856       pMemory += sizeof(void *);
2857       break;
2858     }
2859     case RPC_FC_ALIGNM2:
2860       ALIGN_POINTER_CLEAR(pMemory, 2);
2861       break;
2862     case RPC_FC_ALIGNM4:
2863       ALIGN_POINTER_CLEAR(pMemory, 4);
2864       break;
2865     case RPC_FC_ALIGNM8:
2866       ALIGN_POINTER_CLEAR(pMemory, 8);
2867       break;
2868     case RPC_FC_STRUCTPAD1:
2869     case RPC_FC_STRUCTPAD2:
2870     case RPC_FC_STRUCTPAD3:
2871     case RPC_FC_STRUCTPAD4:
2872     case RPC_FC_STRUCTPAD5:
2873     case RPC_FC_STRUCTPAD6:
2874     case RPC_FC_STRUCTPAD7:
2875       memset(pMemory, 0, *pFormat - RPC_FC_STRUCTPAD1 + 1);
2876       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
2877       break;
2878     case RPC_FC_EMBEDDED_COMPLEX:
2879       pMemory += pFormat[1];
2880       pFormat += 2;
2881       desc = pFormat + *(const SHORT*)pFormat;
2882       size = EmbeddedComplexSize(pStubMsg, desc);
2883       TRACE("embedded complex (size=%d) => %p\n", size, pMemory);
2884       if (fMustAlloc)
2885         /* we can't pass fMustAlloc=TRUE into the marshaller for this type
2886          * since the type is part of the memory block that is encompassed by
2887          * the whole complex type. Memory is forced to allocate when pointers
2888          * are set to NULL, so we emulate that part of fMustAlloc=TRUE by
2889          * clearing the memory we pass in to the unmarshaller */
2890         memset(pMemory, 0, size);
2891       m = NdrUnmarshaller[*desc & NDR_TABLE_MASK];
2892       if (m)
2893       {
2894         /* for some reason interface pointers aren't generated as
2895          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
2896          * they still need the derefencing treatment that pointers are
2897          * given */
2898         if (*desc == RPC_FC_IP)
2899           m(pStubMsg, (unsigned char **)pMemory, desc, FALSE);
2900         else
2901           m(pStubMsg, &pMemory, desc, FALSE);
2902       }
2903       else FIXME("no unmarshaller for embedded type %02x\n", *desc);
2904       pMemory += size;
2905       pFormat += 2;
2906       continue;
2907     case RPC_FC_PAD:
2908       break;
2909     default:
2910       FIXME("unhandled format %d\n", *pFormat);
2911     }
2912     pFormat++;
2913   }
2914 
2915   return pMemory;
2916 }
2917 
2918 static unsigned char * ComplexBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
2919                                          unsigned char *pMemory,
2920                                          PFORMAT_STRING pFormat,
2921                                          PFORMAT_STRING pPointer)
2922 {
2923   PFORMAT_STRING desc;
2924   NDR_BUFFERSIZE m;
2925   ULONG size;
2926 
2927   while (*pFormat != RPC_FC_END) {
2928     switch (*pFormat) {
2929     case RPC_FC_BYTE:
2930     case RPC_FC_CHAR:
2931     case RPC_FC_SMALL:
2932     case RPC_FC_USMALL:
2933       safe_buffer_length_increment(pStubMsg, 1);
2934       pMemory += 1;
2935       break;
2936     case RPC_FC_WCHAR:
2937     case RPC_FC_SHORT:
2938     case RPC_FC_USHORT:
2939       safe_buffer_length_increment(pStubMsg, 2);
2940       pMemory += 2;
2941       break;
2942     case RPC_FC_ENUM16:
2943       safe_buffer_length_increment(pStubMsg, 2);
2944       pMemory += 4;
2945       break;
2946     case RPC_FC_LONG:
2947     case RPC_FC_ULONG:
2948     case RPC_FC_ENUM32:
2949       safe_buffer_length_increment(pStubMsg, 4);
2950       pMemory += 4;
2951       break;
2952     case RPC_FC_HYPER:
2953       safe_buffer_length_increment(pStubMsg, 8);
2954       pMemory += 8;
2955       break;
2956     case RPC_FC_POINTER:
2957       if (!pStubMsg->IgnoreEmbeddedPointers)
2958       {
2959         int saved_buffer_length = pStubMsg->BufferLength;
2960         pStubMsg->BufferLength = pStubMsg->PointerLength;
2961         pStubMsg->PointerLength = 0;
2962         if(!pStubMsg->BufferLength)
2963           ERR("BufferLength == 0??\n");
2964         PointerBufferSize(pStubMsg, *(unsigned char**)pMemory, pPointer);
2965         pStubMsg->PointerLength = pStubMsg->BufferLength;
2966         pStubMsg->BufferLength = saved_buffer_length;
2967       }
2968       if (*pPointer != RPC_FC_RP)
2969       {
2970         ALIGN_LENGTH(pStubMsg->BufferLength, 4);
2971         safe_buffer_length_increment(pStubMsg, 4);
2972       }
2973       pPointer += 4;
2974       pMemory += sizeof(void*);
2975       break;
2976     case RPC_FC_ALIGNM2:
2977       ALIGN_POINTER(pMemory, 2);
2978       break;
2979     case RPC_FC_ALIGNM4:
2980       ALIGN_POINTER(pMemory, 4);
2981       break;
2982     case RPC_FC_ALIGNM8:
2983       ALIGN_POINTER(pMemory, 8);
2984       break;
2985     case RPC_FC_STRUCTPAD1:
2986     case RPC_FC_STRUCTPAD2:
2987     case RPC_FC_STRUCTPAD3:
2988     case RPC_FC_STRUCTPAD4:
2989     case RPC_FC_STRUCTPAD5:
2990     case RPC_FC_STRUCTPAD6:
2991     case RPC_FC_STRUCTPAD7:
2992       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
2993       break;
2994     case RPC_FC_EMBEDDED_COMPLEX:
2995       pMemory += pFormat[1];
2996       pFormat += 2;
2997       desc = pFormat + *(const SHORT*)pFormat;
2998       size = EmbeddedComplexSize(pStubMsg, desc);
2999       m = NdrBufferSizer[*desc & NDR_TABLE_MASK];
3000       if (m)
3001       {
3002         /* for some reason interface pointers aren't generated as
3003          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
3004          * they still need the derefencing treatment that pointers are
3005          * given */
3006         if (*desc == RPC_FC_IP)
3007           m(pStubMsg, *(unsigned char **)pMemory, desc);
3008         else
3009           m(pStubMsg, pMemory, desc);
3010       }
3011       else FIXME("no buffersizer for embedded type %02x\n", *desc);
3012       pMemory += size;
3013       pFormat += 2;
3014       continue;
3015     case RPC_FC_PAD:
3016       break;
3017     default:
3018       FIXME("unhandled format 0x%02x\n", *pFormat);
3019     }
3020     pFormat++;
3021   }
3022 
3023   return pMemory;
3024 }
3025 
3026 static unsigned char * ComplexFree(PMIDL_STUB_MESSAGE pStubMsg,
3027                                    unsigned char *pMemory,
3028                                    PFORMAT_STRING pFormat,
3029                                    PFORMAT_STRING pPointer)
3030 {
3031   PFORMAT_STRING desc;
3032   NDR_FREE m;
3033   ULONG size;
3034 
3035   while (*pFormat != RPC_FC_END) {
3036     switch (*pFormat) {
3037     case RPC_FC_BYTE:
3038     case RPC_FC_CHAR:
3039     case RPC_FC_SMALL:
3040     case RPC_FC_USMALL:
3041       pMemory += 1;
3042       break;
3043     case RPC_FC_WCHAR:
3044     case RPC_FC_SHORT:
3045     case RPC_FC_USHORT:
3046       pMemory += 2;
3047       break;
3048     case RPC_FC_LONG:
3049     case RPC_FC_ULONG:
3050     case RPC_FC_ENUM16:
3051     case RPC_FC_ENUM32:
3052       pMemory += 4;
3053       break;
3054     case RPC_FC_HYPER:
3055       pMemory += 8;
3056       break;
3057     case RPC_FC_POINTER:
3058       NdrPointerFree(pStubMsg, *(unsigned char**)pMemory, pPointer);
3059       pPointer += 4;
3060       pMemory += sizeof(void *);
3061       break;
3062     case RPC_FC_ALIGNM2:
3063       ALIGN_POINTER(pMemory, 2);
3064       break;
3065     case RPC_FC_ALIGNM4:
3066       ALIGN_POINTER(pMemory, 4);
3067       break;
3068     case RPC_FC_ALIGNM8:
3069       ALIGN_POINTER(pMemory, 8);
3070       break;
3071     case RPC_FC_STRUCTPAD1:
3072     case RPC_FC_STRUCTPAD2:
3073     case RPC_FC_STRUCTPAD3:
3074     case RPC_FC_STRUCTPAD4:
3075     case RPC_FC_STRUCTPAD5:
3076     case RPC_FC_STRUCTPAD6:
3077     case RPC_FC_STRUCTPAD7:
3078       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
3079       break;
3080     case RPC_FC_EMBEDDED_COMPLEX:
3081       pMemory += pFormat[1];
3082       pFormat += 2;
3083       desc = pFormat + *(const SHORT*)pFormat;
3084       size = EmbeddedComplexSize(pStubMsg, desc);
3085       m = NdrFreer[*desc & NDR_TABLE_MASK];
3086       if (m)
3087       {
3088         /* for some reason interface pointers aren't generated as
3089          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
3090          * they still need the derefencing treatment that pointers are
3091          * given */
3092         if (*desc == RPC_FC_IP)
3093           m(pStubMsg, *(unsigned char **)pMemory, desc);
3094         else
3095           m(pStubMsg, pMemory, desc);
3096       }
3097       pMemory += size;
3098       pFormat += 2;
3099       continue;
3100     case RPC_FC_PAD:
3101       break;
3102     default:
3103       FIXME("unhandled format 0x%02x\n", *pFormat);
3104     }
3105     pFormat++;
3106   }
3107 
3108   return pMemory;
3109 }
3110 
3111 static ULONG ComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
3112                                      PFORMAT_STRING pFormat,
3113                                      PFORMAT_STRING pPointer)
3114 {
3115   PFORMAT_STRING desc;
3116   ULONG size = 0;
3117 
3118   while (*pFormat != RPC_FC_END) {
3119     switch (*pFormat) {
3120     case RPC_FC_BYTE:
3121     case RPC_FC_CHAR:
3122     case RPC_FC_SMALL:
3123     case RPC_FC_USMALL:
3124       size += 1;
3125       safe_buffer_increment(pStubMsg, 1);
3126       break;
3127     case RPC_FC_WCHAR:
3128     case RPC_FC_SHORT:
3129     case RPC_FC_USHORT:
3130       size += 2;
3131       safe_buffer_increment(pStubMsg, 2);
3132       break;
3133     case RPC_FC_ENUM16:
3134       size += 4;
3135       safe_buffer_increment(pStubMsg, 2);
3136       break;
3137     case RPC_FC_LONG:
3138     case RPC_FC_ULONG:
3139     case RPC_FC_ENUM32:
3140       size += 4;
3141       safe_buffer_increment(pStubMsg, 4);
3142       break;
3143     case RPC_FC_HYPER:
3144       size += 8;
3145       safe_buffer_increment(pStubMsg, 8);
3146       break;
3147     case RPC_FC_POINTER:
3148     {
3149       unsigned char *saved_buffer;
3150       int pointer_buffer_mark_set = 0;
3151       if (*pPointer != RPC_FC_RP)
3152         ALIGN_POINTER(pStubMsg->Buffer, 4);
3153       saved_buffer = pStubMsg->Buffer;
3154       if (pStubMsg->PointerBufferMark)
3155       {
3156         pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3157         pStubMsg->PointerBufferMark = NULL;
3158         pointer_buffer_mark_set = 1;
3159       }
3160       else if (*pPointer != RPC_FC_RP)
3161         safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
3162 
3163       if (!pStubMsg->IgnoreEmbeddedPointers)
3164         PointerMemorySize(pStubMsg, saved_buffer, pPointer);
3165       if (pointer_buffer_mark_set)
3166       {
3167         STD_OVERFLOW_CHECK(pStubMsg);
3168         pStubMsg->PointerBufferMark = pStubMsg->Buffer;
3169         pStubMsg->Buffer = saved_buffer;
3170         if (*pPointer != RPC_FC_RP)
3171           safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
3172       }
3173       pPointer += 4;
3174       size += sizeof(void *);
3175       break;
3176     }
3177     case RPC_FC_ALIGNM2:
3178       ALIGN_LENGTH(size, 2);
3179       break;
3180     case RPC_FC_ALIGNM4:
3181       ALIGN_LENGTH(size, 4);
3182       break;
3183     case RPC_FC_ALIGNM8:
3184       ALIGN_LENGTH(size, 8);
3185       break;
3186     case RPC_FC_STRUCTPAD1:
3187     case RPC_FC_STRUCTPAD2:
3188     case RPC_FC_STRUCTPAD3:
3189     case RPC_FC_STRUCTPAD4:
3190     case RPC_FC_STRUCTPAD5:
3191     case RPC_FC_STRUCTPAD6:
3192     case RPC_FC_STRUCTPAD7:
3193       size += *pFormat - RPC_FC_STRUCTPAD1 + 1;
3194       break;
3195     case RPC_FC_EMBEDDED_COMPLEX:
3196       size += pFormat[1];
3197       pFormat += 2;
3198       desc = pFormat + *(const SHORT*)pFormat;
3199       size += EmbeddedComplexMemorySize(pStubMsg, desc);
3200       pFormat += 2;
3201       continue;
3202     case RPC_FC_PAD:
3203       break;
3204     default:
3205       FIXME("unhandled format 0x%02x\n", *pFormat);
3206     }
3207     pFormat++;
3208   }
3209 
3210   return size;
3211 }
3212 
3213 ULONG ComplexStructSize(PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
3214 {
3215   PFORMAT_STRING desc;
3216   ULONG size = 0;
3217 
3218   while (*pFormat != RPC_FC_END) {
3219     switch (*pFormat) {
3220     case RPC_FC_BYTE:
3221     case RPC_FC_CHAR:
3222     case RPC_FC_SMALL:
3223     case RPC_FC_USMALL:
3224       size += 1;
3225       break;
3226     case RPC_FC_WCHAR:
3227     case RPC_FC_SHORT:
3228     case RPC_FC_USHORT:
3229       size += 2;
3230       break;
3231     case RPC_FC_LONG:
3232     case RPC_FC_ULONG:
3233     case RPC_FC_ENUM16:
3234     case RPC_FC_ENUM32:
3235       size += 4;
3236       break;
3237     case RPC_FC_HYPER:
3238       size += 8;
3239       break;
3240     case RPC_FC_POINTER:
3241       size += sizeof(void *);
3242       break;
3243     case RPC_FC_ALIGNM2:
3244       ALIGN_LENGTH(size, 2);
3245       break;
3246     case RPC_FC_ALIGNM4:
3247       ALIGN_LENGTH(size, 4);
3248       break;
3249     case RPC_FC_ALIGNM8:
3250       ALIGN_LENGTH(size, 8);
3251       break;
3252     case RPC_FC_STRUCTPAD1:
3253     case RPC_FC_STRUCTPAD2:
3254     case RPC_FC_STRUCTPAD3:
3255     case RPC_FC_STRUCTPAD4:
3256     case RPC_FC_STRUCTPAD5:
3257     case RPC_FC_STRUCTPAD6:
3258     case RPC_FC_STRUCTPAD7:
3259       size += *pFormat - RPC_FC_STRUCTPAD1 + 1;
3260       break;
3261     case RPC_FC_EMBEDDED_COMPLEX:
3262       size += pFormat[1];
3263       pFormat += 2;
3264       desc = pFormat + *(const SHORT*)pFormat;
3265       size += EmbeddedComplexSize(pStubMsg, desc);
3266       pFormat += 2;
3267       continue;
3268     case RPC_FC_PAD:
3269       break;
3270     default:
3271       FIXME("unhandled format 0x%02x\n", *pFormat);
3272     }
3273     pFormat++;
3274   }
3275 
3276   return size;
3277 }
3278 
3279 /***********************************************************************
3280  *           NdrComplexStructMarshall [RPCRT4.@]
3281  */
3282 unsigned char * WINAPI NdrComplexStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
3283                                                 unsigned char *pMemory,
3284                                                 PFORMAT_STRING pFormat)
3285 {
3286   PFORMAT_STRING conf_array = NULL;
3287   PFORMAT_STRING pointer_desc = NULL;
3288   unsigned char *OldMemory = pStubMsg->Memory;
3289   int pointer_buffer_mark_set = 0;
3290   ULONG count = 0;
3291   ULONG max_count = 0;
3292   ULONG offset = 0;
3293 
3294   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3295 
3296   if (!pStubMsg->PointerBufferMark)
3297   {
3298     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3299     /* save buffer length */
3300     ULONG saved_buffer_length = pStubMsg->BufferLength;
3301 
3302     /* get the buffer pointer after complex array data, but before
3303      * pointer data */
3304     pStubMsg->BufferLength = pStubMsg->Buffer - (unsigned char *)pStubMsg->RpcMsg->Buffer;
3305     pStubMsg->IgnoreEmbeddedPointers = 1;
3306     NdrComplexStructBufferSize(pStubMsg, pMemory, pFormat);
3307     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3308 
3309     /* save it for use by embedded pointer code later */
3310     pStubMsg->PointerBufferMark = (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength;
3311     TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->PointerBufferMark - pStubMsg->Buffer));
3312     pointer_buffer_mark_set = 1;
3313 
3314     /* restore the original buffer length */
3315     pStubMsg->BufferLength = saved_buffer_length;
3316   }
3317 
3318   ALIGN_POINTER_CLEAR(pStubMsg->Buffer, pFormat[1] + 1);
3319 
3320   pFormat += 4;
3321   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3322   pFormat += 2;
3323   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3324   pFormat += 2;
3325 
3326   pStubMsg->Memory = pMemory;
3327 
3328   if (conf_array)
3329   {
3330     ULONG struct_size = ComplexStructSize(pStubMsg, pFormat);
3331     array_compute_and_write_conformance(conf_array[0], pStubMsg,
3332                                         pMemory + struct_size, conf_array);
3333     /* these could be changed in ComplexMarshall so save them for later */
3334     max_count = pStubMsg->MaxCount;
3335     count = pStubMsg->ActualCount;
3336     offset = pStubMsg->Offset;
3337   }
3338 
3339   pMemory = ComplexMarshall(pStubMsg, pMemory, pFormat, pointer_desc);
3340 
3341   if (conf_array)
3342   {
3343     pStubMsg->MaxCount = max_count;
3344     pStubMsg->ActualCount = count;
3345     pStubMsg->Offset = offset;
3346     array_write_variance_and_marshall(conf_array[0], pStubMsg, pMemory,
3347                                       conf_array, TRUE /* fHasPointers */);
3348   }
3349 
3350   pStubMsg->Memory = OldMemory;
3351 
3352   if (pointer_buffer_mark_set)
3353   {
3354     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3355     pStubMsg->PointerBufferMark = NULL;
3356   }
3357 
3358   STD_OVERFLOW_CHECK(pStubMsg);
3359 
3360   return NULL;
3361 }
3362 
3363 /***********************************************************************
3364  *           NdrComplexStructUnmarshall [RPCRT4.@]
3365  */
3366 unsigned char * WINAPI NdrComplexStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
3367                                                   unsigned char **ppMemory,
3368                                                   PFORMAT_STRING pFormat,
3369                                                   unsigned char fMustAlloc)
3370 {
3371   unsigned size = *(const WORD*)(pFormat+2);
3372   PFORMAT_STRING conf_array = NULL;
3373   PFORMAT_STRING pointer_desc = NULL;
3374   unsigned char *pMemory;
3375   int pointer_buffer_mark_set = 0;
3376   ULONG count = 0;
3377   ULONG max_count = 0;
3378   ULONG offset = 0;
3379   ULONG array_size = 0;
3380 
3381   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
3382 
3383   if (!pStubMsg->PointerBufferMark)
3384   {
3385     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3386     /* save buffer pointer */
3387     unsigned char *saved_buffer = pStubMsg->Buffer;
3388 
3389     /* get the buffer pointer after complex array data, but before
3390      * pointer data */
3391     pStubMsg->IgnoreEmbeddedPointers = 1;
3392     NdrComplexStructMemorySize(pStubMsg, pFormat);
3393     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3394 
3395     /* save it for use by embedded pointer code later */
3396     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
3397     TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->PointerBufferMark - saved_buffer));
3398     pointer_buffer_mark_set = 1;
3399 
3400     /* restore the original buffer */
3401     pStubMsg->Buffer = saved_buffer;
3402   }
3403 
3404   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
3405 
3406   pFormat += 4;
3407   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3408   pFormat += 2;
3409   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3410   pFormat += 2;
3411 
3412   if (conf_array)
3413   {
3414     array_size = array_read_conformance(conf_array[0], pStubMsg, conf_array);
3415     size += array_size;
3416 
3417     /* these could be changed in ComplexMarshall so save them for later */
3418     max_count = pStubMsg->MaxCount;
3419     count = pStubMsg->ActualCount;
3420     offset = pStubMsg->Offset;
3421   }
3422 
3423   if (!fMustAlloc && !*ppMemory)
3424     fMustAlloc = TRUE;
3425   if (fMustAlloc)
3426     *ppMemory = NdrAllocate(pStubMsg, size);
3427 
3428   pMemory = ComplexUnmarshall(pStubMsg, *ppMemory, pFormat, pointer_desc, fMustAlloc);
3429 
3430   if (conf_array)
3431   {
3432     pStubMsg->MaxCount = max_count;
3433     pStubMsg->ActualCount = count;
3434     pStubMsg->Offset = offset;
3435     if (fMustAlloc)
3436       memset(pMemory, 0, array_size);
3437     array_read_variance_and_unmarshall(conf_array[0], pStubMsg, &pMemory,
3438                                        conf_array, FALSE,
3439                                        FALSE /* fUseBufferMemoryServer */,
3440                                        TRUE /* fUnmarshall */);
3441   }
3442 
3443   if (pointer_buffer_mark_set)
3444   {
3445     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3446     pStubMsg->PointerBufferMark = NULL;
3447   }
3448 
3449   return NULL;
3450 }
3451 
3452 /***********************************************************************
3453  *           NdrComplexStructBufferSize [RPCRT4.@]
3454  */
3455 void WINAPI NdrComplexStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
3456                                        unsigned char *pMemory,
3457                                        PFORMAT_STRING pFormat)
3458 {
3459   PFORMAT_STRING conf_array = NULL;
3460   PFORMAT_STRING pointer_desc = NULL;
3461   unsigned char *OldMemory = pStubMsg->Memory;
3462   int pointer_length_set = 0;
3463   ULONG count = 0;
3464   ULONG max_count = 0;
3465   ULONG offset = 0;
3466 
3467   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3468 
3469   ALIGN_LENGTH(pStubMsg->BufferLength, pFormat[1] + 1);
3470 
3471   if(!pStubMsg->IgnoreEmbeddedPointers && !pStubMsg->PointerLength)
3472   {
3473     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3474     ULONG saved_buffer_length = pStubMsg->BufferLength;
3475 
3476     /* get the buffer length after complex struct data, but before
3477      * pointer data */
3478     pStubMsg->IgnoreEmbeddedPointers = 1;
3479     NdrComplexStructBufferSize(pStubMsg, pMemory, pFormat);
3480     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3481 
3482     /* save it for use by embedded pointer code later */
3483     pStubMsg->PointerLength = pStubMsg->BufferLength;
3484     pointer_length_set = 1;
3485     TRACE("difference = 0x%x\n", pStubMsg->PointerLength - saved_buffer_length);
3486 
3487     /* restore the original buffer length */
3488     pStubMsg->BufferLength = saved_buffer_length;
3489   }
3490 
3491   pFormat += 4;
3492   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3493   pFormat += 2;
3494   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3495   pFormat += 2;
3496 
3497   pStubMsg->Memory = pMemory;
3498 
3499   if (conf_array)
3500   {
3501     ULONG struct_size = ComplexStructSize(pStubMsg, pFormat);
3502     array_compute_and_size_conformance(conf_array[0], pStubMsg, pMemory + struct_size,
3503                                        conf_array);
3504 
3505     /* these could be changed in ComplexMarshall so save them for later */
3506     max_count = pStubMsg->MaxCount;
3507     count = pStubMsg->ActualCount;
3508     offset = pStubMsg->Offset;
3509   }
3510 
3511   pMemory = ComplexBufferSize(pStubMsg, pMemory, pFormat, pointer_desc);
3512 
3513   if (conf_array)
3514   {
3515     pStubMsg->MaxCount = max_count;
3516     pStubMsg->ActualCount = count;
3517     pStubMsg->Offset = offset;
3518     array_buffer_size(conf_array[0], pStubMsg, pMemory, conf_array,
3519                       TRUE /* fHasPointers */);
3520   }
3521 
3522   pStubMsg->Memory = OldMemory;
3523 
3524   if(pointer_length_set)
3525   {
3526     pStubMsg->BufferLength = pStubMsg->PointerLength;
3527     pStubMsg->PointerLength = 0;
3528   }
3529 
3530 }
3531 
3532 /***********************************************************************
3533  *           NdrComplexStructMemorySize [RPCRT4.@]
3534  */
3535 ULONG WINAPI NdrComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
3536                                         PFORMAT_STRING pFormat)
3537 {
3538   unsigned size = *(const WORD*)(pFormat+2);
3539   PFORMAT_STRING conf_array = NULL;
3540   PFORMAT_STRING pointer_desc = NULL;
3541   ULONG count = 0;
3542   ULONG max_count = 0;
3543   ULONG offset = 0;
3544 
3545   TRACE("(%p,%p)\n", pStubMsg, pFormat);
3546 
3547   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
3548 
3549   pFormat += 4;
3550   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3551   pFormat += 2;
3552   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3553   pFormat += 2;
3554 
3555   if (conf_array)
3556   {
3557     array_read_conformance(conf_array[0], pStubMsg, conf_array);
3558 
3559     /* these could be changed in ComplexStructMemorySize so save them for
3560      * later */
3561     max_count = pStubMsg->MaxCount;
3562     count = pStubMsg->ActualCount;
3563     offset = pStubMsg->Offset;
3564   }
3565 
3566   ComplexStructMemorySize(pStubMsg, pFormat, pointer_desc);
3567 
3568   if (conf_array)
3569   {
3570     pStubMsg->MaxCount = max_count;
3571     pStubMsg->ActualCount = count;
3572     pStubMsg->Offset = offset;
3573     array_memory_size(conf_array[0], pStubMsg, conf_array,
3574                       TRUE /* fHasPointers */);
3575   }
3576 
3577   return size;
3578 }
3579 
3580 /***********************************************************************
3581  *           NdrComplexStructFree [RPCRT4.@]
3582  */
3583 void WINAPI NdrComplexStructFree(PMIDL_STUB_MESSAGE pStubMsg,
3584                                  unsigned char *pMemory,
3585                                  PFORMAT_STRING pFormat)
3586 {
3587   PFORMAT_STRING conf_array = NULL;
3588   PFORMAT_STRING pointer_desc = NULL;
3589   unsigned char *OldMemory = pStubMsg->Memory;
3590 
3591   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3592 
3593   pFormat += 4;
3594   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3595   pFormat += 2;
3596   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3597   pFormat += 2;
3598 
3599   pStubMsg->Memory = pMemory;
3600 
3601   pMemory = ComplexFree(pStubMsg, pMemory, pFormat, pointer_desc);
3602 
3603   if (conf_array)
3604     array_free(conf_array[0], pStubMsg, pMemory, conf_array,
3605                TRUE /* fHasPointers */);
3606 
3607   pStubMsg->Memory = OldMemory;
3608 }
3609 
3610 /***********************************************************************
3611  *           NdrConformantArrayMarshall [RPCRT4.@]
3612  */
3613 unsigned char * WINAPI NdrConformantArrayMarshall(PMIDL_STUB_MESSAGE pStubMsg,
3614                                                   unsigned char *pMemory,
3615                                                   PFORMAT_STRING pFormat)
3616 {
3617   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3618   if (pFormat[0] != RPC_FC_CARRAY)
3619   {
3620     ERR("invalid format = 0x%x\n", pFormat[0]);
3621     RpcRaiseException(RPC_X_BAD_STUB_DATA);
3622   }
3623 
3624   array_compute_and_write_conformance(RPC_FC_CARRAY, pStubMsg, pMemory,
3625                                       pFormat);
3626   array_write_variance_and_marshall(RPC_FC_CARRAY, pStubMsg, pMemory, pFormat,
3627                                     TRUE /* fHasPointers */);
3628 
3629   return NULL;
3630 }
3631 
3632 /***********************************************************************
3633  *           NdrConformantArrayUnmarshall [RPCRT4.@]
3634  */
3635 unsigned char * WINAPI NdrConformantArrayUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
3636                                                     unsigned char **ppMemory,
3637                                                     PFORMAT_STRING pFormat,
3638                                                     unsigned char fMustAlloc)
3639 {
3640   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
3641   if (pFormat[0] != RPC_FC_CARRAY)
3642   {
3643     ERR("invalid format = 0x%x\n", pFormat[0]);
3644     RpcRaiseException(RPC_X_BAD_STUB_DATA);
3645   }
3646 
3647   array_read_conformance(RPC_FC_CARRAY, pStubMsg, pFormat);
3648   array_read_variance_and_unmarshall(RPC_FC_CARRAY, pStubMsg, ppMemory, pFormat,
3649                                      fMustAlloc,
3650                                      TRUE /* fUseBufferMemoryServer */,
3651                                      TRUE /* fUnmarshall */);
3652 
3653   return NULL;
3654 }
3655 
3656 /***********************************************************************
3657  *           NdrConformantArrayBufferSize [RPCRT4.@]
3658  */
3659 void WINAPI NdrConformantArrayBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
3660                                          unsigned char *pMemory,
3661                                          PFORMAT_STRING pFormat)
3662 {
3663   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3664   if (pFormat[0] != RPC_FC_CARRAY)
3665   {
3666     ERR("invalid format = 0x%x\n", pFormat[0]);
3667     RpcRaiseException(RPC_X_BAD_STUB_DATA);
3668   }
3669 
3670   array_compute_and_size_conformance(RPC_FC_CARRAY, pStubMsg, pMemory, pFormat);
3671   array_buffer_size(RPC_FC_CARRAY, pStubMsg, pMemory, pFormat,
3672                     TRUE /* fHasPointers */);
3673 }
3674 
3675 /***********************************************************************
3676  *           NdrConformantArrayMemorySize [RPCRT4.@]
3677  */
3678 ULONG WINAPI NdrConformantArrayMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
3679                                           PFORMAT_STRING pFormat)
3680 {
3681   TRACE("(%p,%p)\n", pStubMsg, pFormat);
3682   if (pFormat[0] != RPC_FC_CARRAY)
3683   {
3684     ERR("invalid format = 0x%x\n", pFormat[0]);
3685     RpcRaiseException(RPC_X_BAD_STUB_DATA);
3686   }
3687 
3688   array_read_conformance(RPC_FC_CARRAY, pStubMsg, pFormat);
3689   array_memory_size(RPC_FC_CARRAY, pStubMsg, pFormat, TRUE /* fHasPointers */);
3690 
3691   return pStubMsg->MemorySize;
3692 }
3693 
3694 /***********************************************************************
3695  *           NdrConformantArrayFree [RPCRT4.@]
3696  */
3697 void WINAPI NdrConformantArrayFree(PMIDL_STUB_MESSAGE pStubMsg,
3698                                    unsigned char *pMemory,
3699                                    PFORMAT_STRING pFormat)
3700 {
3701   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3702   if (pFormat[0] != RPC_FC_CARRAY)
3703   {
3704     ERR("invalid format = 0x%x\n", pFormat[0]);
3705     RpcRaiseException(RPC_X_BAD_STUB_DATA);
3706   }
3707 
3708   array_free(RPC_FC_CARRAY, pStubMsg, pMemory, pFormat,
3709              TRUE /* fHasPointers */);
3710 }
3711 
3712 
3713 /***********************************************************************
3714  *           NdrConformantVaryingArrayMarshall  [RPCRT4.@]
3715  */
3716 unsigned char* WINAPI NdrConformantVaryingArrayMarshall( PMIDL_STUB_MESSAGE pStubMsg,
3717                                                          unsigned char* pMemory,
3718                                                          PFORMAT_STRING pFormat )
3719 {
3720     TRACE("(%p, %p, %p)\n", pStubMsg, pMemory, pFormat);
3721 
3722     if (pFormat[0] != RPC_FC_CVARRAY)
3723     {
3724         ERR("invalid format type %x\n", pFormat[0]);
3725         RpcRaiseException(RPC_S_INTERNAL_ERROR);
3726         return NULL;
3727     }
3728 
3729     array_compute_and_write_conformance(RPC_FC_CVARRAY, pStubMsg, pMemory,
3730                                         pFormat);
3731     array_write_variance_and_marshall(RPC_FC_CVARRAY, pStubMsg, pMemory,
3732                                       pFormat, TRUE /* fHasPointers */);
3733 
3734     return NULL;
3735 }
3736 
3737 
3738 /***********************************************************************
3739  *           NdrConformantVaryingArrayUnmarshall  [RPCRT4.@]
3740  */
3741 unsigned char* WINAPI NdrConformantVaryingArrayUnmarshall( PMIDL_STUB_MESSAGE pStubMsg,
3742                                                            unsigned char** ppMemory,
3743                                                            PFORMAT_STRING pFormat,
3744                                                            unsigned char fMustAlloc )
3745 {
3746     TRACE("(%p, %p, %p, %d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
3747 
3748     if (pFormat[0] != RPC_FC_CVARRAY)
3749     {
3750         ERR("invalid format type %x\n", pFormat[0]);
3751         RpcRaiseException(RPC_S_INTERNAL_ERROR);
3752         return NULL;
3753     }
3754 
3755     array_read_conformance(RPC_FC_CVARRAY, pStubMsg, pFormat);
3756     array_read_variance_and_unmarshall(RPC_FC_CVARRAY, pStubMsg, ppMemory,
3757                                        pFormat, fMustAlloc,
3758                                        TRUE /* fUseBufferMemoryServer */,
3759                                        TRUE /* fUnmarshall */);
3760 
3761     return NULL;
3762 }
3763 
3764 
3765 /***********************************************************************
3766  *           NdrConformantVaryingArrayFree  [RPCRT4.@]
3767  */
3768 void WINAPI NdrConformantVaryingArrayFree( PMIDL_STUB_MESSAGE pStubMsg,
3769                                            unsigned char* pMemory,
3770                                            PFORMAT_STRING pFormat )
3771 {
3772     TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3773 
3774     if (pFormat[0] != RPC_FC_CVARRAY)
3775     {
3776         ERR("invalid format type %x\n", pFormat[0]);
3777         RpcRaiseException(RPC_S_INTERNAL_ERROR);
3778         return;
3779     }
3780 
3781     array_free(RPC_FC_CVARRAY, pStubMsg, pMemory, pFormat,
3782                TRUE /* fHasPointers */);
3783 }
3784 
3785 
3786 /***********************************************************************
3787  *           NdrConformantVaryingArrayBufferSize  [RPCRT4.@]
3788  */
3789 void WINAPI NdrConformantVaryingArrayBufferSize( PMIDL_STUB_MESSAGE pStubMsg,
3790                                                  unsigned char* pMemory, PFORMAT_STRING pFormat )
3791 {
3792     TRACE("(%p, %p, %p)\n", pStubMsg, pMemory, pFormat);
3793 
3794     if (pFormat[0] != RPC_FC_CVARRAY)
3795     {
3796         ERR("invalid format type %x\n", pFormat[0]);
3797         RpcRaiseException(RPC_S_INTERNAL_ERROR);
3798         return;
3799     }
3800 
3801     array_compute_and_size_conformance(RPC_FC_CVARRAY, pStubMsg, pMemory,
3802                                        pFormat);
3803     array_buffer_size(RPC_FC_CVARRAY, pStubMsg, pMemory, pFormat,
3804                       TRUE /* fHasPointers */);
3805 }
3806 
3807 
3808 /***********************************************************************
3809  *           NdrConformantVaryingArrayMemorySize  [RPCRT4.@]
3810  */
3811 ULONG WINAPI NdrConformantVaryingArrayMemorySize( PMIDL_STUB_MESSAGE pStubMsg,
3812                                                   PFORMAT_STRING pFormat )
3813 {
3814     TRACE("(%p, %p)\n", pStubMsg, pFormat);
3815 
3816     if (pFormat[0] != RPC_FC_CVARRAY)
3817     {
3818         ERR("invalid format type %x\n", pFormat[0]);
3819         RpcRaiseException(RPC_S_INTERNAL_ERROR);
3820         return pStubMsg->MemorySize;
3821     }
3822 
3823     array_read_conformance(RPC_FC_CVARRAY, pStubMsg, pFormat);
3824     array_memory_size(RPC_FC_CVARRAY, pStubMsg, pFormat,
3825                       TRUE /* fHasPointers */);
3826 
3827     return pStubMsg->MemorySize;
3828 }
3829 
3830 
3831 /***********************************************************************
3832  *           NdrComplexArrayMarshall [RPCRT4.@]
3833  */
3834 unsigned char * WINAPI NdrComplexArrayMarshall(PMIDL_STUB_MESSAGE pStubMsg,
3835                                                unsigned char *pMemory,
3836                                                PFORMAT_STRING pFormat)
3837 {
3838   ULONG i, count, def;
3839   BOOL variance_present;
3840   unsigned char alignment;
3841   int pointer_buffer_mark_set = 0;
3842 
3843   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3844 
3845   if (pFormat[0] != RPC_FC_BOGUS_ARRAY)
3846   {
3847       ERR("invalid format type %x\n", pFormat[0]);
3848       RpcRaiseException(RPC_S_INTERNAL_ERROR);
3849       return NULL;
3850   }
3851 
3852   alignment = pFormat[1] + 1;
3853 
3854   if (!pStubMsg->PointerBufferMark)
3855   {
3856     /* save buffer fields that may be changed by buffer sizer functions
3857      * and that may be needed later on */
3858     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3859     ULONG saved_buffer_length = pStubMsg->BufferLength;
3860     ULONG_PTR saved_max_count = pStubMsg->MaxCount;
3861     ULONG saved_offset = pStubMsg->Offset;
3862     ULONG saved_actual_count = pStubMsg->ActualCount;
3863 
3864     /* get the buffer pointer after complex array data, but before
3865      * pointer data */
3866     pStubMsg->BufferLength = pStubMsg->Buffer - (unsigned char *)pStubMsg->RpcMsg->Buffer;
3867     pStubMsg->IgnoreEmbeddedPointers = 1;
3868     NdrComplexArrayBufferSize(pStubMsg, pMemory, pFormat);
3869     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3870 
3871     /* save it for use by embedded pointer code later */
3872     pStubMsg->PointerBufferMark = (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength;
3873     TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->Buffer - (unsigned char *)pStubMsg->RpcMsg->Buffer));
3874     pointer_buffer_mark_set = 1;
3875 
3876     /* restore fields */
3877     pStubMsg->ActualCount = saved_actual_count;
3878     pStubMsg->Offset = saved_offset;
3879     pStubMsg->MaxCount = saved_max_count;
3880     pStubMsg->BufferLength = saved_buffer_length;
3881   }
3882 
3883   def = *(const WORD*)&pFormat[2];
3884   pFormat += 4;
3885 
3886   pFormat = ComputeConformance(pStubMsg, pMemory, pFormat, def);
3887   TRACE("conformance = %ld\n", pStubMsg->MaxCount);
3888 
3889   variance_present = IsConformanceOrVariancePresent(pFormat);
3890   pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, pStubMsg->MaxCount);
3891   TRACE("variance = %d\n", pStubMsg->ActualCount);
3892 
3893   WriteConformance(pStubMsg);
3894   if (variance_present)
3895     WriteVariance(pStubMsg);
3896 
3897   ALIGN_POINTER_CLEAR(pStubMsg->Buffer, alignment);
3898 
3899   count = pStubMsg->ActualCount;
3900   for (i = 0; i < count; i++)
3901     pMemory = ComplexMarshall(pStubMsg, pMemory, pFormat, NULL);
3902 
3903   STD_OVERFLOW_CHECK(pStubMsg);
3904 
3905   if (pointer_buffer_mark_set)
3906   {
3907     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3908     pStubMsg->PointerBufferMark = NULL;
3909   }
3910 
3911   return NULL;
3912 }
3913 
3914 /***********************************************************************
3915  *           NdrComplexArrayUnmarshall [RPCRT4.@]
3916  */
3917 unsigned char * WINAPI NdrComplexArrayUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
3918                                                  unsigned char **ppMemory,
3919                                                  PFORMAT_STRING pFormat,
3920                                                  unsigned char fMustAlloc)
3921 {
3922   ULONG i, count, size;
3923   unsigned char alignment;
3924   unsigned char *pMemory;
3925   unsigned char *saved_buffer;
3926   int pointer_buffer_mark_set = 0;
3927   int saved_ignore_embedded;
3928 
3929   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
3930 
3931   if (pFormat[0] != RPC_FC_BOGUS_ARRAY)
3932   {
3933       ERR("invalid format type %x\n", pFormat[0]);
3934       RpcRaiseException(RPC_S_INTERNAL_ERROR);
3935       return NULL;
3936   }
3937 
3938   alignment = pFormat[1] + 1;
3939 
3940   saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3941   /* save buffer pointer */
3942   saved_buffer = pStubMsg->Buffer;
3943   /* get the buffer pointer after complex array data, but before
3944    * pointer data */
3945   pStubMsg->IgnoreEmbeddedPointers = 1;
3946   pStubMsg->MemorySize = 0;
3947   NdrComplexArrayMemorySize(pStubMsg, pFormat);
3948   size = pStubMsg->MemorySize;
3949   pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3950 
3951   TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->Buffer - saved_buffer));
3952   if (!pStubMsg->PointerBufferMark)
3953   {
3954     /* save it for use by embedded pointer code later */
3955     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
3956     pointer_buffer_mark_set = 1;
3957   }
3958   /* restore the original buffer */
3959   pStubMsg->Buffer = saved_buffer;
3960 
3961   pFormat += 4;
3962 
3963   pFormat = ReadConformance(pStubMsg, pFormat);
3964   pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
3965 
3966   if (!fMustAlloc && !*ppMemory)
3967     fMustAlloc = TRUE;
3968   if (fMustAlloc)
3969     *ppMemory = NdrAllocate(pStubMsg, size);
3970 
3971   ALIGN_POINTER(pStubMsg->Buffer, alignment);
3972 
3973   pMemory = *ppMemory;
3974   count = pStubMsg->ActualCount;
3975   for (i = 0; i < count; i++)
3976     pMemory = ComplexUnmarshall(pStubMsg, pMemory, pFormat, NULL, fMustAlloc);
3977 
3978   if (pointer_buffer_mark_set)
3979   {
3980     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3981     pStubMsg->PointerBufferMark = NULL;
3982   }
3983 
3984   return NULL;
3985 }
3986 
3987 /***********************************************************************
3988  *           NdrComplexArrayBufferSize [RPCRT4.@]
3989  */
3990 void WINAPI NdrComplexArrayBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
3991                                       unsigned char *pMemory,
3992                                       PFORMAT_STRING pFormat)
3993 {
3994   ULONG i, count, def;
3995   unsigned char alignment;
3996   BOOL variance_present;
3997   int pointer_length_set = 0;
3998 
3999   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
4000 
4001   if (pFormat[0] != RPC_FC_BOGUS_ARRAY)
4002   {
4003       ERR("invalid format type %x\n", pFormat[0]);
4004       RpcRaiseException(RPC_S_INTERNAL_ERROR);
4005       return;
4006   }
4007 
4008   alignment = pFormat[1] + 1;
4009 
4010   if (!pStubMsg->IgnoreEmbeddedPointers && !pStubMsg->PointerLength)
4011   {
4012     /* save buffer fields that may be changed by buffer sizer functions
4013      * and that may be needed later on */
4014     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
4015     ULONG saved_buffer_length = pStubMsg->BufferLength;
4016     ULONG_PTR saved_max_count = pStubMsg->MaxCount;
4017     ULONG saved_offset = pStubMsg->Offset;
4018     ULONG saved_actual_count = pStubMsg->ActualCount;
4019 
4020     /* get the buffer pointer after complex array data, but before
4021      * pointer data */
4022     pStubMsg->IgnoreEmbeddedPointers = 1;
4023     NdrComplexArrayBufferSize(pStubMsg, pMemory, pFormat);
4024     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
4025 
4026     /* save it for use by embedded pointer code later */
4027     pStubMsg->PointerLength = pStubMsg->BufferLength;
4028     pointer_length_set = 1;
4029 
4030     /* restore fields */
4031     pStubMsg->ActualCount = saved_actual_count;
4032     pStubMsg->Offset = saved_offset;
4033     pStubMsg->MaxCount = saved_max_count;
4034     pStubMsg->BufferLength = saved_buffer_length;
4035   }
4036   def = *(const WORD*)&pFormat[2];
4037   pFormat += 4;
4038 
4039   pFormat = ComputeConformance(pStubMsg, pMemory, pFormat, def);
4040   TRACE("conformance = %ld\n", pStubMsg->MaxCount);
4041   SizeConformance(pStubMsg);
4042 
4043   variance_present = IsConformanceOrVariancePresent(pFormat);
4044   pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, pStubMsg->MaxCount);
4045   TRACE("variance = %d\n", pStubMsg->ActualCount);
4046 
4047   if (variance_present)
4048     SizeVariance(pStubMsg);
4049 
4050   ALIGN_LENGTH(pStubMsg->BufferLength, alignment);
4051 
4052   count = pStubMsg->ActualCount;
4053   for (i = 0; i < count; i++)
4054     pMemory = ComplexBufferSize(pStubMsg, pMemory, pFormat, NULL);
4055 
4056   if(pointer_length_set)
4057   {
4058     pStubMsg->BufferLength = pStubMsg->PointerLength;
4059     pStubMsg->PointerLength = 0;
4060   }
4061 }
4062 
4063 /***********************************************************************
4064  *           NdrComplexArrayMemorySize [RPCRT4.@]
4065  */
4066 ULONG WINAPI NdrComplexArrayMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
4067                                        PFORMAT_STRING pFormat)
4068 {
4069   ULONG i, count, esize, SavedMemorySize, MemorySize;
4070   unsigned char alignment;
4071 
4072   TRACE("(%p,%p)\n", pStubMsg, pFormat);
4073 
4074   if (pFormat[0] != RPC_FC_BOGUS_ARRAY)
4075   {
4076       ERR("invalid format type %x\n", pFormat[0]);
4077       RpcRaiseException(RPC_S_INTERNAL_ERROR);
4078       return 0;
4079   }
4080 
4081   alignment = pFormat[1] + 1;
4082 
4083   pFormat += 4;
4084 
4085   pFormat = ReadConformance(pStubMsg, pFormat);
4086   pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
4087 
4088   ALIGN_POINTER(pStubMsg->Buffer, alignment);
4089 
4090   SavedMemorySize = pStubMsg->MemorySize;
4091 
4092   esize = ComplexStructSize(pStubMsg, pFormat);
4093 
4094   MemorySize = safe_multiply(pStubMsg->MaxCount, esize);
4095 
4096   count = pStubMsg->ActualCount;
4097   for (i = 0; i < count; i++)
4098     ComplexStructMemorySize(pStubMsg, pFormat, NULL);
4099 
4100   pStubMsg->MemorySize = SavedMemorySize;
4101 
4102   pStubMsg->MemorySize += MemorySize;
4103   return MemorySize;
4104 }
4105 
4106 /***********************************************************************
4107  *           NdrComplexArrayFree [RPCRT4.@]
4108  */
4109 void WINAPI NdrComplexArrayFree(PMIDL_STUB_MESSAGE pStubMsg,
4110                                 unsigned char *pMemory,
4111                                 PFORMAT_STRING pFormat)
4112 {
4113   ULONG i, count, def;
4114 
4115   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
4116 
4117   if (pFormat[0] != RPC_FC_BOGUS_ARRAY)
4118   {
4119       ERR("invalid format type %x\n", pFormat[0]);
4120       RpcRaiseException(RPC_S_INTERNAL_ERROR);
4121       return;
4122   }
4123 
4124   def = *(const WORD*)&pFormat[2];
4125   pFormat += 4;
4126 
4127   pFormat = ComputeConformance(pStubMsg, pMemory, pFormat, def);
4128   TRACE("conformance = %ld\n", pStubMsg->MaxCount);
4129 
4130   pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, pStubMsg->MaxCount);
4131   TRACE("variance = %d\n", pStubMsg->ActualCount);
4132 
4133   count = pStubMsg->ActualCount;
4134   for (i = 0; i < count; i++)
4135     pMemory = ComplexFree(pStubMsg, pMemory, pFormat, NULL);
4136 }
4137 
4138 static void UserMarshalCB(PMIDL_STUB_MESSAGE pStubMsg,
4139                           USER_MARSHAL_CB_TYPE cbtype, PFORMAT_STRING pFormat,
4140                           USER_MARSHAL_CB *umcb)
4141 {
4142   umcb->Flags = MAKELONG(pStubMsg->dwDestContext,
4143                          pStubMsg->RpcMsg->DataRepresentation);
4144   umcb->pStubMsg = pStubMsg;
4145   umcb->pReserve = NULL;
4146   umcb->Signature = USER_MARSHAL_CB_SIGNATURE;
4147   umcb->CBType = cbtype;
4148   umcb->pFormat = pFormat;
4149   umcb->pTypeFormat = NULL /* FIXME */;
4150 }
4151 
4152 #define USER_MARSHAL_PTR_PREFIX \
4153         ( (DWORD)'U'         | ( (DWORD)'s' << 8 ) | \
4154         ( (DWORD)'e' << 16 ) | ( (DWORD)'r' << 24 ) )
4155 
4156 /***********************************************************************
4157  *           NdrUserMarshalMarshall [RPCRT4.@]
4158  */
4159 unsigned char * WINAPI NdrUserMarshalMarshall(PMIDL_STUB_MESSAGE pStubMsg,
4160                                               unsigned char *pMemory,
4161                                               PFORMAT_STRING pFormat)
4162 {
4163   unsigned flags = pFormat[1];
4164   unsigned index = *(const WORD*)&pFormat[2];
4165   unsigned char *saved_buffer = NULL;
4166   USER_MARSHAL_CB umcb;
4167 
4168   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
4169   TRACE("index=%d\n", index);
4170 
4171   UserMarshalCB(pStubMsg, USER_MARSHAL_CB_MARSHALL, pFormat, &umcb);
4172 
4173   if (flags & USER_MARSHAL_POINTER)
4174   {
4175     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
4176     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, USER_MARSHAL_PTR_PREFIX);
4177     pStubMsg->Buffer += 4;
4178     if (pStubMsg->PointerBufferMark)
4179     {
4180       saved_buffer = pStubMsg->Buffer;
4181       pStubMsg->Buffer = pStubMsg->PointerBufferMark;
4182       pStubMsg->PointerBufferMark = NULL;
4183     }
4184     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 8);
4185   }
4186   else
4187     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, (flags & 0xf) + 1);
4188 
4189   pStubMsg->Buffer =
4190     pStubMsg->StubDesc->aUserMarshalQuadruple[index].pfnMarshall(
4191       &umcb.Flags, pStubMsg->Buffer, pMemory);
4192 
4193   if (saved_buffer)
4194   {
4195     STD_OVERFLOW_CHECK(pStubMsg);
4196     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
4197     pStubMsg->Buffer = saved_buffer;
4198   }
4199 
4200   STD_OVERFLOW_CHECK(pStubMsg);
4201 
4202   return NULL;
4203 }
4204 
4205 /***********************************************************************
4206  *           NdrUserMarshalUnmarshall [RPCRT4.@]
4207  */
4208 unsigned char * WINAPI NdrUserMarshalUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
4209                                                  unsigned char **ppMemory,
4210                                                  PFORMAT_STRING pFormat,
4211                                                  unsigned char fMustAlloc)