~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~ [ freetext search ] ~ [ file search ] ~

Wine Cross Reference
wine/dlls/rpcrt4/ndr_marshall.c

Version: ~ [ wine-1.1.33 ] ~ [ wine-1.1.32 ] ~ [ wine-1.1.31 ] ~ [ wine-1.1.30 ] ~ [ wine-1.1.29 ] ~ [ wine-1.1.28 ] ~ [ wine-1.1.27 ] ~ [ wine-1.1.26 ] ~ [ wine-1.1.25 ] ~ [ wine-1.1.24 ] ~ [ wine-1.1.23 ] ~ [ wine-1.1.22 ] ~ [ wine-1.1.21 ] ~ [ wine-1.1.20 ] ~ [ wine-1.1.19 ] ~ [ wine-1.1.18 ] ~ [ wine-1.1.17 ] ~ [ wine-1.1.16 ] ~ [ wine-1.1.15 ] ~ [ wine-1.1.14 ] ~ [ wine-1.1.13 ] ~ [ wine-1.1.12 ] ~ [ wine-1.1.11 ] ~ [ wine-1.1.10 ] ~ [ wine-1.1.9 ] ~ [ wine-1.1.8 ] ~ [ wine-1.1.7 ] ~ [ wine-1.0.1 ] ~ [ wine-1.1.6 ] ~ [ wine-1.1.5 ] ~ [ wine-1.1.4 ] ~ [ wine-1.1.3 ] ~ [ wine-1.1.2 ] ~ [ wine-1.1.1 ] ~ [ wine-1.1.0 ] ~ [ wine-1.0 ] ~

  1 /*
  2  * NDR data marshalling
  3  *
  4  * Copyright 2002 Greg Turner
  5  * Copyright 2003-2006 CodeWeavers
  6  *
  7  * This library is free software; you can redistribute it and/or
  8  * modify it under the terms of the GNU Lesser General Public
  9  * License as published by the Free Software Foundation; either
 10  * version 2.1 of the License, or (at your option) any later version.
 11  *
 12  * This library is distributed in the hope that it will be useful,
 13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
 14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 15  * Lesser General Public License for more details.
 16  *
 17  * You should have received a copy of the GNU Lesser General Public
 18  * License along with this library; if not, write to the Free Software
 19  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
 20  *
 21  * TODO:
 22  *  - String structs
 23  *  - Byte count pointers
 24  *  - transmit_as/represent as
 25  *  - Multi-dimensional arrays
 26  *  - Conversion functions (NdrConvert)
 27  *  - Checks for integer addition overflow in user marshall functions
 28  */
 29 
 30 #include <stdarg.h>
 31 #include <stdio.h>
 32 #include <string.h>
 33 #include <limits.h>
 34 
 35 #include "windef.h"
 36 #include "winbase.h"
 37 #include "winerror.h"
 38 
 39 #include "ndr_misc.h"
 40 #include "rpcndr.h"
 41 
 42 #include "wine/unicode.h"
 43 #include "wine/rpcfc.h"
 44 
 45 #include "wine/debug.h"
 46 
 47 WINE_DEFAULT_DEBUG_CHANNEL(ole);
 48 
 49 #if defined(__i386__)
 50 # define LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32) \
 51     (*((UINT32 *)(pchar)) = (uint32))
 52 
 53 # define LITTLE_ENDIAN_UINT32_READ(pchar) \
 54     (*((UINT32 *)(pchar)))
 55 #else
 56   /* these would work for i386 too, but less efficient */
 57 # define LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32) \
 58     (*(pchar)     = LOBYTE(LOWORD(uint32)), \
 59      *((pchar)+1) = HIBYTE(LOWORD(uint32)), \
 60      *((pchar)+2) = LOBYTE(HIWORD(uint32)), \
 61      *((pchar)+3) = HIBYTE(HIWORD(uint32)))
 62 
 63 # define LITTLE_ENDIAN_UINT32_READ(pchar) \
 64     (MAKELONG( \
 65       MAKEWORD(*(pchar), *((pchar)+1)), \
 66       MAKEWORD(*((pchar)+2), *((pchar)+3))))
 67 #endif
 68 
 69 #define BIG_ENDIAN_UINT32_WRITE(pchar, uint32) \
 70   (*((pchar)+3) = LOBYTE(LOWORD(uint32)), \
 71    *((pchar)+2) = HIBYTE(LOWORD(uint32)), \
 72    *((pchar)+1) = LOBYTE(HIWORD(uint32)), \
 73    *(pchar)     = HIBYTE(HIWORD(uint32)))
 74 
 75 #define BIG_ENDIAN_UINT32_READ(pchar) \
 76   (MAKELONG( \
 77     MAKEWORD(*((pchar)+3), *((pchar)+2)), \
 78     MAKEWORD(*((pchar)+1), *(pchar))))
 79 
 80 #ifdef NDR_LOCAL_IS_BIG_ENDIAN
 81 # define NDR_LOCAL_UINT32_WRITE(pchar, uint32) \
 82     BIG_ENDIAN_UINT32_WRITE(pchar, uint32)
 83 # define NDR_LOCAL_UINT32_READ(pchar) \
 84     BIG_ENDIAN_UINT32_READ(pchar)
 85 #else
 86 # define NDR_LOCAL_UINT32_WRITE(pchar, uint32) \
 87     LITTLE_ENDIAN_UINT32_WRITE(pchar, uint32)
 88 # define NDR_LOCAL_UINT32_READ(pchar) \
 89     LITTLE_ENDIAN_UINT32_READ(pchar)
 90 #endif
 91 
 92 /* _Align must be the desired alignment,
 93  * e.g. ALIGN_LENGTH(len, 4) to align on a dword boundary. */
 94 #define ALIGNED_LENGTH(_Len, _Align) (((_Len)+(_Align)-1)&~((_Align)-1))
 95 #define ALIGNED_POINTER(_Ptr, _Align) ((LPVOID)ALIGNED_LENGTH((ULONG_PTR)(_Ptr), _Align))
 96 #define ALIGN_LENGTH(_Len, _Align) _Len = ALIGNED_LENGTH(_Len, _Align)
 97 #define ALIGN_POINTER(_Ptr, _Align) _Ptr = ALIGNED_POINTER(_Ptr, _Align)
 98 #define ALIGN_POINTER_CLEAR(_Ptr, _Align) \
 99     do { \
100         memset((_Ptr), 0, ((_Align) - (ULONG_PTR)(_Ptr)) & ((_Align) - 1)); \
101         ALIGN_POINTER(_Ptr, _Align); \
102     } while(0)
103 
104 #define STD_OVERFLOW_CHECK(_Msg) do { \
105     TRACE("buffer=%d/%d\n", (ULONG)(_Msg->Buffer - (unsigned char *)_Msg->RpcMsg->Buffer), _Msg->BufferLength); \
106     if (_Msg->Buffer > (unsigned char *)_Msg->RpcMsg->Buffer + _Msg->BufferLength) \
107         ERR("buffer overflow %d bytes\n", (ULONG)(_Msg->Buffer - ((unsigned char *)_Msg->RpcMsg->Buffer + _Msg->BufferLength))); \
108   } while (0)
109 
110 #define NDR_POINTER_ID_BASE 0x20000
111 #define NDR_POINTER_ID(pStubMsg) (NDR_POINTER_ID_BASE + ((pStubMsg)->UniquePtrCount++) * 4)
112 #define NDR_TABLE_SIZE 128
113 #define NDR_TABLE_MASK 127
114 
115 static unsigned char *WINAPI NdrBaseTypeMarshall(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
116 static unsigned char *WINAPI NdrBaseTypeUnmarshall(PMIDL_STUB_MESSAGE, unsigned char **, PFORMAT_STRING, unsigned char);
117 static void WINAPI NdrBaseTypeBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
118 static void WINAPI NdrBaseTypeFree(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
119 static ULONG WINAPI NdrBaseTypeMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
120 
121 static unsigned char *WINAPI NdrContextHandleMarshall(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
122 static void WINAPI NdrContextHandleBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
123 static unsigned char *WINAPI NdrContextHandleUnmarshall(PMIDL_STUB_MESSAGE, unsigned char **, PFORMAT_STRING, unsigned char);
124 
125 static unsigned char *WINAPI NdrRangeMarshall(PMIDL_STUB_MESSAGE,unsigned char *, PFORMAT_STRING);
126 static void WINAPI NdrRangeBufferSize(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
127 static ULONG WINAPI NdrRangeMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
128 static void WINAPI NdrRangeFree(PMIDL_STUB_MESSAGE, unsigned char *, PFORMAT_STRING);
129 
130 static ULONG WINAPI NdrByteCountPointerMemorySize(PMIDL_STUB_MESSAGE, PFORMAT_STRING);
131 
132 const NDR_MARSHALL NdrMarshaller[NDR_TABLE_SIZE] = {
133   0,
134   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
135   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
136   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
137   NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall, NdrBaseTypeMarshall,
138   /* 0x10 */
139   NdrBaseTypeMarshall,
140   /* 0x11 */
141   NdrPointerMarshall, NdrPointerMarshall,
142   NdrPointerMarshall, NdrPointerMarshall,
143   /* 0x15 */
144   NdrSimpleStructMarshall, NdrSimpleStructMarshall,
145   NdrConformantStructMarshall, NdrConformantStructMarshall,
146   NdrConformantVaryingStructMarshall,
147   NdrComplexStructMarshall,
148   /* 0x1b */
149   NdrConformantArrayMarshall, 
150   NdrConformantVaryingArrayMarshall,
151   NdrFixedArrayMarshall, NdrFixedArrayMarshall,
152   NdrVaryingArrayMarshall, NdrVaryingArrayMarshall,
153   NdrComplexArrayMarshall,
154   /* 0x22 */
155   NdrConformantStringMarshall, 0, 0,
156   NdrConformantStringMarshall,
157   NdrNonConformantStringMarshall, 0, 0, 0,
158   /* 0x2a */
159   NdrEncapsulatedUnionMarshall,
160   NdrNonEncapsulatedUnionMarshall,
161   NdrByteCountPointerMarshall,
162   NdrXmitOrRepAsMarshall, NdrXmitOrRepAsMarshall,
163   /* 0x2f */
164   NdrInterfacePointerMarshall,
165   /* 0x30 */
166   NdrContextHandleMarshall,
167   /* 0xb1 */
168   0, 0, 0,
169   NdrUserMarshalMarshall,
170   0, 0,
171   /* 0xb7 */
172   NdrRangeMarshall
173 };
174 const NDR_UNMARSHALL NdrUnmarshaller[NDR_TABLE_SIZE] = {
175   0,
176   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
177   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
178   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
179   NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall, NdrBaseTypeUnmarshall,
180   /* 0x10 */
181   NdrBaseTypeUnmarshall,
182   /* 0x11 */
183   NdrPointerUnmarshall, NdrPointerUnmarshall,
184   NdrPointerUnmarshall, NdrPointerUnmarshall,
185   /* 0x15 */
186   NdrSimpleStructUnmarshall, NdrSimpleStructUnmarshall,
187   NdrConformantStructUnmarshall, NdrConformantStructUnmarshall,
188   NdrConformantVaryingStructUnmarshall,
189   NdrComplexStructUnmarshall,
190   /* 0x1b */
191   NdrConformantArrayUnmarshall, 
192   NdrConformantVaryingArrayUnmarshall,
193   NdrFixedArrayUnmarshall, NdrFixedArrayUnmarshall,
194   NdrVaryingArrayUnmarshall, NdrVaryingArrayUnmarshall,
195   NdrComplexArrayUnmarshall,
196   /* 0x22 */
197   NdrConformantStringUnmarshall, 0, 0,
198   NdrConformantStringUnmarshall,
199   NdrNonConformantStringUnmarshall, 0, 0, 0,
200   /* 0x2a */
201   NdrEncapsulatedUnionUnmarshall,
202   NdrNonEncapsulatedUnionUnmarshall,
203   NdrByteCountPointerUnmarshall,
204   NdrXmitOrRepAsUnmarshall, NdrXmitOrRepAsUnmarshall,
205   /* 0x2f */
206   NdrInterfacePointerUnmarshall,
207   /* 0x30 */
208   NdrContextHandleUnmarshall,
209   /* 0xb1 */
210   0, 0, 0,
211   NdrUserMarshalUnmarshall,
212   0, 0,
213   /* 0xb7 */
214   NdrRangeUnmarshall
215 };
216 const NDR_BUFFERSIZE NdrBufferSizer[NDR_TABLE_SIZE] = {
217   0,
218   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
219   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
220   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
221   NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize, NdrBaseTypeBufferSize,
222   /* 0x10 */
223   NdrBaseTypeBufferSize,
224   /* 0x11 */
225   NdrPointerBufferSize, NdrPointerBufferSize,
226   NdrPointerBufferSize, NdrPointerBufferSize,
227   /* 0x15 */
228   NdrSimpleStructBufferSize, NdrSimpleStructBufferSize,
229   NdrConformantStructBufferSize, NdrConformantStructBufferSize,
230   NdrConformantVaryingStructBufferSize,
231   NdrComplexStructBufferSize,
232   /* 0x1b */
233   NdrConformantArrayBufferSize, 
234   NdrConformantVaryingArrayBufferSize,
235   NdrFixedArrayBufferSize, NdrFixedArrayBufferSize,
236   NdrVaryingArrayBufferSize, NdrVaryingArrayBufferSize,
237   NdrComplexArrayBufferSize,
238   /* 0x22 */
239   NdrConformantStringBufferSize, 0, 0,
240   NdrConformantStringBufferSize,
241   NdrNonConformantStringBufferSize, 0, 0, 0,
242   /* 0x2a */
243   NdrEncapsulatedUnionBufferSize,
244   NdrNonEncapsulatedUnionBufferSize,
245   NdrByteCountPointerBufferSize,
246   NdrXmitOrRepAsBufferSize, NdrXmitOrRepAsBufferSize,
247   /* 0x2f */
248   NdrInterfacePointerBufferSize,
249   /* 0x30 */
250   NdrContextHandleBufferSize,
251   /* 0xb1 */
252   0, 0, 0,
253   NdrUserMarshalBufferSize,
254   0, 0,
255   /* 0xb7 */
256   NdrRangeBufferSize
257 };
258 const NDR_MEMORYSIZE NdrMemorySizer[NDR_TABLE_SIZE] = {
259   0,
260   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
261   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
262   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
263   NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize, NdrBaseTypeMemorySize,
264   /* 0x10 */
265   NdrBaseTypeMemorySize,
266   /* 0x11 */
267   NdrPointerMemorySize, NdrPointerMemorySize,
268   NdrPointerMemorySize, NdrPointerMemorySize,
269   /* 0x15 */
270   NdrSimpleStructMemorySize, NdrSimpleStructMemorySize,
271   NdrConformantStructMemorySize, NdrConformantStructMemorySize,
272   NdrConformantVaryingStructMemorySize,
273   NdrComplexStructMemorySize,
274   /* 0x1b */
275   NdrConformantArrayMemorySize,
276   NdrConformantVaryingArrayMemorySize,
277   NdrFixedArrayMemorySize, NdrFixedArrayMemorySize,
278   NdrVaryingArrayMemorySize, NdrVaryingArrayMemorySize,
279   NdrComplexArrayMemorySize,
280   /* 0x22 */
281   NdrConformantStringMemorySize, 0, 0,
282   NdrConformantStringMemorySize,
283   NdrNonConformantStringMemorySize, 0, 0, 0,
284   /* 0x2a */
285   NdrEncapsulatedUnionMemorySize,
286   NdrNonEncapsulatedUnionMemorySize,
287   NdrByteCountPointerMemorySize,
288   NdrXmitOrRepAsMemorySize, NdrXmitOrRepAsMemorySize,
289   /* 0x2f */
290   NdrInterfacePointerMemorySize,
291   /* 0x30 */
292   0,
293   /* 0xb1 */
294   0, 0, 0,
295   NdrUserMarshalMemorySize,
296   0, 0,
297   /* 0xb7 */
298   NdrRangeMemorySize
299 };
300 const NDR_FREE NdrFreer[NDR_TABLE_SIZE] = {
301   0,
302   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
303   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
304   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
305   NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree, NdrBaseTypeFree,
306   /* 0x10 */
307   NdrBaseTypeFree,
308   /* 0x11 */
309   NdrPointerFree, NdrPointerFree,
310   NdrPointerFree, NdrPointerFree,
311   /* 0x15 */
312   NdrSimpleStructFree, NdrSimpleStructFree,
313   NdrConformantStructFree, NdrConformantStructFree,
314   NdrConformantVaryingStructFree,
315   NdrComplexStructFree,
316   /* 0x1b */
317   NdrConformantArrayFree, 
318   NdrConformantVaryingArrayFree,
319   NdrFixedArrayFree, NdrFixedArrayFree,
320   NdrVaryingArrayFree, NdrVaryingArrayFree,
321   NdrComplexArrayFree,
322   /* 0x22 */
323   0, 0, 0,
324   0, 0, 0, 0, 0,
325   /* 0x2a */
326   NdrEncapsulatedUnionFree,
327   NdrNonEncapsulatedUnionFree,
328   0,
329   NdrXmitOrRepAsFree, NdrXmitOrRepAsFree,
330   /* 0x2f */
331   NdrInterfacePointerFree,
332   /* 0x30 */
333   0,
334   /* 0xb1 */
335   0, 0, 0,
336   NdrUserMarshalFree,
337   0, 0,
338   /* 0xb7 */
339   NdrRangeFree
340 };
341 
342 typedef struct _NDR_MEMORY_LIST
343 {
344     ULONG magic;
345     ULONG size;
346     ULONG reserved;
347     struct _NDR_MEMORY_LIST *next;
348 } NDR_MEMORY_LIST;
349 
350 #define MEML_MAGIC  ('M' << 24 | 'E' << 16 | 'M' << 8 | 'L')
351 
352 /***********************************************************************
353  *            NdrAllocate [RPCRT4.@]
354  *
355  * Allocates a block of memory using pStubMsg->pfnAllocate.
356  *
357  * PARAMS
358  *  pStubMsg [I/O] MIDL_STUB_MESSAGE structure.
359  *  len      [I]   Size of memory block to allocate.
360  *
361  * RETURNS
362  *  The memory block of size len that was allocated.
363  *
364  * NOTES
365  *  The memory block is always 8-byte aligned.
366  *  If the function is unable to allocate memory an ERROR_OUTOFMEMORY
367  *  exception is raised.
368  */
369 void * WINAPI NdrAllocate(MIDL_STUB_MESSAGE *pStubMsg, SIZE_T len)
370 {
371     SIZE_T aligned_len;
372     SIZE_T adjusted_len;
373     void *p;
374     NDR_MEMORY_LIST *mem_list;
375 
376     aligned_len = ALIGNED_LENGTH(len, 8);
377     adjusted_len = aligned_len + sizeof(NDR_MEMORY_LIST);
378     /* check for overflow */
379     if (adjusted_len < len)
380     {
381         ERR("overflow of adjusted_len %ld, len %ld\n", adjusted_len, len);
382         RpcRaiseException(RPC_X_BAD_STUB_DATA);
383     }
384 
385     p = pStubMsg->pfnAllocate(adjusted_len);
386     if (!p) RpcRaiseException(ERROR_OUTOFMEMORY);
387 
388     mem_list = (NDR_MEMORY_LIST *)((char *)p + aligned_len);
389     mem_list->magic = MEML_MAGIC;
390     mem_list->size = aligned_len;
391     mem_list->reserved = 0;
392     mem_list->next = pStubMsg->pMemoryList;
393     pStubMsg->pMemoryList = mem_list;
394 
395     TRACE("-- %p\n", p);
396     return p;
397 }
398 
399 static void NdrFree(MIDL_STUB_MESSAGE *pStubMsg, unsigned char *Pointer)
400 {
401     TRACE("(%p, %p)\n", pStubMsg, Pointer);
402 
403     pStubMsg->pfnFree(Pointer);
404 }
405 
406 static inline BOOL IsConformanceOrVariancePresent(PFORMAT_STRING pFormat)
407 {
408     return (*(const ULONG *)pFormat != -1);
409 }
410 
411 static PFORMAT_STRING ReadConformance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat)
412 {
413   ALIGN_POINTER(pStubMsg->Buffer, 4);
414   if (pStubMsg->Buffer + 4 > pStubMsg->BufferEnd)
415       RpcRaiseException(RPC_X_BAD_STUB_DATA);
416   pStubMsg->MaxCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
417   pStubMsg->Buffer += 4;
418   TRACE("unmarshalled conformance is %ld\n", pStubMsg->MaxCount);
419   if (pStubMsg->fHasNewCorrDesc)
420     return pFormat+6;
421   else
422     return pFormat+4;
423 }
424 
425 static inline PFORMAT_STRING ReadVariance(MIDL_STUB_MESSAGE *pStubMsg, PFORMAT_STRING pFormat, ULONG MaxValue)
426 {
427   if (pFormat && !IsConformanceOrVariancePresent(pFormat))
428   {
429     pStubMsg->Offset = 0;
430     pStubMsg->ActualCount = pStubMsg->MaxCount;
431     goto done;
432   }
433 
434   ALIGN_POINTER(pStubMsg->Buffer, 4);
435   if (pStubMsg->Buffer + 8 > pStubMsg->BufferEnd)
436     RpcRaiseException(RPC_X_BAD_STUB_DATA);
437   pStubMsg->Offset      = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
438   pStubMsg->Buffer += 4;
439   TRACE("offset is %d\n", pStubMsg->Offset);
440   pStubMsg->ActualCount = NDR_LOCAL_UINT32_READ(pStubMsg->Buffer);
441   pStubMsg->Buffer += 4;
442   TRACE("variance is %d\n", pStubMsg->ActualCount);
443 
444   if ((pStubMsg->ActualCount > MaxValue) ||
445       (pStubMsg->ActualCount + pStubMsg->Offset > MaxValue))
446   {
447     ERR("invalid array bound(s): ActualCount = %d, Offset = %d, MaxValue = %d\n",
448         pStubMsg->ActualCount, pStubMsg->Offset, MaxValue);
449     RpcRaiseException(RPC_S_INVALID_BOUND);
450     return NULL;
451   }
452 
453 done:
454   if (pStubMsg->fHasNewCorrDesc)
455     return pFormat+6;
456   else
457     return pFormat+4;
458 }
459 
460 /* writes the conformance value to the buffer */
461 static inline void WriteConformance(MIDL_STUB_MESSAGE *pStubMsg)
462 {
463     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
464     if (pStubMsg->Buffer + 4 > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength)
465         RpcRaiseException(RPC_X_BAD_STUB_DATA);
466     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->MaxCount);
467     pStubMsg->Buffer += 4;
468 }
469 
470 /* writes the variance values to the buffer */
471 static inline void WriteVariance(MIDL_STUB_MESSAGE *pStubMsg)
472 {
473     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
474     if (pStubMsg->Buffer + 8 > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength)
475         RpcRaiseException(RPC_X_BAD_STUB_DATA);
476     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->Offset);
477     pStubMsg->Buffer += 4;
478     NDR_LOCAL_UINT32_WRITE(pStubMsg->Buffer, pStubMsg->ActualCount);
479     pStubMsg->Buffer += 4;
480 }
481 
482 /* requests buffer space for the conformance value */
483 static inline void SizeConformance(MIDL_STUB_MESSAGE *pStubMsg)
484 {
485     ALIGN_LENGTH(pStubMsg->BufferLength, 4);
486     if (pStubMsg->BufferLength + 4 < pStubMsg->BufferLength)
487         RpcRaiseException(RPC_X_BAD_STUB_DATA);
488     pStubMsg->BufferLength += 4;
489 }
490 
491 /* requests buffer space for the variance values */
492 static inline void SizeVariance(MIDL_STUB_MESSAGE *pStubMsg)
493 {
494     ALIGN_LENGTH(pStubMsg->BufferLength, 4);
495     if (pStubMsg->BufferLength + 8 < pStubMsg->BufferLength)
496         RpcRaiseException(RPC_X_BAD_STUB_DATA);
497     pStubMsg->BufferLength += 8;
498 }
499 
500 PFORMAT_STRING ComputeConformanceOrVariance(
501     MIDL_STUB_MESSAGE *pStubMsg, unsigned char *pMemory,
502     PFORMAT_STRING pFormat, ULONG_PTR def, ULONG_PTR *pCount)
503 {
504   BYTE dtype = pFormat[0] & 0xf;
505   short ofs = *(const short *)&pFormat[2];
506   LPVOID ptr = NULL;
507   DWORD data = 0;
508 
509   if (!IsConformanceOrVariancePresent(pFormat)) {
510     /* null descriptor */
511     *pCount = def;
512     goto finish_conf;
513   }
514 
515   switch (pFormat[0] & 0xf0) {
516   case RPC_FC_NORMAL_CONFORMANCE:
517     TRACE("normal conformance, ofs=%d\n", ofs);
518     ptr = pMemory;
519     break;
520   case RPC_FC_POINTER_CONFORMANCE:
521     TRACE("pointer conformance, ofs=%d\n", ofs);
522     ptr = pStubMsg->Memory;
523     break;
524   case RPC_FC_TOP_LEVEL_CONFORMANCE:
525     TRACE("toplevel conformance, ofs=%d\n", ofs);
526     if (pStubMsg->StackTop) {
527       ptr = pStubMsg->StackTop;
528     }
529     else {
530       /* -Os mode, *pCount is already set */
531       goto finish_conf;
532     }
533     break;
534   case RPC_FC_CONSTANT_CONFORMANCE:
535     data = ofs | ((DWORD)pFormat[1] << 16);
536     TRACE("constant conformance, val=%d\n", data);
537     *pCount = data;
538     goto finish_conf;
539   case RPC_FC_TOP_LEVEL_MULTID_CONFORMANCE:
540     FIXME("toplevel multidimensional conformance, ofs=%d\n", ofs);
541     if (pStubMsg->StackTop) {
542       ptr = pStubMsg->StackTop;
543     }
544     else {
545       /* ? */
546       goto done_conf_grab;
547     }
548     break;
549   default:
550     FIXME("unknown conformance type %x\n", pFormat[0] & 0xf0);
551   }
552 
553   switch (pFormat[1]) {
554   case RPC_FC_DEREFERENCE:
555     ptr = *(LPVOID*)((char *)ptr + ofs);
556     break;
557   case RPC_FC_CALLBACK:
558   {
559     unsigned char *old_stack_top = pStubMsg->StackTop;
560     pStubMsg->StackTop = ptr;
561 
562     /* ofs is index into StubDesc->apfnExprEval */
563     TRACE("callback conformance into apfnExprEval[%d]\n", ofs);
564     pStubMsg->StubDesc->apfnExprEval[ofs](pStubMsg);
565 
566     pStubMsg->StackTop = old_stack_top;
567 
568     /* the callback function always stores the computed value in MaxCount */
569     *pCount = pStubMsg->MaxCount;
570     goto finish_conf;
571   }
572   default:
573     ptr = (char *)ptr + ofs;
574     break;
575   }
576 
577   switch (dtype) {
578   case RPC_FC_LONG:
579   case RPC_FC_ULONG:
580     data = *(DWORD*)ptr;
581     break;
582   case RPC_FC_SHORT:
583     data = *(SHORT*)ptr;
584     break;
585   case RPC_FC_USHORT:
586     data = *(USHORT*)ptr;
587     break;
588   case RPC_FC_CHAR:
589   case RPC_FC_SMALL:
590     data = *(CHAR*)ptr;
591     break;
592   case RPC_FC_BYTE:
593   case RPC_FC_USMALL:
594     data = *(UCHAR*)ptr;
595     break;
596   default:
597     FIXME("unknown conformance data type %x\n", dtype);
598     goto done_conf_grab;
599   }
600   TRACE("dereferenced data type %x at %p, got %d\n", dtype, ptr, data);
601 
602 done_conf_grab:
603   switch (pFormat[1]) {
604   case RPC_FC_DEREFERENCE: /* already handled */
605   case 0: /* no op */
606     *pCount = data;
607     break;
608   case RPC_FC_ADD_1:
609     *pCount = data + 1;
610     break;
611   case RPC_FC_SUB_1:
612     *pCount = data - 1;
613     break;
614   case RPC_FC_MULT_2:
615     *pCount = data * 2;
616     break;
617   case RPC_FC_DIV_2:
618     *pCount = data / 2;
619     break;
620   default:
621     FIXME("unknown conformance op %d\n", pFormat[1]);
622     goto finish_conf;
623   }
624 
625 finish_conf:
626   TRACE("resulting conformance is %ld\n", *pCount);
627   if (pStubMsg->fHasNewCorrDesc)
628     return pFormat+6;
629   else
630     return pFormat+4;
631 }
632 
633 static inline PFORMAT_STRING SkipConformance(PMIDL_STUB_MESSAGE pStubMsg,
634                                              PFORMAT_STRING pFormat)
635 {
636   if (IsConformanceOrVariancePresent(pFormat))
637   {
638     if (pStubMsg->fHasNewCorrDesc)
639       pFormat += 6;
640     else
641       pFormat += 4;
642   }
643   return pFormat;
644 }
645 
646 /* multiply two numbers together, raising an RPC_S_INVALID_BOUND exception if
647  * the result overflows 32-bits */
648 static inline ULONG safe_multiply(ULONG a, ULONG b)
649 {
650     ULONGLONG ret = (ULONGLONG)a * b;
651     if (ret > 0xffffffff)
652     {
653         RpcRaiseException(RPC_S_INVALID_BOUND);
654         return 0;
655     }
656     return ret;
657 }
658 
659 static inline void safe_buffer_increment(MIDL_STUB_MESSAGE *pStubMsg, ULONG size)
660 {
661     if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
662         (pStubMsg->Buffer + size > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength))
663         RpcRaiseException(RPC_X_BAD_STUB_DATA);
664     pStubMsg->Buffer += size;
665 }
666 
667 static inline void safe_buffer_length_increment(MIDL_STUB_MESSAGE *pStubMsg, ULONG size)
668 {
669     if (pStubMsg->BufferLength + size < pStubMsg->BufferLength) /* integer overflow of pStubMsg->BufferSize */
670     {
671         ERR("buffer length overflow - BufferLength = %u, size = %u\n",
672             pStubMsg->BufferLength, size);
673         RpcRaiseException(RPC_X_BAD_STUB_DATA);
674     }
675     pStubMsg->BufferLength += size;
676 }
677 
678 /* copies data from the buffer, checking that there is enough data in the buffer
679  * to do so */
680 static inline void safe_copy_from_buffer(MIDL_STUB_MESSAGE *pStubMsg, void *p, ULONG size)
681 {
682     if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
683         (pStubMsg->Buffer + size > pStubMsg->BufferEnd))
684     {
685         ERR("buffer overflow - Buffer = %p, BufferEnd = %p, size = %u\n",
686             pStubMsg->Buffer, pStubMsg->BufferEnd, size);
687         RpcRaiseException(RPC_X_BAD_STUB_DATA);
688     }
689     if (p == pStubMsg->Buffer)
690         ERR("pointer is the same as the buffer\n");
691     memcpy(p, pStubMsg->Buffer, size);
692     pStubMsg->Buffer += size;
693 }
694 
695 /* copies data to the buffer, checking that there is enough space to do so */
696 static inline void safe_copy_to_buffer(MIDL_STUB_MESSAGE *pStubMsg, const void *p, ULONG size)
697 {
698     if ((pStubMsg->Buffer + size < pStubMsg->Buffer) || /* integer overflow of pStubMsg->Buffer */
699         (pStubMsg->Buffer + size > (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength))
700     {
701         ERR("buffer overflow - Buffer = %p, BufferEnd = %p, size = %u\n",
702             pStubMsg->Buffer, (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength,
703             size);
704         RpcRaiseException(RPC_X_BAD_STUB_DATA);
705     }
706     memcpy(pStubMsg->Buffer, p, size);
707     pStubMsg->Buffer += size;
708 }
709 
710 /* verify that string data sitting in the buffer is valid and safe to
711  * unmarshall */
712 static void validate_string_data(MIDL_STUB_MESSAGE *pStubMsg, ULONG bufsize, ULONG esize)
713 {
714     ULONG i;
715 
716     /* verify the buffer is safe to access */
717     if ((pStubMsg->Buffer + bufsize < pStubMsg->Buffer) ||
718         (pStubMsg->Buffer + bufsize > pStubMsg->BufferEnd))
719     {
720         ERR("bufsize 0x%x exceeded buffer end %p of buffer %p\n", bufsize,
721             pStubMsg->BufferEnd, pStubMsg->Buffer);
722         RpcRaiseException(RPC_X_BAD_STUB_DATA);
723     }
724 
725     /* strings must always have null terminating bytes */
726     if (bufsize < esize)
727     {
728         ERR("invalid string length of %d\n", bufsize / esize);
729         RpcRaiseException(RPC_S_INVALID_BOUND);
730     }
731 
732     for (i = bufsize - esize; i < bufsize; i++)
733         if (pStubMsg->Buffer[i] != 0)
734         {
735             ERR("string not null-terminated at byte position %d, data is 0x%x\n",
736                 i, pStubMsg->Buffer[i]);
737             RpcRaiseException(RPC_S_INVALID_BOUND);
738         }
739 }
740 
741 static inline void dump_pointer_attr(unsigned char attr)
742 {
743     if (attr & RPC_FC_P_ALLOCALLNODES)
744         TRACE(" RPC_FC_P_ALLOCALLNODES");
745     if (attr & RPC_FC_P_DONTFREE)
746         TRACE(" RPC_FC_P_DONTFREE");
747     if (attr & RPC_FC_P_ONSTACK)
748         TRACE(" RPC_FC_P_ONSTACK");
749     if (attr & RPC_FC_P_SIMPLEPOINTER)
750         TRACE(" RPC_FC_P_SIMPLEPOINTER");
751     if (attr & RPC_FC_P_DEREF)
752         TRACE(" RPC_FC_P_DEREF");
753     TRACE("\n");
754 }
755 
756 /***********************************************************************
757  *           PointerMarshall [internal]
758  */
759 static void PointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
760                             unsigned char *Buffer,
761                             unsigned char *Pointer,
762                             PFORMAT_STRING pFormat)
763 {
764   unsigned type = pFormat[0], attr = pFormat[1];
765   PFORMAT_STRING desc;
766   NDR_MARSHALL m;
767   ULONG pointer_id;
768   int pointer_needs_marshaling;
769 
770   TRACE("(%p,%p,%p,%p)\n", pStubMsg, Buffer, Pointer, pFormat);
771   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
772   pFormat += 2;
773   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
774   else desc = pFormat + *(const SHORT*)pFormat;
775 
776   switch (type) {
777   case RPC_FC_RP: /* ref pointer (always non-null) */
778     if (!Pointer)
779     {
780       ERR("NULL ref pointer is not allowed\n");
781       RpcRaiseException(RPC_X_NULL_REF_POINTER);
782     }
783     pointer_needs_marshaling = 1;
784     break;
785   case RPC_FC_UP: /* unique pointer */
786   case RPC_FC_OP: /* object pointer - same as unique here */
787     if (Pointer)
788       pointer_needs_marshaling = 1;
789     else
790       pointer_needs_marshaling = 0;
791     pointer_id = Pointer ? NDR_POINTER_ID(pStubMsg) : 0;
792     TRACE("writing 0x%08x to buffer\n", pointer_id);
793     NDR_LOCAL_UINT32_WRITE(Buffer, pointer_id);
794     break;
795   case RPC_FC_FP:
796     pointer_needs_marshaling = !NdrFullPointerQueryPointer(
797       pStubMsg->FullPtrXlatTables, Pointer, 1, &pointer_id);
798     TRACE("writing 0x%08x to buffer\n", pointer_id);
799     NDR_LOCAL_UINT32_WRITE(Buffer, pointer_id);
800     break;
801   default:
802     FIXME("unhandled ptr type=%02x\n", type);
803     RpcRaiseException(RPC_X_BAD_STUB_DATA);
804     return;
805   }
806 
807   TRACE("calling marshaller for type 0x%x\n", (int)*desc);
808 
809   if (pointer_needs_marshaling) {
810     if (attr & RPC_FC_P_DEREF) {
811       Pointer = *(unsigned char**)Pointer;
812       TRACE("deref => %p\n", Pointer);
813     }
814     m = NdrMarshaller[*desc & NDR_TABLE_MASK];
815     if (m) m(pStubMsg, Pointer, desc);
816     else FIXME("no marshaller for data type=%02x\n", *desc);
817   }
818 
819   STD_OVERFLOW_CHECK(pStubMsg);
820 }
821 
822 /***********************************************************************
823  *           PointerUnmarshall [internal]
824  */
825 static void PointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
826                               unsigned char *Buffer,
827                               unsigned char **pPointer,
828                               unsigned char *pSrcPointer,
829                               PFORMAT_STRING pFormat,
830                               unsigned char fMustAlloc)
831 {
832   unsigned type = pFormat[0], attr = pFormat[1];
833   PFORMAT_STRING desc;
834   NDR_UNMARSHALL m;
835   DWORD pointer_id = 0;
836   int pointer_needs_unmarshaling;
837 
838   TRACE("(%p,%p,%p,%p,%p,%d)\n", pStubMsg, Buffer, pPointer, pSrcPointer, pFormat, fMustAlloc);
839   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
840   pFormat += 2;
841   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
842   else desc = pFormat + *(const SHORT*)pFormat;
843 
844   switch (type) {
845   case RPC_FC_RP: /* ref pointer (always non-null) */
846     pointer_needs_unmarshaling = 1;
847     break;
848   case RPC_FC_UP: /* unique pointer */
849     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
850     TRACE("pointer_id is 0x%08x\n", pointer_id);
851     if (pointer_id)
852       pointer_needs_unmarshaling = 1;
853     else {
854       *pPointer = NULL;
855       pointer_needs_unmarshaling = 0;
856     }
857     break;
858   case RPC_FC_OP: /* object pointer - we must free data before overwriting it */
859     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
860     TRACE("pointer_id is 0x%08x\n", pointer_id);
861     if (!fMustAlloc && pSrcPointer)
862     {
863         FIXME("free object pointer %p\n", pSrcPointer);
864         fMustAlloc = TRUE;
865     }
866     if (pointer_id)
867       pointer_needs_unmarshaling = 1;
868     else
869     {
870       *pPointer = NULL;    
871       pointer_needs_unmarshaling = 0;
872     }
873     break;
874   case RPC_FC_FP:
875     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
876     TRACE("pointer_id is 0x%08x\n", pointer_id);
877     pointer_needs_unmarshaling = !NdrFullPointerQueryRefId(
878       pStubMsg->FullPtrXlatTables, pointer_id, 1, (void **)pPointer);
879     break;
880   default:
881     FIXME("unhandled ptr type=%02x\n", type);
882     RpcRaiseException(RPC_X_BAD_STUB_DATA);
883     return;
884   }
885 
886   if (pointer_needs_unmarshaling) {
887     unsigned char *base_ptr_val = *pPointer;
888     unsigned char **current_ptr = pPointer;
889     if (pStubMsg->IsClient) {
890       TRACE("client\n");
891       /* if we aren't forcing allocation of memory then try to use the existing
892        * (source) pointer to unmarshall the data into so that [in,out]
893        * parameters behave correctly. it doesn't matter if the parameter is
894        * [out] only since in that case the pointer will be NULL. we force
895        * allocation when the source pointer is NULL here instead of in the type
896        * unmarshalling routine for the benefit of the deref code below */
897       if (!fMustAlloc) {
898         if (pSrcPointer) {
899           TRACE("setting *pPointer to %p\n", pSrcPointer);
900           *pPointer = base_ptr_val = pSrcPointer;
901         } else
902           fMustAlloc = TRUE;
903       }
904     } else {
905       TRACE("server\n");
906       /* the memory in a stub is never initialised, so we have to work out here
907        * whether we have to initialise it so we can use the optimisation of
908        * setting the pointer to the buffer, if possible, or set fMustAlloc to
909        * TRUE. */
910       if (attr & RPC_FC_P_DEREF) {
911         fMustAlloc = TRUE;
912       } else {
913         base_ptr_val = NULL;
914         *current_ptr = NULL;
915       }
916     }
917 
918     if (attr & RPC_FC_P_ALLOCALLNODES)
919         FIXME("RPC_FC_P_ALLOCALLNODES not implemented\n");
920 
921     if (attr & RPC_FC_P_DEREF) {
922       if (fMustAlloc) {
923         base_ptr_val = NdrAllocate(pStubMsg, sizeof(void *));
924         *pPointer = base_ptr_val;
925         current_ptr = (unsigned char **)base_ptr_val;
926       } else
927         current_ptr = *(unsigned char***)current_ptr;
928       TRACE("deref => %p\n", current_ptr);
929       if (!fMustAlloc && !*current_ptr) fMustAlloc = TRUE;
930     }
931     m = NdrUnmarshaller[*desc & NDR_TABLE_MASK];
932     if (m) m(pStubMsg, current_ptr, desc, fMustAlloc);
933     else FIXME("no unmarshaller for data type=%02x\n", *desc);
934 
935     if (type == RPC_FC_FP)
936       NdrFullPointerInsertRefId(pStubMsg->FullPtrXlatTables, pointer_id,
937                                 base_ptr_val);
938   }
939 
940   TRACE("pointer=%p\n", *pPointer);
941 }
942 
943 /***********************************************************************
944  *           PointerBufferSize [internal]
945  */
946 static void PointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
947                               unsigned char *Pointer,
948                               PFORMAT_STRING pFormat)
949 {
950   unsigned type = pFormat[0], attr = pFormat[1];
951   PFORMAT_STRING desc;
952   NDR_BUFFERSIZE m;
953   int pointer_needs_sizing;
954   ULONG pointer_id;
955 
956   TRACE("(%p,%p,%p)\n", pStubMsg, Pointer, pFormat);
957   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
958   pFormat += 2;
959   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
960   else desc = pFormat + *(const SHORT*)pFormat;
961 
962   switch (type) {
963   case RPC_FC_RP: /* ref pointer (always non-null) */
964     if (!Pointer)
965     {
966       ERR("NULL ref pointer is not allowed\n");
967       RpcRaiseException(RPC_X_NULL_REF_POINTER);
968     }
969     break;
970   case RPC_FC_OP:
971   case RPC_FC_UP:
972     /* NULL pointer has no further representation */
973     if (!Pointer)
974         return;
975     break;
976   case RPC_FC_FP:
977     pointer_needs_sizing = !NdrFullPointerQueryPointer(
978       pStubMsg->FullPtrXlatTables, Pointer, 0, &pointer_id);
979     if (!pointer_needs_sizing)
980       return;
981     break;
982   default:
983     FIXME("unhandled ptr type=%02x\n", type);
984     RpcRaiseException(RPC_X_BAD_STUB_DATA);
985     return;
986   }
987 
988   if (attr & RPC_FC_P_DEREF) {
989     Pointer = *(unsigned char**)Pointer;
990     TRACE("deref => %p\n", Pointer);
991   }
992 
993   m = NdrBufferSizer[*desc & NDR_TABLE_MASK];
994   if (m) m(pStubMsg, Pointer, desc);
995   else FIXME("no buffersizer for data type=%02x\n", *desc);
996 }
997 
998 /***********************************************************************
999  *           PointerMemorySize [internal]
1000  */
1001 static ULONG PointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1002                                unsigned char *Buffer, PFORMAT_STRING pFormat)
1003 {
1004   unsigned type = pFormat[0], attr = pFormat[1];
1005   PFORMAT_STRING desc;
1006   NDR_MEMORYSIZE m;
1007   DWORD pointer_id = 0;
1008   int pointer_needs_sizing;
1009 
1010   TRACE("(%p,%p,%p)\n", pStubMsg, Buffer, pFormat);
1011   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
1012   pFormat += 2;
1013   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
1014   else desc = pFormat + *(const SHORT*)pFormat;
1015 
1016   switch (type) {
1017   case RPC_FC_RP: /* ref pointer (always non-null) */
1018     pointer_needs_sizing = 1;
1019     break;
1020   case RPC_FC_UP: /* unique pointer */
1021   case RPC_FC_OP: /* object pointer - we must free data before overwriting it */
1022     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
1023     TRACE("pointer_id is 0x%08x\n", pointer_id);
1024     if (pointer_id)
1025       pointer_needs_sizing = 1;
1026     else
1027       pointer_needs_sizing = 0;
1028     break;
1029   case RPC_FC_FP:
1030   {
1031     void *pointer;
1032     pointer_id = NDR_LOCAL_UINT32_READ(Buffer);
1033     TRACE("pointer_id is 0x%08x\n", pointer_id);
1034     pointer_needs_sizing = !NdrFullPointerQueryRefId(
1035       pStubMsg->FullPtrXlatTables, pointer_id, 1, &pointer);
1036     break;
1037   }
1038   default:
1039     FIXME("unhandled ptr type=%02x\n", type);
1040     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1041     return 0;
1042   }
1043 
1044   if (attr & RPC_FC_P_DEREF) {
1045     ALIGN_LENGTH(pStubMsg->MemorySize, sizeof(void*));
1046     pStubMsg->MemorySize += sizeof(void*);
1047     TRACE("deref\n");
1048   }
1049 
1050   if (pointer_needs_sizing) {
1051     m = NdrMemorySizer[*desc & NDR_TABLE_MASK];
1052     if (m) m(pStubMsg, desc);
1053     else FIXME("no memorysizer for data type=%02x\n", *desc);
1054   }
1055 
1056   return pStubMsg->MemorySize;
1057 }
1058 
1059 /***********************************************************************
1060  *           PointerFree [internal]
1061  */
1062 static void PointerFree(PMIDL_STUB_MESSAGE pStubMsg,
1063                         unsigned char *Pointer,
1064                         PFORMAT_STRING pFormat)
1065 {
1066   unsigned type = pFormat[0], attr = pFormat[1];
1067   PFORMAT_STRING desc;
1068   NDR_FREE m;
1069   unsigned char *current_pointer = Pointer;
1070 
1071   TRACE("(%p,%p,%p)\n", pStubMsg, Pointer, pFormat);
1072   TRACE("type=0x%x, attr=", type); dump_pointer_attr(attr);
1073   if (attr & RPC_FC_P_DONTFREE) return;
1074   pFormat += 2;
1075   if (attr & RPC_FC_P_SIMPLEPOINTER) desc = pFormat;
1076   else desc = pFormat + *(const SHORT*)pFormat;
1077 
1078   if (!Pointer) return;
1079 
1080   if (type == RPC_FC_FP) {
1081     int pointer_needs_freeing = NdrFullPointerFree(
1082       pStubMsg->FullPtrXlatTables, Pointer);
1083     if (!pointer_needs_freeing)
1084       return;
1085   }
1086 
1087   if (attr & RPC_FC_P_DEREF) {
1088     current_pointer = *(unsigned char**)Pointer;
1089     TRACE("deref => %p\n", current_pointer);
1090   }
1091 
1092   m = NdrFreer[*desc & NDR_TABLE_MASK];
1093   if (m) m(pStubMsg, current_pointer, desc);
1094 
1095   /* this check stops us from trying to free buffer memory. we don't have to
1096    * worry about clients, since they won't call this function.
1097    * we don't have to check for the buffer being reallocated because
1098    * BufferStart and BufferEnd won't be reset when allocating memory for
1099    * sending the response. we don't have to check for the new buffer here as
1100    * it won't be used a type memory, only for buffer memory */
1101   if (Pointer >= pStubMsg->BufferStart && Pointer < pStubMsg->BufferEnd)
1102       goto notfree;
1103 
1104   if (attr & RPC_FC_P_ONSTACK) {
1105     TRACE("not freeing stack ptr %p\n", Pointer);
1106     return;
1107   }
1108   TRACE("freeing %p\n", Pointer);
1109   NdrFree(pStubMsg, Pointer);
1110   return;
1111 notfree:
1112   TRACE("not freeing %p\n", Pointer);
1113 }
1114 
1115 /***********************************************************************
1116  *           EmbeddedPointerMarshall
1117  */
1118 static unsigned char * EmbeddedPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
1119                                                unsigned char *pMemory,
1120                                                PFORMAT_STRING pFormat)
1121 {
1122   unsigned char *Mark = pStubMsg->BufferMark;
1123   unsigned rep, count, stride;
1124   unsigned i;
1125   unsigned char *saved_buffer = NULL;
1126 
1127   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1128 
1129   if (*pFormat != RPC_FC_PP) return NULL;
1130   pFormat += 2;
1131 
1132   if (pStubMsg->PointerBufferMark)
1133   {
1134     saved_buffer = pStubMsg->Buffer;
1135     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
1136     pStubMsg->PointerBufferMark = NULL;
1137   }
1138 
1139   while (pFormat[0] != RPC_FC_END) {
1140     switch (pFormat[0]) {
1141     default:
1142       FIXME("unknown repeat type %d\n", pFormat[0]);
1143     case RPC_FC_NO_REPEAT:
1144       rep = 1;
1145       stride = 0;
1146       count = 1;
1147       pFormat += 2;
1148       break;
1149     case RPC_FC_FIXED_REPEAT:
1150       rep = *(const WORD*)&pFormat[2];
1151       stride = *(const WORD*)&pFormat[4];
1152       count = *(const WORD*)&pFormat[8];
1153       pFormat += 10;
1154       break;
1155     case RPC_FC_VARIABLE_REPEAT:
1156       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1157       stride = *(const WORD*)&pFormat[2];
1158       count = *(const WORD*)&pFormat[6];
1159       pFormat += 8;
1160       break;
1161     }
1162     for (i = 0; i < rep; i++) {
1163       PFORMAT_STRING info = pFormat;
1164       unsigned char *membase = pMemory + (i * stride);
1165       unsigned char *bufbase = Mark + (i * stride);
1166       unsigned u;
1167 
1168       for (u=0; u<count; u++,info+=8) {
1169         unsigned char *memptr = membase + *(const SHORT*)&info[0];
1170         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
1171         unsigned char *saved_memory = pStubMsg->Memory;
1172 
1173         pStubMsg->Memory = pMemory;
1174         PointerMarshall(pStubMsg, bufptr, *(unsigned char**)memptr, info+4);
1175         pStubMsg->Memory = saved_memory;
1176       }
1177     }
1178     pFormat += 8 * count;
1179   }
1180 
1181   if (saved_buffer)
1182   {
1183     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
1184     pStubMsg->Buffer = saved_buffer;
1185   }
1186 
1187   STD_OVERFLOW_CHECK(pStubMsg);
1188 
1189   return NULL;
1190 }
1191 
1192 /***********************************************************************
1193  *           EmbeddedPointerUnmarshall
1194  */
1195 static unsigned char * EmbeddedPointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
1196                                                  unsigned char *pDstBuffer,
1197                                                  unsigned char *pSrcMemoryPtrs,
1198                                                  PFORMAT_STRING pFormat,
1199                                                  unsigned char fMustAlloc)
1200 {
1201   unsigned char *Mark = pStubMsg->BufferMark;
1202   unsigned rep, count, stride;
1203   unsigned i;
1204   unsigned char *saved_buffer = NULL;
1205 
1206   TRACE("(%p,%p,%p,%p,%d)\n", pStubMsg, pDstBuffer, pSrcMemoryPtrs, pFormat, fMustAlloc);
1207 
1208   if (*pFormat != RPC_FC_PP) return NULL;
1209   pFormat += 2;
1210 
1211   if (pStubMsg->PointerBufferMark)
1212   {
1213     saved_buffer = pStubMsg->Buffer;
1214     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
1215     pStubMsg->PointerBufferMark = NULL;
1216   }
1217 
1218   while (pFormat[0] != RPC_FC_END) {
1219     TRACE("pFormat[0] = 0x%x\n", pFormat[0]);
1220     switch (pFormat[0]) {
1221     default:
1222       FIXME("unknown repeat type %d\n", pFormat[0]);
1223     case RPC_FC_NO_REPEAT:
1224       rep = 1;
1225       stride = 0;
1226       count = 1;
1227       pFormat += 2;
1228       break;
1229     case RPC_FC_FIXED_REPEAT:
1230       rep = *(const WORD*)&pFormat[2];
1231       stride = *(const WORD*)&pFormat[4];
1232       count = *(const WORD*)&pFormat[8];
1233       pFormat += 10;
1234       break;
1235     case RPC_FC_VARIABLE_REPEAT:
1236       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1237       stride = *(const WORD*)&pFormat[2];
1238       count = *(const WORD*)&pFormat[6];
1239       pFormat += 8;
1240       break;
1241     }
1242     for (i = 0; i < rep; i++) {
1243       PFORMAT_STRING info = pFormat;
1244       unsigned char *bufdstbase = pDstBuffer + (i * stride);
1245       unsigned char *memsrcbase = pSrcMemoryPtrs + (i * stride);
1246       unsigned char *bufbase = Mark + (i * stride);
1247       unsigned u;
1248 
1249       for (u=0; u<count; u++,info+=8) {
1250         unsigned char **bufdstptr = (unsigned char **)(bufdstbase + *(const SHORT*)&info[2]);
1251         unsigned char **memsrcptr = (unsigned char **)(memsrcbase + *(const SHORT*)&info[0]);
1252         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
1253         PointerUnmarshall(pStubMsg, bufptr, bufdstptr, *memsrcptr, info+4, fMustAlloc);
1254       }
1255     }
1256     pFormat += 8 * count;
1257   }
1258 
1259   if (saved_buffer)
1260   {
1261     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
1262     pStubMsg->Buffer = saved_buffer;
1263   }
1264 
1265   return NULL;
1266 }
1267 
1268 /***********************************************************************
1269  *           EmbeddedPointerBufferSize
1270  */
1271 static void EmbeddedPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
1272                                       unsigned char *pMemory,
1273                                       PFORMAT_STRING pFormat)
1274 {
1275   unsigned rep, count, stride;
1276   unsigned i;
1277   ULONG saved_buffer_length = 0;
1278 
1279   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1280 
1281   if (pStubMsg->IgnoreEmbeddedPointers) return;
1282 
1283   if (*pFormat != RPC_FC_PP) return;
1284   pFormat += 2;
1285 
1286   if (pStubMsg->PointerLength)
1287   {
1288     saved_buffer_length = pStubMsg->BufferLength;
1289     pStubMsg->BufferLength = pStubMsg->PointerLength;
1290     pStubMsg->PointerLength = 0;
1291   }
1292 
1293   while (pFormat[0] != RPC_FC_END) {
1294     switch (pFormat[0]) {
1295     default:
1296       FIXME("unknown repeat type %d\n", pFormat[0]);
1297     case RPC_FC_NO_REPEAT:
1298       rep = 1;
1299       stride = 0;
1300       count = 1;
1301       pFormat += 2;
1302       break;
1303     case RPC_FC_FIXED_REPEAT:
1304       rep = *(const WORD*)&pFormat[2];
1305       stride = *(const WORD*)&pFormat[4];
1306       count = *(const WORD*)&pFormat[8];
1307       pFormat += 10;
1308       break;
1309     case RPC_FC_VARIABLE_REPEAT:
1310       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1311       stride = *(const WORD*)&pFormat[2];
1312       count = *(const WORD*)&pFormat[6];
1313       pFormat += 8;
1314       break;
1315     }
1316     for (i = 0; i < rep; i++) {
1317       PFORMAT_STRING info = pFormat;
1318       unsigned char *membase = pMemory + (i * stride);
1319       unsigned u;
1320 
1321       for (u=0; u<count; u++,info+=8) {
1322         unsigned char *memptr = membase + *(const SHORT*)&info[0];
1323         unsigned char *saved_memory = pStubMsg->Memory;
1324 
1325         pStubMsg->Memory = pMemory;
1326         PointerBufferSize(pStubMsg, *(unsigned char**)memptr, info+4);
1327         pStubMsg->Memory = saved_memory;
1328       }
1329     }
1330     pFormat += 8 * count;
1331   }
1332 
1333   if (saved_buffer_length)
1334   {
1335     pStubMsg->PointerLength = pStubMsg->BufferLength;
1336     pStubMsg->BufferLength = saved_buffer_length;
1337   }
1338 }
1339 
1340 /***********************************************************************
1341  *           EmbeddedPointerMemorySize [internal]
1342  */
1343 static ULONG EmbeddedPointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1344                                        PFORMAT_STRING pFormat)
1345 {
1346   unsigned char *Mark = pStubMsg->BufferMark;
1347   unsigned rep, count, stride;
1348   unsigned i;
1349   unsigned char *saved_buffer = NULL;
1350 
1351   TRACE("(%p,%p)\n", pStubMsg, pFormat);
1352 
1353   if (pStubMsg->IgnoreEmbeddedPointers) return 0;
1354 
1355   if (pStubMsg->PointerBufferMark)
1356   {
1357     saved_buffer = pStubMsg->Buffer;
1358     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
1359     pStubMsg->PointerBufferMark = NULL;
1360   }
1361 
1362   if (*pFormat != RPC_FC_PP) return 0;
1363   pFormat += 2;
1364 
1365   while (pFormat[0] != RPC_FC_END) {
1366     switch (pFormat[0]) {
1367     default:
1368       FIXME("unknown repeat type %d\n", pFormat[0]);
1369     case RPC_FC_NO_REPEAT:
1370       rep = 1;
1371       stride = 0;
1372       count = 1;
1373       pFormat += 2;
1374       break;
1375     case RPC_FC_FIXED_REPEAT:
1376       rep = *(const WORD*)&pFormat[2];
1377       stride = *(const WORD*)&pFormat[4];
1378       count = *(const WORD*)&pFormat[8];
1379       pFormat += 10;
1380       break;
1381     case RPC_FC_VARIABLE_REPEAT:
1382       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1383       stride = *(const WORD*)&pFormat[2];
1384       count = *(const WORD*)&pFormat[6];
1385       pFormat += 8;
1386       break;
1387     }
1388     for (i = 0; i < rep; i++) {
1389       PFORMAT_STRING info = pFormat;
1390       unsigned char *bufbase = Mark + (i * stride);
1391       unsigned u;
1392       for (u=0; u<count; u++,info+=8) {
1393         unsigned char *bufptr = bufbase + *(const SHORT*)&info[2];
1394         PointerMemorySize(pStubMsg, bufptr, info+4);
1395       }
1396     }
1397     pFormat += 8 * count;
1398   }
1399 
1400   if (saved_buffer)
1401   {
1402     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
1403     pStubMsg->Buffer = saved_buffer;
1404   }
1405 
1406   return 0;
1407 }
1408 
1409 /***********************************************************************
1410  *           EmbeddedPointerFree [internal]
1411  */
1412 static void EmbeddedPointerFree(PMIDL_STUB_MESSAGE pStubMsg,
1413                                 unsigned char *pMemory,
1414                                 PFORMAT_STRING pFormat)
1415 {
1416   unsigned rep, count, stride;
1417   unsigned i;
1418 
1419   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1420   if (*pFormat != RPC_FC_PP) return;
1421   pFormat += 2;
1422 
1423   while (pFormat[0] != RPC_FC_END) {
1424     switch (pFormat[0]) {
1425     default:
1426       FIXME("unknown repeat type %d\n", pFormat[0]);
1427     case RPC_FC_NO_REPEAT:
1428       rep = 1;
1429       stride = 0;
1430       count = 1;
1431       pFormat += 2;
1432       break;
1433     case RPC_FC_FIXED_REPEAT:
1434       rep = *(const WORD*)&pFormat[2];
1435       stride = *(const WORD*)&pFormat[4];
1436       count = *(const WORD*)&pFormat[8];
1437       pFormat += 10;
1438       break;
1439     case RPC_FC_VARIABLE_REPEAT:
1440       rep = (pFormat[1] == RPC_FC_VARIABLE_OFFSET) ? pStubMsg->ActualCount : pStubMsg->MaxCount;
1441       stride = *(const WORD*)&pFormat[2];
1442       count = *(const WORD*)&pFormat[6];
1443       pFormat += 8;
1444       break;
1445     }
1446     for (i = 0; i < rep; i++) {
1447       PFORMAT_STRING info = pFormat;
1448       unsigned char *membase = pMemory + (i * stride);
1449       unsigned u;
1450 
1451       for (u=0; u<count; u++,info+=8) {
1452         unsigned char *memptr = membase + *(const SHORT*)&info[0];
1453         unsigned char *saved_memory = pStubMsg->Memory;
1454 
1455         pStubMsg->Memory = pMemory;
1456         PointerFree(pStubMsg, *(unsigned char**)memptr, info+4);
1457         pStubMsg->Memory = saved_memory;
1458       }
1459     }
1460     pFormat += 8 * count;
1461   }
1462 }
1463 
1464 /***********************************************************************
1465  *           NdrPointerMarshall [RPCRT4.@]
1466  */
1467 unsigned char * WINAPI NdrPointerMarshall(PMIDL_STUB_MESSAGE pStubMsg,
1468                                           unsigned char *pMemory,
1469                                           PFORMAT_STRING pFormat)
1470 {
1471   unsigned char *Buffer;
1472 
1473   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1474 
1475   /* Increment the buffer here instead of in PointerMarshall,
1476    * as that is used by embedded pointers which already handle the incrementing
1477    * the buffer, and shouldn't write any additional pointer data to the wire */
1478   if (*pFormat != RPC_FC_RP)
1479   {
1480     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
1481     Buffer = pStubMsg->Buffer;
1482     safe_buffer_increment(pStubMsg, 4);
1483   }
1484   else
1485     Buffer = pStubMsg->Buffer;
1486 
1487   PointerMarshall(pStubMsg, Buffer, pMemory, pFormat);
1488 
1489   return NULL;
1490 }
1491 
1492 /***********************************************************************
1493  *           NdrPointerUnmarshall [RPCRT4.@]
1494  */
1495 unsigned char * WINAPI NdrPointerUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
1496                                             unsigned char **ppMemory,
1497                                             PFORMAT_STRING pFormat,
1498                                             unsigned char fMustAlloc)
1499 {
1500   unsigned char *Buffer;
1501 
1502   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
1503 
1504   if (*pFormat == RPC_FC_RP)
1505   {
1506     Buffer = pStubMsg->Buffer;
1507     /* Do the NULL ref pointer check here because embedded pointers can be
1508      * NULL if the type the pointer is embedded in was allocated rather than
1509      * being passed in by the client */
1510     if (pStubMsg->IsClient && !*ppMemory)
1511     {
1512       ERR("NULL ref pointer is not allowed\n");
1513       RpcRaiseException(RPC_X_NULL_REF_POINTER);
1514     }
1515   }
1516   else
1517   {
1518     /* Increment the buffer here instead of in PointerUnmarshall,
1519      * as that is used by embedded pointers which already handle the incrementing
1520      * the buffer, and shouldn't read any additional pointer data from the
1521      * buffer */
1522     ALIGN_POINTER(pStubMsg->Buffer, 4);
1523     Buffer = pStubMsg->Buffer;
1524     safe_buffer_increment(pStubMsg, 4);
1525   }
1526 
1527   PointerUnmarshall(pStubMsg, Buffer, ppMemory, *ppMemory, pFormat, fMustAlloc);
1528 
1529   return NULL;
1530 }
1531 
1532 /***********************************************************************
1533  *           NdrPointerBufferSize [RPCRT4.@]
1534  */
1535 void WINAPI NdrPointerBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
1536                                       unsigned char *pMemory,
1537                                       PFORMAT_STRING pFormat)
1538 {
1539   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1540 
1541   /* Increment the buffer length here instead of in PointerBufferSize,
1542    * as that is used by embedded pointers which already handle the buffer
1543    * length, and shouldn't write anything more to the wire */
1544   if (*pFormat != RPC_FC_RP)
1545   {
1546     ALIGN_LENGTH(pStubMsg->BufferLength, 4);
1547     safe_buffer_length_increment(pStubMsg, 4);
1548   }
1549 
1550   PointerBufferSize(pStubMsg, pMemory, pFormat);
1551 }
1552 
1553 /***********************************************************************
1554  *           NdrPointerMemorySize [RPCRT4.@]
1555  */
1556 ULONG WINAPI NdrPointerMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1557                                   PFORMAT_STRING pFormat)
1558 {
1559     unsigned char *Buffer = pStubMsg->Buffer;
1560     if (*pFormat != RPC_FC_RP)
1561     {
1562         ALIGN_POINTER(pStubMsg->Buffer, 4);
1563         safe_buffer_increment(pStubMsg, 4);
1564     }
1565     ALIGN_LENGTH(pStubMsg->MemorySize, sizeof(void *));
1566     return PointerMemorySize(pStubMsg, Buffer, pFormat);
1567 }
1568 
1569 /***********************************************************************
1570  *           NdrPointerFree [RPCRT4.@]
1571  */
1572 void WINAPI NdrPointerFree(PMIDL_STUB_MESSAGE pStubMsg,
1573                            unsigned char *pMemory,
1574                            PFORMAT_STRING pFormat)
1575 {
1576   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1577   PointerFree(pStubMsg, pMemory, pFormat);
1578 }
1579 
1580 /***********************************************************************
1581  *           NdrSimpleTypeMarshall [RPCRT4.@]
1582  */
1583 void WINAPI NdrSimpleTypeMarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory,
1584                                    unsigned char FormatChar )
1585 {
1586     NdrBaseTypeMarshall(pStubMsg, pMemory, &FormatChar);
1587 }
1588 
1589 /***********************************************************************
1590  *           NdrSimpleTypeUnmarshall [RPCRT4.@]
1591  *
1592  * Unmarshall a base type.
1593  *
1594  * NOTES
1595  *  Doesn't check that the buffer is long enough before copying, so the caller
1596  * should do this.
1597  */
1598 void WINAPI NdrSimpleTypeUnmarshall( PMIDL_STUB_MESSAGE pStubMsg, unsigned char* pMemory,
1599                                      unsigned char FormatChar )
1600 {
1601 #define BASE_TYPE_UNMARSHALL(type) \
1602         ALIGN_POINTER(pStubMsg->Buffer, sizeof(type)); \
1603         TRACE("pMemory: %p\n", pMemory); \
1604         *(type *)pMemory = *(type *)pStubMsg->Buffer; \
1605         pStubMsg->Buffer += sizeof(type);
1606 
1607     switch(FormatChar)
1608     {
1609     case RPC_FC_BYTE:
1610     case RPC_FC_CHAR:
1611     case RPC_FC_SMALL:
1612     case RPC_FC_USMALL:
1613         BASE_TYPE_UNMARSHALL(UCHAR);
1614         TRACE("value: 0x%02x\n", *pMemory);
1615         break;
1616     case RPC_FC_WCHAR:
1617     case RPC_FC_SHORT:
1618     case RPC_FC_USHORT:
1619         BASE_TYPE_UNMARSHALL(USHORT);
1620         TRACE("value: 0x%04x\n", *(USHORT *)pMemory);
1621         break;
1622     case RPC_FC_LONG:
1623     case RPC_FC_ULONG:
1624     case RPC_FC_ERROR_STATUS_T:
1625     case RPC_FC_ENUM32:
1626         BASE_TYPE_UNMARSHALL(ULONG);
1627         TRACE("value: 0x%08x\n", *(ULONG *)pMemory);
1628         break;
1629    case RPC_FC_FLOAT:
1630         BASE_TYPE_UNMARSHALL(float);
1631         TRACE("value: %f\n", *(float *)pMemory);
1632         break;
1633     case RPC_FC_DOUBLE:
1634         BASE_TYPE_UNMARSHALL(double);
1635         TRACE("value: %f\n", *(double *)pMemory);
1636         break;
1637     case RPC_FC_HYPER:
1638         BASE_TYPE_UNMARSHALL(ULONGLONG);
1639         TRACE("value: %s\n", wine_dbgstr_longlong(*(ULONGLONG *)pMemory));
1640         break;
1641     case RPC_FC_ENUM16:
1642         ALIGN_POINTER(pStubMsg->Buffer, sizeof(USHORT));
1643         TRACE("pMemory: %p\n", pMemory);
1644         /* 16-bits on the wire, but int in memory */
1645         *(UINT *)pMemory = *(USHORT *)pStubMsg->Buffer;
1646         pStubMsg->Buffer += sizeof(USHORT);
1647         TRACE("value: 0x%08x\n", *(UINT *)pMemory);
1648         break;
1649     case RPC_FC_IGNORE:
1650         break;
1651     default:
1652         FIXME("Unhandled base type: 0x%02x\n", FormatChar);
1653     }
1654 #undef BASE_TYPE_UNMARSHALL
1655 }
1656 
1657 /***********************************************************************
1658  *           NdrSimpleStructMarshall [RPCRT4.@]
1659  */
1660 unsigned char * WINAPI NdrSimpleStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
1661                                                unsigned char *pMemory,
1662                                                PFORMAT_STRING pFormat)
1663 {
1664   unsigned size = *(const WORD*)(pFormat+2);
1665   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1666 
1667   ALIGN_POINTER_CLEAR(pStubMsg->Buffer, pFormat[1] + 1);
1668 
1669   pStubMsg->BufferMark = pStubMsg->Buffer;
1670   safe_copy_to_buffer(pStubMsg, pMemory, size);
1671 
1672   if (pFormat[0] != RPC_FC_STRUCT)
1673     EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat+4);
1674 
1675   return NULL;
1676 }
1677 
1678 /***********************************************************************
1679  *           NdrSimpleStructUnmarshall [RPCRT4.@]
1680  */
1681 unsigned char * WINAPI NdrSimpleStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
1682                                                  unsigned char **ppMemory,
1683                                                  PFORMAT_STRING pFormat,
1684                                                  unsigned char fMustAlloc)
1685 {
1686   unsigned size = *(const WORD*)(pFormat+2);
1687   unsigned char *saved_buffer;
1688   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
1689 
1690   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
1691 
1692   if (fMustAlloc)
1693     *ppMemory = NdrAllocate(pStubMsg, size);
1694   else
1695   {
1696     if (!pStubMsg->IsClient && !*ppMemory)
1697       /* for servers, we just point straight into the RPC buffer */
1698       *ppMemory = pStubMsg->Buffer;
1699   }
1700 
1701   saved_buffer = pStubMsg->BufferMark = pStubMsg->Buffer;
1702   safe_buffer_increment(pStubMsg, size);
1703   if (pFormat[0] == RPC_FC_PSTRUCT)
1704       EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat+4, fMustAlloc);
1705 
1706   TRACE("copying %p to %p\n", saved_buffer, *ppMemory);
1707   if (*ppMemory != saved_buffer)
1708       memcpy(*ppMemory, saved_buffer, size);
1709 
1710   return NULL;
1711 }
1712 
1713 /***********************************************************************
1714  *           NdrSimpleStructBufferSize [RPCRT4.@]
1715  */
1716 void WINAPI NdrSimpleStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
1717                                       unsigned char *pMemory,
1718                                       PFORMAT_STRING pFormat)
1719 {
1720   unsigned size = *(const WORD*)(pFormat+2);
1721   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1722 
1723   ALIGN_LENGTH(pStubMsg->BufferLength, pFormat[1] + 1);
1724 
1725   safe_buffer_length_increment(pStubMsg, size);
1726   if (pFormat[0] != RPC_FC_STRUCT)
1727     EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat+4);
1728 }
1729 
1730 /***********************************************************************
1731  *           NdrSimpleStructMemorySize [RPCRT4.@]
1732  */
1733 ULONG WINAPI NdrSimpleStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
1734                                        PFORMAT_STRING pFormat)
1735 {
1736   unsigned short size = *(const WORD *)(pFormat+2);
1737 
1738   TRACE("(%p,%p)\n", pStubMsg, pFormat);
1739 
1740   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
1741   pStubMsg->MemorySize += size;
1742   safe_buffer_increment(pStubMsg, size);
1743 
1744   if (pFormat[0] != RPC_FC_STRUCT)
1745     EmbeddedPointerMemorySize(pStubMsg, pFormat+4);
1746   return pStubMsg->MemorySize;
1747 }
1748 
1749 /***********************************************************************
1750  *           NdrSimpleStructFree [RPCRT4.@]
1751  */
1752 void WINAPI NdrSimpleStructFree(PMIDL_STUB_MESSAGE pStubMsg,
1753                                 unsigned char *pMemory,
1754                                 PFORMAT_STRING pFormat)
1755 {
1756   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
1757   if (pFormat[0] != RPC_FC_STRUCT)
1758     EmbeddedPointerFree(pStubMsg, pMemory, pFormat+4);
1759 }
1760 
1761 /* Array helpers */
1762 
1763 static inline void array_compute_and_size_conformance(
1764     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1765     PFORMAT_STRING pFormat)
1766 {
1767   switch (fc)
1768   {
1769   case RPC_FC_CARRAY:
1770     ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
1771     SizeConformance(pStubMsg);
1772     break;
1773   case RPC_FC_CVARRAY:
1774     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, 0);
1775     pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
1776     SizeConformance(pStubMsg);
1777     break;
1778   case RPC_FC_C_CSTRING:
1779   case RPC_FC_C_WSTRING:
1780     if (pFormat[0] == RPC_FC_C_CSTRING)
1781     {
1782       TRACE("string=%s\n", debugstr_a((const char *)pMemory));
1783       pStubMsg->ActualCount = strlen((const char *)pMemory)+1;
1784     }
1785     else
1786     {
1787       TRACE("string=%s\n", debugstr_w((LPCWSTR)pMemory));
1788       pStubMsg->ActualCount = strlenW((LPCWSTR)pMemory)+1;
1789     }
1790 
1791     if (fc == RPC_FC_STRING_SIZED)
1792       pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0);
1793     else
1794       pStubMsg->MaxCount = pStubMsg->ActualCount;
1795 
1796     SizeConformance(pStubMsg);
1797     break;
1798   default:
1799     ERR("unknown array format 0x%x\n", fc);
1800     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1801   }
1802 }
1803 
1804 static inline void array_buffer_size(
1805     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1806     PFORMAT_STRING pFormat, unsigned char fHasPointers)
1807 {
1808   DWORD size;
1809   DWORD esize;
1810   unsigned char alignment;
1811 
1812   switch (fc)
1813   {
1814   case RPC_FC_CARRAY:
1815     esize = *(const WORD*)(pFormat+2);
1816     alignment = pFormat[1] + 1;
1817 
1818     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1819 
1820     ALIGN_LENGTH(pStubMsg->BufferLength, alignment);
1821 
1822     size = safe_multiply(esize, pStubMsg->MaxCount);
1823     /* conformance value plus array */
1824     safe_buffer_length_increment(pStubMsg, size);
1825 
1826     if (fHasPointers)
1827       EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat);
1828     break;
1829   case RPC_FC_CVARRAY:
1830     esize = *(const WORD*)(pFormat+2);
1831     alignment = pFormat[1] + 1;
1832 
1833     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1834     pFormat = SkipConformance(pStubMsg, pFormat);
1835 
1836     SizeVariance(pStubMsg);
1837 
1838     ALIGN_LENGTH(pStubMsg->BufferLength, alignment);
1839 
1840     size = safe_multiply(esize, pStubMsg->ActualCount);
1841     safe_buffer_length_increment(pStubMsg, size);
1842 
1843     if (fHasPointers)
1844       EmbeddedPointerBufferSize(pStubMsg, pMemory, pFormat);
1845     break;
1846   case RPC_FC_C_CSTRING:
1847   case RPC_FC_C_WSTRING:
1848     if (fc == RPC_FC_C_CSTRING)
1849       esize = 1;
1850     else
1851       esize = 2;
1852 
1853     SizeVariance(pStubMsg);
1854 
1855     size = safe_multiply(esize, pStubMsg->ActualCount);
1856     safe_buffer_length_increment(pStubMsg, size);
1857     break;
1858   default:
1859     ERR("unknown array format 0x%x\n", fc);
1860     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1861   }
1862 }
1863 
1864 static inline void array_compute_and_write_conformance(
1865     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1866     PFORMAT_STRING pFormat)
1867 {
1868   switch (fc)
1869   {
1870   case RPC_FC_CARRAY:
1871     ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
1872     WriteConformance(pStubMsg);
1873     break;
1874   case RPC_FC_CVARRAY:
1875     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 4, 0);
1876     pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
1877     WriteConformance(pStubMsg);
1878     break;
1879   case RPC_FC_C_CSTRING:
1880   case RPC_FC_C_WSTRING:
1881     if (fc == RPC_FC_C_CSTRING)
1882     {
1883       TRACE("string=%s\n", debugstr_a((const char *)pMemory));
1884       pStubMsg->ActualCount = strlen((const char *)pMemory)+1;
1885     }
1886     else
1887     {
1888       TRACE("string=%s\n", debugstr_w((LPCWSTR)pMemory));
1889       pStubMsg->ActualCount = strlenW((LPCWSTR)pMemory)+1;
1890     }
1891     if (pFormat[1] == RPC_FC_STRING_SIZED)
1892       pFormat = ComputeConformance(pStubMsg, pMemory, pFormat + 2, 0);
1893     else
1894       pStubMsg->MaxCount = pStubMsg->ActualCount;
1895     pStubMsg->Offset = 0;
1896     WriteConformance(pStubMsg);
1897     break;
1898   default:
1899     ERR("unknown array format 0x%x\n", fc);
1900     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1901   }
1902 }
1903 
1904 static inline void array_write_variance_and_marshall(
1905     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char *pMemory,
1906     PFORMAT_STRING pFormat, unsigned char fHasPointers)
1907 {
1908   DWORD size;
1909   DWORD esize;
1910   unsigned char alignment;
1911 
1912   switch (fc)
1913   {
1914   case RPC_FC_CARRAY:
1915     esize = *(const WORD*)(pFormat+2);
1916     alignment = pFormat[1] + 1;
1917 
1918     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1919 
1920     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, alignment);
1921 
1922     size = safe_multiply(esize, pStubMsg->MaxCount);
1923     if (fHasPointers)
1924       pStubMsg->BufferMark = pStubMsg->Buffer;
1925     safe_copy_to_buffer(pStubMsg, pMemory, size);
1926 
1927     if (fHasPointers)
1928       EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat);
1929     break;
1930   case RPC_FC_CVARRAY:
1931     esize = *(const WORD*)(pFormat+2);
1932     alignment = pFormat[1] + 1;
1933 
1934     /* conformance */
1935     pFormat = SkipConformance(pStubMsg, pFormat + 4);
1936     /* variance */
1937     pFormat = SkipConformance(pStubMsg, pFormat);
1938 
1939     WriteVariance(pStubMsg);
1940 
1941     ALIGN_POINTER_CLEAR(pStubMsg->Buffer, alignment);
1942 
1943     size = safe_multiply(esize, pStubMsg->ActualCount);
1944 
1945     if (fHasPointers)
1946       pStubMsg->BufferMark = pStubMsg->Buffer;
1947     safe_copy_to_buffer(pStubMsg, pMemory + pStubMsg->Offset, size);
1948 
1949     if (fHasPointers)
1950       EmbeddedPointerMarshall(pStubMsg, pMemory, pFormat);
1951     break;
1952   case RPC_FC_C_CSTRING:
1953   case RPC_FC_C_WSTRING:
1954     if (fc == RPC_FC_C_CSTRING)
1955       esize = 1;
1956     else
1957       esize = 2;
1958 
1959     WriteVariance(pStubMsg);
1960 
1961     size = safe_multiply(esize, pStubMsg->ActualCount);
1962     safe_copy_to_buffer(pStubMsg, pMemory, size); /* the string itself */
1963     break;
1964   default:
1965     ERR("unknown array format 0x%x\n", fc);
1966     RpcRaiseException(RPC_X_BAD_STUB_DATA);
1967   }
1968 }
1969 
1970 static inline ULONG array_read_conformance(
1971     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
1972 {
1973   DWORD esize;
1974 
1975   switch (fc)
1976   {
1977   case RPC_FC_CARRAY:
1978     esize = *(const WORD*)(pFormat+2);
1979     pFormat = ReadConformance(pStubMsg, pFormat+4);
1980     return safe_multiply(esize, pStubMsg->MaxCount);
1981   case RPC_FC_CVARRAY:
1982     esize = *(const WORD*)(pFormat+2);
1983     pFormat = ReadConformance(pStubMsg, pFormat+4);
1984     return safe_multiply(esize, pStubMsg->MaxCount);
1985   case RPC_FC_C_CSTRING:
1986   case RPC_FC_C_WSTRING:
1987     if (fc == RPC_FC_C_CSTRING)
1988       esize = 1;
1989     else
1990       esize = 2;
1991 
1992     if (pFormat[1] == RPC_FC_STRING_SIZED)
1993       ReadConformance(pStubMsg, pFormat + 2);
1994     else
1995       ReadConformance(pStubMsg, NULL);
1996     return safe_multiply(esize, pStubMsg->MaxCount);
1997   default:
1998     ERR("unknown array format 0x%x\n", fc);
1999     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2000   }
2001 }
2002 
2003 static inline ULONG array_read_variance_and_unmarshall(
2004     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, unsigned char **ppMemory,
2005     PFORMAT_STRING pFormat, unsigned char fMustAlloc,
2006     unsigned char fUseBufferMemoryServer, unsigned char fUnmarshall)
2007 {
2008   ULONG bufsize, memsize;
2009   WORD esize;
2010   unsigned char alignment;
2011   unsigned char *saved_buffer;
2012   ULONG offset;
2013 
2014   switch (fc)
2015   {
2016   case RPC_FC_CARRAY:
2017     esize = *(const WORD*)(pFormat+2);
2018     alignment = pFormat[1] + 1;
2019 
2020     bufsize = memsize = safe_multiply(esize, pStubMsg->MaxCount);
2021 
2022     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2023 
2024     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2025 
2026     if (fUnmarshall)
2027     {
2028       if (fMustAlloc)
2029         *ppMemory = NdrAllocate(pStubMsg, memsize);
2030       else
2031       {
2032         if (fUseBufferMemoryServer && !pStubMsg->IsClient && !*ppMemory)
2033           /* for servers, we just point straight into the RPC buffer */
2034           *ppMemory = pStubMsg->Buffer;
2035       }
2036 
2037       saved_buffer = pStubMsg->Buffer;
2038       safe_buffer_increment(pStubMsg, bufsize);
2039 
2040       pStubMsg->BufferMark = saved_buffer;
2041       EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat, fMustAlloc);
2042 
2043       TRACE("copying %p to %p\n", saved_buffer, *ppMemory);
2044       if (*ppMemory != saved_buffer)
2045         memcpy(*ppMemory, saved_buffer, bufsize);
2046     }
2047     return bufsize;
2048   case RPC_FC_CVARRAY:
2049     esize = *(const WORD*)(pFormat+2);
2050     alignment = pFormat[1] + 1;
2051 
2052     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2053 
2054     pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
2055 
2056     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2057 
2058     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2059     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2060 
2061     if (fUnmarshall)
2062     {
2063       offset = pStubMsg->Offset;
2064 
2065       if (!fMustAlloc && !*ppMemory)
2066         fMustAlloc = TRUE;
2067       if (fMustAlloc)
2068         *ppMemory = NdrAllocate(pStubMsg, memsize);
2069       saved_buffer = pStubMsg->Buffer;
2070       safe_buffer_increment(pStubMsg, bufsize);
2071 
2072       pStubMsg->BufferMark = saved_buffer;
2073       EmbeddedPointerUnmarshall(pStubMsg, saved_buffer, *ppMemory, pFormat,
2074                                 fMustAlloc);
2075 
2076       memcpy(*ppMemory + offset, saved_buffer, bufsize);
2077     }
2078     return bufsize;
2079   case RPC_FC_C_CSTRING:
2080   case RPC_FC_C_WSTRING:
2081     if (fc == RPC_FC_C_CSTRING)
2082       esize = 1;
2083     else
2084       esize = 2;
2085 
2086     ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount);
2087 
2088     if (pFormat[1] != RPC_FC_STRING_SIZED && (pStubMsg->MaxCount != pStubMsg->ActualCount))
2089     {
2090       ERR("buffer size %d must equal memory size %ld for non-sized conformant strings\n",
2091           pStubMsg->ActualCount, pStubMsg->MaxCount);
2092       RpcRaiseException(RPC_S_INVALID_BOUND);
2093     }
2094     if (pStubMsg->Offset)
2095     {
2096       ERR("conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2097       RpcRaiseException(RPC_S_INVALID_BOUND);
2098     }
2099 
2100     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2101     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2102 
2103     validate_string_data(pStubMsg, bufsize, esize);
2104 
2105     if (fUnmarshall)
2106     {
2107       if (fMustAlloc)
2108         *ppMemory = NdrAllocate(pStubMsg, memsize);
2109       else
2110       {
2111         if (fUseBufferMemoryServer && !pStubMsg->IsClient &&
2112             !*ppMemory && (pStubMsg->MaxCount == pStubMsg->ActualCount))
2113           /* if the data in the RPC buffer is big enough, we just point
2114            * straight into it */
2115           *ppMemory = pStubMsg->Buffer;
2116         else if (!*ppMemory)
2117           *ppMemory = NdrAllocate(pStubMsg, memsize);
2118       }
2119 
2120       if (*ppMemory == pStubMsg->Buffer)
2121         safe_buffer_increment(pStubMsg, bufsize);
2122       else
2123         safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);
2124 
2125       if (*pFormat == RPC_FC_C_CSTRING)
2126         TRACE("string=%s\n", debugstr_a((char*)*ppMemory));
2127       else
2128         TRACE("string=%s\n", debugstr_w((LPWSTR)*ppMemory));
2129     }
2130     return bufsize;
2131   default:
2132     ERR("unknown array format 0x%x\n", fc);
2133     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2134   }
2135 }
2136 
2137 static inline void array_memory_size(
2138     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat,
2139     unsigned char fHasPointers)
2140 {
2141   ULONG bufsize, memsize;
2142   DWORD esize;
2143   unsigned char alignment;
2144 
2145   switch (fc)
2146   {
2147   case RPC_FC_CARRAY:
2148     esize = *(const WORD*)(pFormat+2);
2149     alignment = pFormat[1] + 1;
2150 
2151     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2152 
2153     bufsize = memsize = safe_multiply(esize, pStubMsg->MaxCount);
2154     pStubMsg->MemorySize += memsize;
2155 
2156     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2157     if (fHasPointers)
2158       pStubMsg->BufferMark = pStubMsg->Buffer;
2159     safe_buffer_increment(pStubMsg, bufsize);
2160 
2161     if (fHasPointers)
2162       EmbeddedPointerMemorySize(pStubMsg, pFormat);
2163     break;
2164   case RPC_FC_CVARRAY:
2165     esize = *(const WORD*)(pFormat+2);
2166     alignment = pFormat[1] + 1;
2167 
2168     pFormat = SkipConformance(pStubMsg, pFormat + 4);
2169 
2170     pFormat = ReadVariance(pStubMsg, pFormat, pStubMsg->MaxCount);
2171 
2172     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2173     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2174     pStubMsg->MemorySize += memsize;
2175 
2176     ALIGN_POINTER(pStubMsg->Buffer, alignment);
2177     if (fHasPointers)
2178       pStubMsg->BufferMark = pStubMsg->Buffer;
2179     safe_buffer_increment(pStubMsg, bufsize);
2180 
2181     if (fHasPointers)
2182       EmbeddedPointerMemorySize(pStubMsg, pFormat);
2183     break;
2184   case RPC_FC_C_CSTRING:
2185   case RPC_FC_C_WSTRING:
2186     if (fc == RPC_FC_C_CSTRING)
2187       esize = 1;
2188     else
2189       esize = 2;
2190 
2191     ReadVariance(pStubMsg, NULL, pStubMsg->MaxCount);
2192 
2193     if (pFormat[1] != RPC_FC_STRING_SIZED && (pStubMsg->MaxCount != pStubMsg->ActualCount))
2194     {
2195       ERR("buffer size %d must equal memory size %ld for non-sized conformant strings\n",
2196           pStubMsg->ActualCount, pStubMsg->MaxCount);
2197       RpcRaiseException(RPC_S_INVALID_BOUND);
2198     }
2199     if (pStubMsg->Offset)
2200     {
2201       ERR("conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2202       RpcRaiseException(RPC_S_INVALID_BOUND);
2203     }
2204 
2205     memsize = safe_multiply(esize, pStubMsg->MaxCount);
2206     bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2207 
2208     validate_string_data(pStubMsg, bufsize, esize);
2209 
2210     safe_buffer_increment(pStubMsg, bufsize);
2211     pStubMsg->MemorySize += memsize;
2212     break;
2213   default:
2214     ERR("unknown array format 0x%x\n", fc);
2215     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2216   }
2217 }
2218 
2219 static inline void array_free(
2220     unsigned char fc, PMIDL_STUB_MESSAGE pStubMsg,
2221     unsigned char *pMemory, PFORMAT_STRING pFormat, unsigned char fHasPointers)
2222 {
2223   switch (fc)
2224   {
2225   case RPC_FC_CARRAY:
2226     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
2227     if (fHasPointers)
2228       EmbeddedPointerFree(pStubMsg, pMemory, pFormat);
2229     break;
2230   case RPC_FC_CVARRAY:
2231     pFormat = ComputeConformance(pStubMsg, pMemory, pFormat+4, 0);
2232     pFormat = ComputeVariance(pStubMsg, pMemory, pFormat, 0);
2233     if (fHasPointers)
2234       EmbeddedPointerFree(pStubMsg, pMemory, pFormat);
2235     break;
2236   case RPC_FC_C_CSTRING:
2237   case RPC_FC_C_WSTRING:
2238     /* No embedded pointers so nothing to do */
2239     break;
2240   default:
2241     ERR("unknown array format 0x%x\n", fc);
2242     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2243   }
2244 }
2245 
2246 /*
2247  * NdrConformantString:
2248  *
2249  * What MS calls a ConformantString is, in DCE terminology,
2250  * a Varying-Conformant String.
2251  * [
2252  *   maxlen: DWORD (max # of CHARTYPE characters, inclusive of '\0')
2253  *   offset: DWORD (actual string data begins at (offset) CHARTYPE's
2254  *           into unmarshalled string)
2255  *   length: DWORD (# of CHARTYPE characters, inclusive of '\0')
2256  *   [
2257  *     data: CHARTYPE[maxlen]
2258  *   ]
2259  * ], where CHARTYPE is the appropriate character type (specified externally)
2260  *
2261  */
2262 
2263 /***********************************************************************
2264  *            NdrConformantStringMarshall [RPCRT4.@]
2265  */
2266 unsigned char *WINAPI NdrConformantStringMarshall(MIDL_STUB_MESSAGE *pStubMsg,
2267   unsigned char *pszMessage, PFORMAT_STRING pFormat)
2268 {
2269   TRACE("(pStubMsg == ^%p, pszMessage == ^%p, pFormat == ^%p)\n", pStubMsg, pszMessage, pFormat);
2270 
2271   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2272     ERR("Unhandled string type: %#x\n", pFormat[0]);
2273     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2274   }
2275 
2276   /* allow compiler to optimise inline function by passing constant into
2277    * these functions */
2278   if (pFormat[0] == RPC_FC_C_CSTRING) {
2279     array_compute_and_write_conformance(RPC_FC_C_CSTRING, pStubMsg, pszMessage,
2280                                         pFormat);
2281     array_write_variance_and_marshall(RPC_FC_C_CSTRING, pStubMsg, pszMessage,
2282                                       pFormat, TRUE /* fHasPointers */);
2283   } else {
2284     array_compute_and_write_conformance(RPC_FC_C_WSTRING, pStubMsg, pszMessage,
2285                                         pFormat);
2286     array_write_variance_and_marshall(RPC_FC_C_WSTRING, pStubMsg, pszMessage,
2287                                       pFormat, TRUE /* fHasPointers */);
2288   }
2289 
2290   return NULL;
2291 }
2292 
2293 /***********************************************************************
2294  *           NdrConformantStringBufferSize [RPCRT4.@]
2295  */
2296 void WINAPI NdrConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
2297   unsigned char* pMemory, PFORMAT_STRING pFormat)
2298 {
2299   TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
2300 
2301   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2302     ERR("Unhandled string type: %#x\n", pFormat[0]);
2303     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2304   }
2305 
2306   /* allow compiler to optimise inline function by passing constant into
2307    * these functions */
2308   if (pFormat[0] == RPC_FC_C_CSTRING) {
2309     array_compute_and_size_conformance(RPC_FC_C_CSTRING, pStubMsg, pMemory,
2310                                        pFormat);
2311     array_buffer_size(RPC_FC_C_CSTRING, pStubMsg, pMemory, pFormat,
2312                       TRUE /* fHasPointers */);
2313   } else {
2314     array_compute_and_size_conformance(RPC_FC_C_WSTRING, pStubMsg, pMemory,
2315                                        pFormat);
2316     array_buffer_size(RPC_FC_C_WSTRING, pStubMsg, pMemory, pFormat,
2317                       TRUE /* fHasPointers */);
2318   }
2319 }
2320 
2321 /************************************************************************
2322  *            NdrConformantStringMemorySize [RPCRT4.@]
2323  */
2324 ULONG WINAPI NdrConformantStringMemorySize( PMIDL_STUB_MESSAGE pStubMsg,
2325   PFORMAT_STRING pFormat )
2326 {
2327   TRACE("(pStubMsg == ^%p, pFormat == ^%p)\n", pStubMsg, pFormat);
2328 
2329   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2330     ERR("Unhandled string type: %#x\n", pFormat[0]);
2331     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2332   }
2333 
2334   /* allow compiler to optimise inline function by passing constant into
2335    * these functions */
2336   if (pFormat[0] == RPC_FC_C_CSTRING) {
2337     array_read_conformance(RPC_FC_C_CSTRING, pStubMsg, pFormat);
2338     array_memory_size(RPC_FC_C_CSTRING, pStubMsg, pFormat,
2339                       TRUE /* fHasPointers */);
2340   } else {
2341     array_read_conformance(RPC_FC_C_WSTRING, pStubMsg, pFormat);
2342     array_memory_size(RPC_FC_C_WSTRING, pStubMsg, pFormat,
2343                       TRUE /* fHasPointers */);
2344   }
2345 
2346   return pStubMsg->MemorySize;
2347 }
2348 
2349 /************************************************************************
2350  *           NdrConformantStringUnmarshall [RPCRT4.@]
2351  */
2352 unsigned char *WINAPI NdrConformantStringUnmarshall( PMIDL_STUB_MESSAGE pStubMsg,
2353   unsigned char** ppMemory, PFORMAT_STRING pFormat, unsigned char fMustAlloc )
2354 {
2355   TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n",
2356     pStubMsg, *ppMemory, pFormat, fMustAlloc);
2357 
2358   if (pFormat[0] != RPC_FC_C_CSTRING && pFormat[0] != RPC_FC_C_WSTRING) {
2359     ERR("Unhandled string type: %#x\n", *pFormat);
2360     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2361   }
2362 
2363   /* allow compiler to optimise inline function by passing constant into
2364    * these functions */
2365   if (pFormat[0] == RPC_FC_C_CSTRING) {
2366     array_read_conformance(RPC_FC_C_CSTRING, pStubMsg, pFormat);
2367     array_read_variance_and_unmarshall(RPC_FC_C_CSTRING, pStubMsg, ppMemory,
2368                                        pFormat, fMustAlloc,
2369                                        TRUE /* fUseBufferMemoryServer */,
2370                                        TRUE /* fUnmarshall */);
2371   } else {
2372     array_read_conformance(RPC_FC_C_WSTRING, pStubMsg, pFormat);
2373     array_read_variance_and_unmarshall(RPC_FC_C_WSTRING, pStubMsg, ppMemory,
2374                                        pFormat, fMustAlloc,
2375                                        TRUE /* fUseBufferMemoryServer */,
2376                                        TRUE /* fUnmarshall */);
2377   }
2378 
2379   return NULL;
2380 }
2381 
2382 /***********************************************************************
2383  *           NdrNonConformantStringMarshall [RPCRT4.@]
2384  */
2385 unsigned char *  WINAPI NdrNonConformantStringMarshall(PMIDL_STUB_MESSAGE pStubMsg,
2386                                 unsigned char *pMemory,
2387                                 PFORMAT_STRING pFormat)
2388 {
2389   ULONG esize, size, maxsize;
2390 
2391   TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
2392 
2393   maxsize = *(USHORT *)&pFormat[2];
2394 
2395   if (*pFormat == RPC_FC_CSTRING)
2396   {
2397     ULONG i;
2398     const char *str = (const char *)pMemory;
2399     for (i = 0; i < maxsize && *str; i++, str++)
2400         ;
2401     TRACE("string=%s\n", debugstr_an(str, i));
2402     pStubMsg->ActualCount = i + 1;
2403     esize = 1;
2404   }
2405   else if (*pFormat == RPC_FC_WSTRING)
2406   {
2407     ULONG i;
2408     const WCHAR *str = (const WCHAR *)pMemory;
2409     for (i = 0; i < maxsize && *str; i++, str++)
2410         ;
2411     TRACE("string=%s\n", debugstr_wn(str, i));
2412     pStubMsg->ActualCount = i + 1;
2413     esize = 2;
2414   }
2415   else
2416   {
2417     ERR("Unhandled string type: %#x\n", *pFormat);
2418     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2419   }
2420 
2421   pStubMsg->Offset = 0;
2422   WriteVariance(pStubMsg);
2423 
2424   size = safe_multiply(esize, pStubMsg->ActualCount);
2425   safe_copy_to_buffer(pStubMsg, pMemory, size); /* the string itself */
2426 
2427   return NULL;
2428 }
2429 
2430 /***********************************************************************
2431  *           NdrNonConformantStringUnmarshall [RPCRT4.@]
2432  */
2433 unsigned char *  WINAPI NdrNonConformantStringUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
2434                                 unsigned char **ppMemory,
2435                                 PFORMAT_STRING pFormat,
2436                                 unsigned char fMustAlloc)
2437 {
2438   ULONG bufsize, memsize, esize, maxsize;
2439 
2440   TRACE("(pStubMsg == ^%p, *pMemory == ^%p, pFormat == ^%p, fMustAlloc == %u)\n",
2441     pStubMsg, *ppMemory, pFormat, fMustAlloc);
2442 
2443   maxsize = *(USHORT *)&pFormat[2];
2444 
2445   ReadVariance(pStubMsg, NULL, maxsize);
2446   if (pStubMsg->Offset)
2447   {
2448     ERR("non-conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2449     RpcRaiseException(RPC_S_INVALID_BOUND);
2450   }
2451 
2452   if (*pFormat == RPC_FC_CSTRING) esize = 1;
2453   else if (*pFormat == RPC_FC_WSTRING) esize = 2;
2454   else
2455   {
2456     ERR("Unhandled string type: %#x\n", *pFormat);
2457     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2458   }
2459 
2460   memsize = esize * maxsize;
2461   bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2462 
2463   validate_string_data(pStubMsg, bufsize, esize);
2464 
2465   if (!fMustAlloc && !*ppMemory)
2466     fMustAlloc = TRUE;
2467   if (fMustAlloc)
2468     *ppMemory = NdrAllocate(pStubMsg, memsize);
2469 
2470   safe_copy_from_buffer(pStubMsg, *ppMemory, bufsize);
2471 
2472   if (*pFormat == RPC_FC_CSTRING) {
2473     TRACE("string=%s\n", debugstr_an((char*)*ppMemory, pStubMsg->ActualCount));
2474   }
2475   else if (*pFormat == RPC_FC_WSTRING) {
2476     TRACE("string=%s\n", debugstr_wn((LPWSTR)*ppMemory, pStubMsg->ActualCount));
2477   }
2478 
2479   return NULL;
2480 }
2481 
2482 /***********************************************************************
2483  *           NdrNonConformantStringBufferSize [RPCRT4.@]
2484  */
2485 void WINAPI NdrNonConformantStringBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
2486                                 unsigned char *pMemory,
2487                                 PFORMAT_STRING pFormat)
2488 {
2489   ULONG esize, maxsize;
2490 
2491   TRACE("(pStubMsg == ^%p, pMemory == ^%p, pFormat == ^%p)\n", pStubMsg, pMemory, pFormat);
2492 
2493   maxsize = *(USHORT *)&pFormat[2];
2494 
2495   SizeVariance(pStubMsg);
2496 
2497   if (*pFormat == RPC_FC_CSTRING)
2498   {
2499     ULONG i;
2500     const char *str = (const char *)pMemory;
2501     for (i = 0; i < maxsize && *str; i++, str++)
2502         ;
2503     TRACE("string=%s\n", debugstr_an(str, i));
2504     pStubMsg->ActualCount = i + 1;
2505     esize = 1;
2506   }
2507   else if (*pFormat == RPC_FC_WSTRING)
2508   {
2509     ULONG i;
2510     const WCHAR *str = (const WCHAR *)pMemory;
2511     for (i = 0; i < maxsize && *str; i++, str++)
2512         ;
2513     TRACE("string=%s\n", debugstr_wn(str, i));
2514     pStubMsg->ActualCount = i + 1;
2515     esize = 2;
2516   }
2517   else
2518   {
2519     ERR("Unhandled string type: %#x\n", *pFormat);
2520     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2521   }
2522 
2523   safe_buffer_length_increment(pStubMsg, safe_multiply(esize, pStubMsg->ActualCount));
2524 }
2525 
2526 /***********************************************************************
2527  *           NdrNonConformantStringMemorySize [RPCRT4.@]
2528  */
2529 ULONG WINAPI NdrNonConformantStringMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
2530                                 PFORMAT_STRING pFormat)
2531 {
2532   ULONG bufsize, memsize, esize, maxsize;
2533 
2534   TRACE("(pStubMsg == ^%p, pFormat == ^%p)\n", pStubMsg, pFormat);
2535 
2536   maxsize = *(USHORT *)&pFormat[2];
2537 
2538   ReadVariance(pStubMsg, NULL, maxsize);
2539 
2540   if (pStubMsg->Offset)
2541   {
2542     ERR("non-conformant strings can't have Offset (%d)\n", pStubMsg->Offset);
2543     RpcRaiseException(RPC_S_INVALID_BOUND);
2544   }
2545 
2546   if (*pFormat == RPC_FC_CSTRING) esize = 1;
2547   else if (*pFormat == RPC_FC_WSTRING) esize = 2;
2548   else
2549   {
2550     ERR("Unhandled string type: %#x\n", *pFormat);
2551     RpcRaiseException(RPC_X_BAD_STUB_DATA);
2552   }
2553 
2554   memsize = esize * maxsize;
2555   bufsize = safe_multiply(esize, pStubMsg->ActualCount);
2556 
2557   validate_string_data(pStubMsg, bufsize, esize);
2558 
2559   safe_buffer_increment(pStubMsg, bufsize);
2560   pStubMsg->MemorySize += memsize;
2561 
2562   return pStubMsg->MemorySize;
2563 }
2564 
2565 /* Complex types */
2566 
2567 #include "pshpack1.h"
2568 typedef struct
2569 {
2570     unsigned char type;
2571     unsigned char flags_type; /* flags in upper nibble, type in lower nibble */
2572     ULONG low_value;
2573     ULONG high_value;
2574 } NDR_RANGE;
2575 #include "poppack.h"
2576 
2577 static ULONG EmbeddedComplexSize(MIDL_STUB_MESSAGE *pStubMsg,
2578                                  PFORMAT_STRING pFormat)
2579 {
2580   switch (*pFormat) {
2581   case RPC_FC_STRUCT:
2582   case RPC_FC_PSTRUCT:
2583   case RPC_FC_CSTRUCT:
2584   case RPC_FC_BOGUS_STRUCT:
2585   case RPC_FC_SMFARRAY:
2586   case RPC_FC_SMVARRAY:
2587   case RPC_FC_CSTRING:
2588     return *(const WORD*)&pFormat[2];
2589   case RPC_FC_USER_MARSHAL:
2590     return *(const WORD*)&pFormat[4];
2591   case RPC_FC_RANGE: {
2592     switch (((const NDR_RANGE *)pFormat)->flags_type & 0xf) {
2593     case RPC_FC_BYTE:
2594     case RPC_FC_CHAR:
2595     case RPC_FC_SMALL:
2596     case RPC_FC_USMALL:
2597         return sizeof(UCHAR);
2598     case RPC_FC_WCHAR:
2599     case RPC_FC_SHORT:
2600     case RPC_FC_USHORT:
2601         return sizeof(USHORT);
2602     case RPC_FC_LONG:
2603     case RPC_FC_ULONG:
2604     case RPC_FC_ENUM32:
2605         return sizeof(ULONG);
2606     case RPC_FC_FLOAT:
2607         return sizeof(float);
2608     case RPC_FC_DOUBLE:
2609         return sizeof(double);
2610     case RPC_FC_HYPER:
2611         return sizeof(ULONGLONG);
2612     case RPC_FC_ENUM16:
2613         return sizeof(UINT);
2614     default:
2615         ERR("unknown type 0x%x\n", ((const NDR_RANGE *)pFormat)->flags_type & 0xf);
2616         RpcRaiseException(RPC_X_BAD_STUB_DATA);
2617     }
2618   }
2619   case RPC_FC_NON_ENCAPSULATED_UNION:
2620     pFormat += 2;
2621     if (pStubMsg->fHasNewCorrDesc)
2622         pFormat += 6;
2623     else
2624         pFormat += 4;
2625 
2626     pFormat += *(const SHORT*)pFormat;
2627     return *(const SHORT*)pFormat;
2628   case RPC_FC_IP:
2629     return sizeof(void *);
2630   case RPC_FC_WSTRING:
2631     return *(const WORD*)&pFormat[2] * 2;
2632   default:
2633     FIXME("unhandled embedded type %02x\n", *pFormat);
2634   }
2635   return 0;
2636 }
2637 
2638 
2639 static ULONG EmbeddedComplexMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
2640                                        PFORMAT_STRING pFormat)
2641 {
2642   NDR_MEMORYSIZE m = NdrMemorySizer[*pFormat & NDR_TABLE_MASK];
2643 
2644   if (!m)
2645   {
2646     FIXME("no memorysizer for data type=%02x\n", *pFormat);
2647     return 0;
2648   }
2649 
2650   return m(pStubMsg, pFormat);
2651 }
2652 
2653 
2654 static unsigned char * ComplexMarshall(PMIDL_STUB_MESSAGE pStubMsg,
2655                                        unsigned char *pMemory,
2656                                        PFORMAT_STRING pFormat,
2657                                        PFORMAT_STRING pPointer)
2658 {
2659   PFORMAT_STRING desc;
2660   NDR_MARSHALL m;
2661   ULONG size;
2662 
2663   while (*pFormat != RPC_FC_END) {
2664     switch (*pFormat) {
2665     case RPC_FC_BYTE:
2666     case RPC_FC_CHAR:
2667     case RPC_FC_SMALL:
2668     case RPC_FC_USMALL:
2669       TRACE("byte=%d <= %p\n", *(WORD*)pMemory, pMemory);
2670       safe_copy_to_buffer(pStubMsg, pMemory, 1);
2671       pMemory += 1;
2672       break;
2673     case RPC_FC_WCHAR:
2674     case RPC_FC_SHORT:
2675     case RPC_FC_USHORT:
2676       TRACE("short=%d <= %p\n", *(WORD*)pMemory, pMemory);
2677       safe_copy_to_buffer(pStubMsg, pMemory, 2);
2678       pMemory += 2;
2679       break;
2680     case RPC_FC_ENUM16:
2681       TRACE("enum16=%d <= %p\n", *(DWORD*)pMemory, pMemory);
2682       if (32767 < *(DWORD*)pMemory)
2683         RpcRaiseException(RPC_X_ENUM_VALUE_OUT_OF_RANGE);
2684       safe_copy_to_buffer(pStubMsg, pMemory, 2);
2685       pMemory += 4;
2686       break;
2687     case RPC_FC_LONG:
2688     case RPC_FC_ULONG:
2689     case RPC_FC_ENUM32:
2690       TRACE("long=%d <= %p\n", *(DWORD*)pMemory, pMemory);
2691       safe_copy_to_buffer(pStubMsg, pMemory, 4);
2692       pMemory += 4;
2693       break;
2694     case RPC_FC_HYPER:
2695       TRACE("longlong=%s <= %p\n", wine_dbgstr_longlong(*(ULONGLONG*)pMemory), pMemory);
2696       safe_copy_to_buffer(pStubMsg, pMemory, 8);
2697       pMemory += 8;
2698       break;
2699     case RPC_FC_POINTER:
2700     {
2701       unsigned char *saved_buffer;
2702       int pointer_buffer_mark_set = 0;
2703       TRACE("pointer=%p <= %p\n", *(unsigned char**)pMemory, pMemory);
2704       TRACE("pStubMsg->Buffer before %p\n", pStubMsg->Buffer);
2705       if (*pPointer != RPC_FC_RP)
2706         ALIGN_POINTER_CLEAR(pStubMsg->Buffer, 4);
2707       saved_buffer = pStubMsg->Buffer;
2708       if (pStubMsg->PointerBufferMark)
2709       {
2710         pStubMsg->Buffer = pStubMsg->PointerBufferMark;
2711         pStubMsg->PointerBufferMark = NULL;
2712         pointer_buffer_mark_set = 1;
2713       }
2714       else if (*pPointer != RPC_FC_RP)
2715         safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2716       PointerMarshall(pStubMsg, saved_buffer, *(unsigned char**)pMemory, pPointer);
2717       if (pointer_buffer_mark_set)
2718       {
2719         STD_OVERFLOW_CHECK(pStubMsg);
2720         pStubMsg->PointerBufferMark = pStubMsg->Buffer;
2721         pStubMsg->Buffer = saved_buffer;
2722         if (*pPointer != RPC_FC_RP)
2723           safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2724       }
2725       TRACE("pStubMsg->Buffer after %p\n", pStubMsg->Buffer);
2726       pPointer += 4;
2727       pMemory += sizeof(void *);
2728       break;
2729     }
2730     case RPC_FC_ALIGNM4:
2731       ALIGN_POINTER(pMemory, 4);
2732       break;
2733     case RPC_FC_ALIGNM8:
2734       ALIGN_POINTER(pMemory, 8);
2735       break;
2736     case RPC_FC_STRUCTPAD1:
2737     case RPC_FC_STRUCTPAD2:
2738     case RPC_FC_STRUCTPAD3:
2739     case RPC_FC_STRUCTPAD4:
2740     case RPC_FC_STRUCTPAD5:
2741     case RPC_FC_STRUCTPAD6:
2742     case RPC_FC_STRUCTPAD7:
2743       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
2744       break;
2745     case RPC_FC_EMBEDDED_COMPLEX:
2746       pMemory += pFormat[1];
2747       pFormat += 2;
2748       desc = pFormat + *(const SHORT*)pFormat;
2749       size = EmbeddedComplexSize(pStubMsg, desc);
2750       TRACE("embedded complex (size=%d) <= %p\n", size, pMemory);
2751       m = NdrMarshaller[*desc & NDR_TABLE_MASK];
2752       if (m)
2753       {
2754         /* for some reason interface pointers aren't generated as
2755          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
2756          * they still need the derefencing treatment that pointers are
2757          * given */
2758         if (*desc == RPC_FC_IP)
2759           m(pStubMsg, *(unsigned char **)pMemory, desc);
2760         else
2761           m(pStubMsg, pMemory, desc);
2762       }
2763       else FIXME("no marshaller for embedded type %02x\n", *desc);
2764       pMemory += size;
2765       pFormat += 2;
2766       continue;
2767     case RPC_FC_PAD:
2768       break;
2769     default:
2770       FIXME("unhandled format 0x%02x\n", *pFormat);
2771     }
2772     pFormat++;
2773   }
2774 
2775   return pMemory;
2776 }
2777 
2778 static unsigned char * ComplexUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
2779                                          unsigned char *pMemory,
2780                                          PFORMAT_STRING pFormat,
2781                                          PFORMAT_STRING pPointer,
2782                                          unsigned char fMustAlloc)
2783 {
2784   PFORMAT_STRING desc;
2785   NDR_UNMARSHALL m;
2786   ULONG size;
2787 
2788   while (*pFormat != RPC_FC_END) {
2789     switch (*pFormat) {
2790     case RPC_FC_BYTE:
2791     case RPC_FC_CHAR:
2792     case RPC_FC_SMALL:
2793     case RPC_FC_USMALL:
2794       safe_copy_from_buffer(pStubMsg, pMemory, 1);
2795       TRACE("byte=%d => %p\n", *(WORD*)pMemory, pMemory);
2796       pMemory += 1;
2797       break;
2798     case RPC_FC_WCHAR:
2799     case RPC_FC_SHORT:
2800     case RPC_FC_USHORT:
2801       safe_copy_from_buffer(pStubMsg, pMemory, 2);
2802       TRACE("short=%d => %p\n", *(WORD*)pMemory, pMemory);
2803       pMemory += 2;
2804       break;
2805     case RPC_FC_ENUM16:
2806       safe_copy_from_buffer(pStubMsg, pMemory, 2);
2807       *(DWORD*)pMemory &= 0xffff;
2808       TRACE("enum16=%d => %p\n", *(DWORD*)pMemory, pMemory);
2809       if (32767 < *(DWORD*)pMemory)
2810         RpcRaiseException(RPC_X_ENUM_VALUE_OUT_OF_RANGE);
2811       pMemory += 4;
2812       break;
2813     case RPC_FC_LONG:
2814     case RPC_FC_ULONG:
2815     case RPC_FC_ENUM32:
2816       safe_copy_from_buffer(pStubMsg, pMemory, 4);
2817       TRACE("long=%d => %p\n", *(DWORD*)pMemory, pMemory);
2818       pMemory += 4;
2819       break;
2820     case RPC_FC_HYPER:
2821       safe_copy_from_buffer(pStubMsg, pMemory, 8);
2822       TRACE("longlong=%s => %p\n", wine_dbgstr_longlong(*(ULONGLONG*)pMemory), pMemory);
2823       pMemory += 8;
2824       break;
2825     case RPC_FC_POINTER:
2826     {
2827       unsigned char *saved_buffer;
2828       int pointer_buffer_mark_set = 0;
2829       TRACE("pointer => %p\n", pMemory);
2830       if (*pPointer != RPC_FC_RP)
2831         ALIGN_POINTER(pStubMsg->Buffer, 4);
2832       saved_buffer = pStubMsg->Buffer;
2833       if (pStubMsg->PointerBufferMark)
2834       {
2835         pStubMsg->Buffer = pStubMsg->PointerBufferMark;
2836         pStubMsg->PointerBufferMark = NULL;
2837         pointer_buffer_mark_set = 1;
2838       }
2839       else if (*pPointer != RPC_FC_RP)
2840         safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2841 
2842       PointerUnmarshall(pStubMsg, saved_buffer, (unsigned char**)pMemory, *(unsigned char**)pMemory, pPointer, fMustAlloc);
2843       if (pointer_buffer_mark_set)
2844       {
2845         STD_OVERFLOW_CHECK(pStubMsg);
2846         pStubMsg->PointerBufferMark = pStubMsg->Buffer;
2847         pStubMsg->Buffer = saved_buffer;
2848         if (*pPointer != RPC_FC_RP)
2849           safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
2850       }
2851       pPointer += 4;
2852       pMemory += sizeof(void *);
2853       break;
2854     }
2855     case RPC_FC_ALIGNM4:
2856       ALIGN_POINTER_CLEAR(pMemory, 4);
2857       break;
2858     case RPC_FC_ALIGNM8:
2859       ALIGN_POINTER_CLEAR(pMemory, 8);
2860       break;
2861     case RPC_FC_STRUCTPAD1:
2862     case RPC_FC_STRUCTPAD2:
2863     case RPC_FC_STRUCTPAD3:
2864     case RPC_FC_STRUCTPAD4:
2865     case RPC_FC_STRUCTPAD5:
2866     case RPC_FC_STRUCTPAD6:
2867     case RPC_FC_STRUCTPAD7:
2868       memset(pMemory, 0, *pFormat - RPC_FC_STRUCTPAD1 + 1);
2869       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
2870       break;
2871     case RPC_FC_EMBEDDED_COMPLEX:
2872       pMemory += pFormat[1];
2873       pFormat += 2;
2874       desc = pFormat + *(const SHORT*)pFormat;
2875       size = EmbeddedComplexSize(pStubMsg, desc);
2876       TRACE("embedded complex (size=%d) => %p\n", size, pMemory);
2877       if (fMustAlloc)
2878         /* we can't pass fMustAlloc=TRUE into the marshaller for this type
2879          * since the type is part of the memory block that is encompassed by
2880          * the whole complex type. Memory is forced to allocate when pointers
2881          * are set to NULL, so we emulate that part of fMustAlloc=TRUE by
2882          * clearing the memory we pass in to the unmarshaller */
2883         memset(pMemory, 0, size);
2884       m = NdrUnmarshaller[*desc & NDR_TABLE_MASK];
2885       if (m)
2886       {
2887         /* for some reason interface pointers aren't generated as
2888          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
2889          * they still need the derefencing treatment that pointers are
2890          * given */
2891         if (*desc == RPC_FC_IP)
2892           m(pStubMsg, (unsigned char **)pMemory, desc, FALSE);
2893         else
2894           m(pStubMsg, &pMemory, desc, FALSE);
2895       }
2896       else FIXME("no unmarshaller for embedded type %02x\n", *desc);
2897       pMemory += size;
2898       pFormat += 2;
2899       continue;
2900     case RPC_FC_PAD:
2901       break;
2902     default:
2903       FIXME("unhandled format %d\n", *pFormat);
2904     }
2905     pFormat++;
2906   }
2907 
2908   return pMemory;
2909 }
2910 
2911 static unsigned char * ComplexBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
2912                                          unsigned char *pMemory,
2913                                          PFORMAT_STRING pFormat,
2914                                          PFORMAT_STRING pPointer)
2915 {
2916   PFORMAT_STRING desc;
2917   NDR_BUFFERSIZE m;
2918   ULONG size;
2919 
2920   while (*pFormat != RPC_FC_END) {
2921     switch (*pFormat) {
2922     case RPC_FC_BYTE:
2923     case RPC_FC_CHAR:
2924     case RPC_FC_SMALL:
2925     case RPC_FC_USMALL:
2926       safe_buffer_length_increment(pStubMsg, 1);
2927       pMemory += 1;
2928       break;
2929     case RPC_FC_WCHAR:
2930     case RPC_FC_SHORT:
2931     case RPC_FC_USHORT:
2932       safe_buffer_length_increment(pStubMsg, 2);
2933       pMemory += 2;
2934       break;
2935     case RPC_FC_ENUM16:
2936       safe_buffer_length_increment(pStubMsg, 2);
2937       pMemory += 4;
2938       break;
2939     case RPC_FC_LONG:
2940     case RPC_FC_ULONG:
2941     case RPC_FC_ENUM32:
2942       safe_buffer_length_increment(pStubMsg, 4);
2943       pMemory += 4;
2944       break;
2945     case RPC_FC_HYPER:
2946       safe_buffer_length_increment(pStubMsg, 8);
2947       pMemory += 8;
2948       break;
2949     case RPC_FC_POINTER:
2950       if (!pStubMsg->IgnoreEmbeddedPointers)
2951       {
2952         int saved_buffer_length = pStubMsg->BufferLength;
2953         pStubMsg->BufferLength = pStubMsg->PointerLength;
2954         pStubMsg->PointerLength = 0;
2955         if(!pStubMsg->BufferLength)
2956           ERR("BufferLength == 0??\n");
2957         PointerBufferSize(pStubMsg, *(unsigned char**)pMemory, pPointer);
2958         pStubMsg->PointerLength = pStubMsg->BufferLength;
2959         pStubMsg->BufferLength = saved_buffer_length;
2960       }
2961       if (*pPointer != RPC_FC_RP)
2962       {
2963         ALIGN_LENGTH(pStubMsg->BufferLength, 4);
2964         safe_buffer_length_increment(pStubMsg, 4);
2965       }
2966       pPointer += 4;
2967       pMemory += sizeof(void*);
2968       break;
2969     case RPC_FC_ALIGNM4:
2970       ALIGN_POINTER(pMemory, 4);
2971       break;
2972     case RPC_FC_ALIGNM8:
2973       ALIGN_POINTER(pMemory, 8);
2974       break;
2975     case RPC_FC_STRUCTPAD1:
2976     case RPC_FC_STRUCTPAD2:
2977     case RPC_FC_STRUCTPAD3:
2978     case RPC_FC_STRUCTPAD4:
2979     case RPC_FC_STRUCTPAD5:
2980     case RPC_FC_STRUCTPAD6:
2981     case RPC_FC_STRUCTPAD7:
2982       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
2983       break;
2984     case RPC_FC_EMBEDDED_COMPLEX:
2985       pMemory += pFormat[1];
2986       pFormat += 2;
2987       desc = pFormat + *(const SHORT*)pFormat;
2988       size = EmbeddedComplexSize(pStubMsg, desc);
2989       m = NdrBufferSizer[*desc & NDR_TABLE_MASK];
2990       if (m)
2991       {
2992         /* for some reason interface pointers aren't generated as
2993          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
2994          * they still need the derefencing treatment that pointers are
2995          * given */
2996         if (*desc == RPC_FC_IP)
2997           m(pStubMsg, *(unsigned char **)pMemory, desc);
2998         else
2999           m(pStubMsg, pMemory, desc);
3000       }
3001       else FIXME("no buffersizer for embedded type %02x\n", *desc);
3002       pMemory += size;
3003       pFormat += 2;
3004       continue;
3005     case RPC_FC_PAD:
3006       break;
3007     default:
3008       FIXME("unhandled format 0x%02x\n", *pFormat);
3009     }
3010     pFormat++;
3011   }
3012 
3013   return pMemory;
3014 }
3015 
3016 static unsigned char * ComplexFree(PMIDL_STUB_MESSAGE pStubMsg,
3017                                    unsigned char *pMemory,
3018                                    PFORMAT_STRING pFormat,
3019                                    PFORMAT_STRING pPointer)
3020 {
3021   PFORMAT_STRING desc;
3022   NDR_FREE m;
3023   ULONG size;
3024 
3025   while (*pFormat != RPC_FC_END) {
3026     switch (*pFormat) {
3027     case RPC_FC_BYTE:
3028     case RPC_FC_CHAR:
3029     case RPC_FC_SMALL:
3030     case RPC_FC_USMALL:
3031       pMemory += 1;
3032       break;
3033     case RPC_FC_WCHAR:
3034     case RPC_FC_SHORT:
3035     case RPC_FC_USHORT:
3036       pMemory += 2;
3037       break;
3038     case RPC_FC_LONG:
3039     case RPC_FC_ULONG:
3040     case RPC_FC_ENUM16:
3041     case RPC_FC_ENUM32:
3042       pMemory += 4;
3043       break;
3044     case RPC_FC_HYPER:
3045       pMemory += 8;
3046       break;
3047     case RPC_FC_POINTER:
3048       NdrPointerFree(pStubMsg, *(unsigned char**)pMemory, pPointer);
3049       pPointer += 4;
3050       pMemory += sizeof(void *);
3051       break;
3052     case RPC_FC_ALIGNM4:
3053       ALIGN_POINTER(pMemory, 4);
3054       break;
3055     case RPC_FC_ALIGNM8:
3056       ALIGN_POINTER(pMemory, 8);
3057       break;
3058     case RPC_FC_STRUCTPAD1:
3059     case RPC_FC_STRUCTPAD2:
3060     case RPC_FC_STRUCTPAD3:
3061     case RPC_FC_STRUCTPAD4:
3062     case RPC_FC_STRUCTPAD5:
3063     case RPC_FC_STRUCTPAD6:
3064     case RPC_FC_STRUCTPAD7:
3065       pMemory += *pFormat - RPC_FC_STRUCTPAD1 + 1;
3066       break;
3067     case RPC_FC_EMBEDDED_COMPLEX:
3068       pMemory += pFormat[1];
3069       pFormat += 2;
3070       desc = pFormat + *(const SHORT*)pFormat;
3071       size = EmbeddedComplexSize(pStubMsg, desc);
3072       m = NdrFreer[*desc & NDR_TABLE_MASK];
3073       if (m)
3074       {
3075         /* for some reason interface pointers aren't generated as
3076          * RPC_FC_POINTER, but instead as RPC_FC_EMBEDDED_COMPLEX, yet
3077          * they still need the derefencing treatment that pointers are
3078          * given */
3079         if (*desc == RPC_FC_IP)
3080           m(pStubMsg, *(unsigned char **)pMemory, desc);
3081         else
3082           m(pStubMsg, pMemory, desc);
3083       }
3084       pMemory += size;
3085       pFormat += 2;
3086       continue;
3087     case RPC_FC_PAD:
3088       break;
3089     default:
3090       FIXME("unhandled format 0x%02x\n", *pFormat);
3091     }
3092     pFormat++;
3093   }
3094 
3095   return pMemory;
3096 }
3097 
3098 static ULONG ComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
3099                                      PFORMAT_STRING pFormat,
3100                                      PFORMAT_STRING pPointer)
3101 {
3102   PFORMAT_STRING desc;
3103   ULONG size = 0;
3104 
3105   while (*pFormat != RPC_FC_END) {
3106     switch (*pFormat) {
3107     case RPC_FC_BYTE:
3108     case RPC_FC_CHAR:
3109     case RPC_FC_SMALL:
3110     case RPC_FC_USMALL:
3111       size += 1;
3112       safe_buffer_increment(pStubMsg, 1);
3113       break;
3114     case RPC_FC_WCHAR:
3115     case RPC_FC_SHORT:
3116     case RPC_FC_USHORT:
3117       size += 2;
3118       safe_buffer_increment(pStubMsg, 2);
3119       break;
3120     case RPC_FC_ENUM16:
3121       size += 4;
3122       safe_buffer_increment(pStubMsg, 2);
3123       break;
3124     case RPC_FC_LONG:
3125     case RPC_FC_ULONG:
3126     case RPC_FC_ENUM32:
3127       size += 4;
3128       safe_buffer_increment(pStubMsg, 4);
3129       break;
3130     case RPC_FC_HYPER:
3131       size += 8;
3132       safe_buffer_increment(pStubMsg, 8);
3133       break;
3134     case RPC_FC_POINTER:
3135     {
3136       unsigned char *saved_buffer;
3137       int pointer_buffer_mark_set = 0;
3138       if (*pPointer != RPC_FC_RP)
3139         ALIGN_POINTER(pStubMsg->Buffer, 4);
3140       saved_buffer = pStubMsg->Buffer;
3141       if (pStubMsg->PointerBufferMark)
3142       {
3143         pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3144         pStubMsg->PointerBufferMark = NULL;
3145         pointer_buffer_mark_set = 1;
3146       }
3147       else if (*pPointer != RPC_FC_RP)
3148         safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
3149 
3150       if (!pStubMsg->IgnoreEmbeddedPointers)
3151         PointerMemorySize(pStubMsg, saved_buffer, pPointer);
3152       if (pointer_buffer_mark_set)
3153       {
3154         STD_OVERFLOW_CHECK(pStubMsg);
3155         pStubMsg->PointerBufferMark = pStubMsg->Buffer;
3156         pStubMsg->Buffer = saved_buffer;
3157         if (*pPointer != RPC_FC_RP)
3158           safe_buffer_increment(pStubMsg, 4); /* for pointer ID */
3159       }
3160       pPointer += 4;
3161       size += sizeof(void *);
3162       break;
3163     }
3164     case RPC_FC_ALIGNM4:
3165       ALIGN_LENGTH(size, 4);
3166       break;
3167     case RPC_FC_ALIGNM8:
3168       ALIGN_LENGTH(size, 8);
3169       break;
3170     case RPC_FC_STRUCTPAD1:
3171     case RPC_FC_STRUCTPAD2:
3172     case RPC_FC_STRUCTPAD3:
3173     case RPC_FC_STRUCTPAD4:
3174     case RPC_FC_STRUCTPAD5:
3175     case RPC_FC_STRUCTPAD6:
3176     case RPC_FC_STRUCTPAD7:
3177       size += *pFormat - RPC_FC_STRUCTPAD1 + 1;
3178       break;
3179     case RPC_FC_EMBEDDED_COMPLEX:
3180       size += pFormat[1];
3181       pFormat += 2;
3182       desc = pFormat + *(const SHORT*)pFormat;
3183       size += EmbeddedComplexMemorySize(pStubMsg, desc);
3184       pFormat += 2;
3185       continue;
3186     case RPC_FC_PAD:
3187       break;
3188     default:
3189       FIXME("unhandled format 0x%02x\n", *pFormat);
3190     }
3191     pFormat++;
3192   }
3193 
3194   return size;
3195 }
3196 
3197 ULONG ComplexStructSize(PMIDL_STUB_MESSAGE pStubMsg, PFORMAT_STRING pFormat)
3198 {
3199   PFORMAT_STRING desc;
3200   ULONG size = 0;
3201 
3202   while (*pFormat != RPC_FC_END) {
3203     switch (*pFormat) {
3204     case RPC_FC_BYTE:
3205     case RPC_FC_CHAR:
3206     case RPC_FC_SMALL:
3207     case RPC_FC_USMALL:
3208       size += 1;
3209       break;
3210     case RPC_FC_WCHAR:
3211     case RPC_FC_SHORT:
3212     case RPC_FC_USHORT:
3213       size += 2;
3214       break;
3215     case RPC_FC_LONG:
3216     case RPC_FC_ULONG:
3217     case RPC_FC_ENUM16:
3218     case RPC_FC_ENUM32:
3219       size += 4;
3220       break;
3221     case RPC_FC_HYPER:
3222       size += 8;
3223       break;
3224     case RPC_FC_POINTER:
3225       size += sizeof(void *);
3226       break;
3227     case RPC_FC_ALIGNM4:
3228       ALIGN_LENGTH(size, 4);
3229       break;
3230     case RPC_FC_ALIGNM8:
3231       ALIGN_LENGTH(size, 8);
3232       break;
3233     case RPC_FC_STRUCTPAD1:
3234     case RPC_FC_STRUCTPAD2:
3235     case RPC_FC_STRUCTPAD3:
3236     case RPC_FC_STRUCTPAD4:
3237     case RPC_FC_STRUCTPAD5:
3238     case RPC_FC_STRUCTPAD6:
3239     case RPC_FC_STRUCTPAD7:
3240       size += *pFormat - RPC_FC_STRUCTPAD1 + 1;
3241       break;
3242     case RPC_FC_EMBEDDED_COMPLEX:
3243       size += pFormat[1];
3244       pFormat += 2;
3245       desc = pFormat + *(const SHORT*)pFormat;
3246       size += EmbeddedComplexSize(pStubMsg, desc);
3247       pFormat += 2;
3248       continue;
3249     case RPC_FC_PAD:
3250       break;
3251     default:
3252       FIXME("unhandled format 0x%02x\n", *pFormat);
3253     }
3254     pFormat++;
3255   }
3256 
3257   return size;
3258 }
3259 
3260 /***********************************************************************
3261  *           NdrComplexStructMarshall [RPCRT4.@]
3262  */
3263 unsigned char * WINAPI NdrComplexStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
3264                                                 unsigned char *pMemory,
3265                                                 PFORMAT_STRING pFormat)
3266 {
3267   PFORMAT_STRING conf_array = NULL;
3268   PFORMAT_STRING pointer_desc = NULL;
3269   unsigned char *OldMemory = pStubMsg->Memory;
3270   int pointer_buffer_mark_set = 0;
3271   ULONG count = 0;
3272   ULONG max_count = 0;
3273   ULONG offset = 0;
3274 
3275   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3276 
3277   if (!pStubMsg->PointerBufferMark)
3278   {
3279     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3280     /* save buffer length */
3281     ULONG saved_buffer_length = pStubMsg->BufferLength;
3282 
3283     /* get the buffer pointer after complex array data, but before
3284      * pointer data */
3285     pStubMsg->BufferLength = pStubMsg->Buffer - (unsigned char *)pStubMsg->RpcMsg->Buffer;
3286     pStubMsg->IgnoreEmbeddedPointers = 1;
3287     NdrComplexStructBufferSize(pStubMsg, pMemory, pFormat);
3288     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3289 
3290     /* save it for use by embedded pointer code later */
3291     pStubMsg->PointerBufferMark = (unsigned char *)pStubMsg->RpcMsg->Buffer + pStubMsg->BufferLength;
3292     TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->PointerBufferMark - pStubMsg->Buffer));
3293     pointer_buffer_mark_set = 1;
3294 
3295     /* restore the original buffer length */
3296     pStubMsg->BufferLength = saved_buffer_length;
3297   }
3298 
3299   ALIGN_POINTER_CLEAR(pStubMsg->Buffer, pFormat[1] + 1);
3300 
3301   pFormat += 4;
3302   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3303   pFormat += 2;
3304   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3305   pFormat += 2;
3306 
3307   pStubMsg->Memory = pMemory;
3308 
3309   if (conf_array)
3310   {
3311     ULONG struct_size = ComplexStructSize(pStubMsg, pFormat);
3312     array_compute_and_write_conformance(conf_array[0], pStubMsg,
3313                                         pMemory + struct_size, conf_array);
3314     /* these could be changed in ComplexMarshall so save them for later */
3315     max_count = pStubMsg->MaxCount;
3316     count = pStubMsg->ActualCount;
3317     offset = pStubMsg->Offset;
3318   }
3319 
3320   pMemory = ComplexMarshall(pStubMsg, pMemory, pFormat, pointer_desc);
3321 
3322   if (conf_array)
3323   {
3324     pStubMsg->MaxCount = max_count;
3325     pStubMsg->ActualCount = count;
3326     pStubMsg->Offset = offset;
3327     array_write_variance_and_marshall(conf_array[0], pStubMsg, pMemory,
3328                                       conf_array, TRUE /* fHasPointers */);
3329   }
3330 
3331   pStubMsg->Memory = OldMemory;
3332 
3333   if (pointer_buffer_mark_set)
3334   {
3335     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3336     pStubMsg->PointerBufferMark = NULL;
3337   }
3338 
3339   STD_OVERFLOW_CHECK(pStubMsg);
3340 
3341   return NULL;
3342 }
3343 
3344 /***********************************************************************
3345  *           NdrComplexStructUnmarshall [RPCRT4.@]
3346  */
3347 unsigned char * WINAPI NdrComplexStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
3348                                                   unsigned char **ppMemory,
3349                                                   PFORMAT_STRING pFormat,
3350                                                   unsigned char fMustAlloc)
3351 {
3352   unsigned size = *(const WORD*)(pFormat+2);
3353   PFORMAT_STRING conf_array = NULL;
3354   PFORMAT_STRING pointer_desc = NULL;
3355   unsigned char *pMemory;
3356   int pointer_buffer_mark_set = 0;
3357   ULONG count = 0;
3358   ULONG max_count = 0;
3359   ULONG offset = 0;
3360   ULONG array_size = 0;
3361 
3362   TRACE("(%p,%p,%p,%d)\n", pStubMsg, ppMemory, pFormat, fMustAlloc);
3363 
3364   if (!pStubMsg->PointerBufferMark)
3365   {
3366     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3367     /* save buffer pointer */
3368     unsigned char *saved_buffer = pStubMsg->Buffer;
3369 
3370     /* get the buffer pointer after complex array data, but before
3371      * pointer data */
3372     pStubMsg->IgnoreEmbeddedPointers = 1;
3373     NdrComplexStructMemorySize(pStubMsg, pFormat);
3374     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3375 
3376     /* save it for use by embedded pointer code later */
3377     pStubMsg->PointerBufferMark = pStubMsg->Buffer;
3378     TRACE("difference = 0x%x\n", (ULONG)(pStubMsg->PointerBufferMark - saved_buffer));
3379     pointer_buffer_mark_set = 1;
3380 
3381     /* restore the original buffer */
3382     pStubMsg->Buffer = saved_buffer;
3383   }
3384 
3385   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
3386 
3387   pFormat += 4;
3388   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3389   pFormat += 2;
3390   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3391   pFormat += 2;
3392 
3393   if (conf_array)
3394   {
3395     array_size = array_read_conformance(conf_array[0], pStubMsg, conf_array);
3396     size += array_size;
3397 
3398     /* these could be changed in ComplexMarshall so save them for later */
3399     max_count = pStubMsg->MaxCount;
3400     count = pStubMsg->ActualCount;
3401     offset = pStubMsg->Offset;
3402   }
3403 
3404   if (!fMustAlloc && !*ppMemory)
3405     fMustAlloc = TRUE;
3406   if (fMustAlloc)
3407     *ppMemory = NdrAllocate(pStubMsg, size);
3408 
3409   pMemory = ComplexUnmarshall(pStubMsg, *ppMemory, pFormat, pointer_desc, fMustAlloc);
3410 
3411   if (conf_array)
3412   {
3413     pStubMsg->MaxCount = max_count;
3414     pStubMsg->ActualCount = count;
3415     pStubMsg->Offset = offset;
3416     if (fMustAlloc)
3417       memset(pMemory, 0, array_size);
3418     array_read_variance_and_unmarshall(conf_array[0], pStubMsg, &pMemory,
3419                                        conf_array, FALSE,
3420                                        FALSE /* fUseBufferMemoryServer */,
3421                                        TRUE /* fUnmarshall */);
3422   }
3423 
3424   if (pointer_buffer_mark_set)
3425   {
3426     pStubMsg->Buffer = pStubMsg->PointerBufferMark;
3427     pStubMsg->PointerBufferMark = NULL;
3428   }
3429 
3430   return NULL;
3431 }
3432 
3433 /***********************************************************************
3434  *           NdrComplexStructBufferSize [RPCRT4.@]
3435  */
3436 void WINAPI NdrComplexStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
3437                                        unsigned char *pMemory,
3438                                        PFORMAT_STRING pFormat)
3439 {
3440   PFORMAT_STRING conf_array = NULL;
3441   PFORMAT_STRING pointer_desc = NULL;
3442   unsigned char *OldMemory = pStubMsg->Memory;
3443   int pointer_length_set = 0;
3444   ULONG count = 0;
3445   ULONG max_count = 0;
3446   ULONG offset = 0;
3447 
3448   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3449 
3450   ALIGN_LENGTH(pStubMsg->BufferLength, pFormat[1] + 1);
3451 
3452   if(!pStubMsg->IgnoreEmbeddedPointers && !pStubMsg->PointerLength)
3453   {
3454     int saved_ignore_embedded = pStubMsg->IgnoreEmbeddedPointers;
3455     ULONG saved_buffer_length = pStubMsg->BufferLength;
3456 
3457     /* get the buffer length after complex struct data, but before
3458      * pointer data */
3459     pStubMsg->IgnoreEmbeddedPointers = 1;
3460     NdrComplexStructBufferSize(pStubMsg, pMemory, pFormat);
3461     pStubMsg->IgnoreEmbeddedPointers = saved_ignore_embedded;
3462 
3463     /* save it for use by embedded pointer code later */
3464     pStubMsg->PointerLength = pStubMsg->BufferLength;
3465     pointer_length_set = 1;
3466     TRACE("difference = 0x%x\n", pStubMsg->PointerLength - saved_buffer_length);
3467 
3468     /* restore the original buffer length */
3469     pStubMsg->BufferLength = saved_buffer_length;
3470   }
3471 
3472   pFormat += 4;
3473   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3474   pFormat += 2;
3475   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3476   pFormat += 2;
3477 
3478   pStubMsg->Memory = pMemory;
3479 
3480   if (conf_array)
3481   {
3482     ULONG struct_size = ComplexStructSize(pStubMsg, pFormat);
3483     array_compute_and_size_conformance(conf_array[0], pStubMsg, pMemory + struct_size,
3484                                        conf_array);
3485 
3486     /* these could be changed in ComplexMarshall so save them for later */
3487     max_count = pStubMsg->MaxCount;
3488     count = pStubMsg->ActualCount;
3489     offset = pStubMsg->Offset;
3490   }
3491 
3492   pMemory = ComplexBufferSize(pStubMsg, pMemory, pFormat, pointer_desc);
3493 
3494   if (conf_array)
3495   {
3496     pStubMsg->MaxCount = max_count;
3497     pStubMsg->ActualCount = count;
3498     pStubMsg->Offset = offset;
3499     array_buffer_size(conf_array[0], pStubMsg, pMemory, conf_array,
3500                       TRUE /* fHasPointers */);
3501   }
3502 
3503   pStubMsg->Memory = OldMemory;
3504 
3505   if(pointer_length_set)
3506   {
3507     pStubMsg->BufferLength = pStubMsg->PointerLength;
3508     pStubMsg->PointerLength = 0;
3509   }
3510 
3511 }
3512 
3513 /***********************************************************************
3514  *           NdrComplexStructMemorySize [RPCRT4.@]
3515  */
3516 ULONG WINAPI NdrComplexStructMemorySize(PMIDL_STUB_MESSAGE pStubMsg,
3517                                         PFORMAT_STRING pFormat)
3518 {
3519   unsigned size = *(const WORD*)(pFormat+2);
3520   PFORMAT_STRING conf_array = NULL;
3521   PFORMAT_STRING pointer_desc = NULL;
3522   ULONG count = 0;
3523   ULONG max_count = 0;
3524   ULONG offset = 0;
3525 
3526   TRACE("(%p,%p)\n", pStubMsg, pFormat);
3527 
3528   ALIGN_POINTER(pStubMsg->Buffer, pFormat[1] + 1);
3529 
3530   pFormat += 4;
3531   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
3532   pFormat += 2;
3533   if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
3534   pFormat += 2;
3535 
3536   if (conf_array)
3537   {
3538     array_read_conformance(conf_array[0], pStubMsg, conf_array);
3539 
3540     /* these could be changed in ComplexStructMemorySize so save them for
3541      * later */
3542     max_count = pStubMsg->MaxCount;
3543     count = pStubMsg->ActualCount;
3544     offset = pStubMsg->Offset;
3545   }
3546 
3547   ComplexStructMemorySize(pStubMsg, pFormat, pointer_desc);
3548 
3549   if (conf_array)
3550   {
3551     pStubMsg->MaxCount = max_count;
3552     pStubMsg->ActualCount = count;
3553     pStubMsg->Offset = offset;
3554     array_memory_size(conf_array[0], pStubMsg, conf_array,
3555                       TRUE /* fHasPointers */);
3556   }
3557 
3558   return size;
3559 }
3560 
3561 /***********************************************************************
3562  *           NdrComplexStructFree [RPCRT4.@]
3563  */
3564 void WINAPI NdrComplexStructFree(PMIDL_STUB_MESSAGE pStubMsg,
3565                                  unsigned char *pMemory,
3566                                  PFORMAT_STRING pFormat)
3567 {
3568   PFORMAT_STRING conf_array = NULL;
3569   PFORMAT_STRING pointer_desc = NULL;
3570   unsigned char *OldMemory = pStubMsg->Memory;
3571 
3572   TRACE("(%p,%p,%p)\n", pStubMsg, pMemory, pFormat);
3573 
3574   pFormat += 4;
3575   if (*(const SHORT*)p