OLE: Fix brokenness in typelib marshaller caused by dispinterface retval fix.
Fix more fallout from dispinterface retval patch: make typelib
marshaler use the internal function description so that it calls
dispinterface functions with the correct number of parameters again.
Also fixes some memory leaks caused by the fact that a corresponding
ReleaseXDesc function has to be called for each GetXDesc.

dlls/oleaut32/tmarshal.c

diff --git a/dlls/oleaut32/tmarshal.c b/dlls/oleaut32/tmarshal.c
index 0886fc3..50a9135 100644
--- a/dlls/oleaut32/tmarshal.c
+++ b/dlls/oleaut32/tmarshal.c
@@ -304,12 +304,12 @@
  */
 static int _nroffuncs(ITypeInfo *tinfo) {
     int 	n, max = 0;
-    FUNCDESC	*fdesc;
+    const FUNCDESC *fdesc;
     HRESULT	hres;
 
     n=0;
     while (1) {
-	hres = ITypeInfo_GetFuncDesc(tinfo,n,&fdesc);
+	hres = ITypeInfoImpl_GetInternalFuncDesc(tinfo,n,&fdesc);
 	if (hres)
 	    return max+1;
 	if (fdesc->oVft/4 > max)
@@ -1053,6 +1053,7 @@
 			    (DWORD*)(((LPBYTE)*arg)+vdesc->u.oInst),
 			    buf
 			);
+                        ITypeInfo2_ReleaseVarDesc(tinfo2, vdesc);
 		        if (debugout && (i<tattr->cVars-1)) TRACE_(olerelay)(",");
 		    }
 		    if (debugout) TRACE_(olerelay)("}");
@@ -1108,7 +1109,7 @@
 /* Searches function, also in inherited interfaces */
 static HRESULT
 _get_funcdesc(
-    ITypeInfo *tinfo, int iMethod, ITypeInfo **tactual, FUNCDESC **fdesc, BSTR *iname, BSTR *fname)
+    ITypeInfo *tinfo, int iMethod, ITypeInfo **tactual, const FUNCDESC **fdesc, BSTR *iname, BSTR *fname)
 {
     int i = 0, j = 0;
     HRESULT hres;
@@ -1120,7 +1121,8 @@
     ITypeInfo_AddRef(*tactual);
 
     while (1) {
-	hres = ITypeInfo_GetFuncDesc(tinfo, i, fdesc);
+	hres = ITypeInfoImpl_GetInternalFuncDesc(tinfo, i, fdesc);
+
 	if (hres) {
 	    ITypeInfo	*tinfo2;
 	    HREFTYPE	href;
@@ -1164,7 +1166,7 @@
 xCall(LPVOID retptr, int method, TMProxyImpl *tpinfo /*, args */)
 {
     DWORD		*args = ((DWORD*)&tpinfo)+1, *xargs;
-    FUNCDESC		*fdesc;
+    const FUNCDESC	*fdesc;
     HRESULT		hres;
     int			i, relaydeb = TRACE_ON(olerelay);
     marshal_state	buf;
@@ -1451,7 +1453,7 @@
     HRESULT	hres;
     ITypeInfo	*tinfo;
     int		i, nroffuncs;
-    FUNCDESC	*fdesc;
+    const FUNCDESC *fdesc;
     TMProxyImpl	*proxy;
     TYPEATTR	*typeattr;
 
@@ -1647,7 +1649,7 @@
     LPRPCSTUBBUFFER iface, RPCOLEMESSAGE* xmsg,IRpcChannelBuffer*rpcchanbuf)
 {
     int		i;
-    FUNCDESC	*fdesc;
+    const FUNCDESC *fdesc;
     TMStubImpl *This = (TMStubImpl *)iface;
     HRESULT	hres;
     DWORD	*args, res, *xargs, nrofargs;

dlls/oleaut32/typelib.c

diff --git a/dlls/oleaut32/typelib.c b/dlls/oleaut32/typelib.c
index b2f417e..ebf1903 100644
--- a/dlls/oleaut32/typelib.c
+++ b/dlls/oleaut32/typelib.c
@@ -4489,6 +4489,24 @@
     return S_OK;
 }
 
+HRESULT ITypeInfoImpl_GetInternalFuncDesc( ITypeInfo *iface, UINT index, const FUNCDESC **ppFuncDesc )
+{
+    ITypeInfoImpl *This = (ITypeInfoImpl *)iface;
+    const TLBFuncDesc *pFDesc;
+    int i;
+
+    for(i=0, pFDesc=This->funclist; i!=index && pFDesc; i++, pFDesc=pFDesc->next)
+        ;
+
+    if (pFDesc)
+    {
+        *ppFuncDesc = &pFDesc->funcdesc;
+        return S_OK;
+    }
+
+    return E_INVALIDARG;
+}
+
 /* ITypeInfo::GetFuncDesc
  *
  * Retrieves the FUNCDESC structure that contains information about a
@@ -4499,21 +4517,19 @@
         LPFUNCDESC  *ppFuncDesc)
 {
     ITypeInfoImpl *This = (ITypeInfoImpl *)iface;
-    int i;
-    const TLBFuncDesc *pFDesc;
+    const FUNCDESC *internal_funcdesc;
+    HRESULT hr;
 
     TRACE("(%p) index %d\n", This, index);
 
-    for(i=0, pFDesc=This->funclist; i!=index && pFDesc; i++, pFDesc=pFDesc->next)
-        ;
+    hr = ITypeInfoImpl_GetInternalFuncDesc((ITypeInfo *)iface, index, &internal_funcdesc);
+    if (FAILED(hr))
+        return hr;
 
-    if(pFDesc)
-        return TLB_AllocAndInitFuncDesc(
-            &pFDesc->funcdesc,
-            ppFuncDesc,
-            This->TypeAttr.typekind == TKIND_DISPATCH);
-
-    return E_INVALIDARG;
+    return TLB_AllocAndInitFuncDesc(
+        internal_funcdesc,
+        ppFuncDesc,
+        This->TypeAttr.typekind == TKIND_DISPATCH);
 }
 
 static HRESULT TLB_AllocAndInitVarDesc( const VARDESC *src, VARDESC **dest_ptr )

dlls/oleaut32/typelib.h

diff --git a/dlls/oleaut32/typelib.h b/dlls/oleaut32/typelib.h
index 3bb6811..c286fae 100644
--- a/dlls/oleaut32/typelib.h
+++ b/dlls/oleaut32/typelib.h
@@ -600,6 +600,8 @@
 
 #include "poppack.h"
 
+HRESULT ITypeInfoImpl_GetInternalFuncDesc( ITypeInfo *iface, UINT index, const FUNCDESC **ppFuncDesc );
+
 extern DWORD _invoke(FARPROC func,CALLCONV callconv, int nrargs, DWORD *args);
 extern void dump_Variant(const VARIANT * pvar);