- Fix ref count on standard proxy creation.

dlls/ole32/marshal.c

@@ -315,13 +315,20 @@ StdMarshalImpl_UnmarshalInterface(
     return hres;
   }
   hres = PIPE_GetNewPipeBuf(&mid,&chanbuf);
+  IPSFactoryBuffer_Release(psfacbuf);
   if (hres) {
     ERR("Failed to get an rpc channel buffer for %s\n",debugstr_guid(riid));
   } else {
+    /* Connect the channel buffer to the proxy and release the no longer
+     * needed proxy.
+     * NOTE: The proxy should have taken an extra reference because it also
+     * aggregates the object, so we can safely release our reference to it. */
     IRpcProxyBuffer_Connect(rpcproxy,chanbuf);
-    IRpcProxyBuffer_Release(rpcproxy); /* no need */
+    IRpcProxyBuffer_Release(rpcproxy);
+    /* IRpcProxyBuffer takes a reference on the channel buffer and
+     * we no longer need it, so release it */
+    IRpcChannelBuffer_Release(chanbuf);
   }
-  IPSFactoryBuffer_Release(psfacbuf);
   return hres;
 }
 

dlls/ole32/oleproxy.c

@@ -435,7 +435,8 @@ CFProxy_Construct(LPVOID *ppv,LPVOID *ppProxy) {
 
     cf->lpvtbl_cf	= &cfproxyvt;
     cf->lpvtbl_proxy	= &pspbvtbl;
-    cf->ref		= 2; /* we return 2 references to the object! */
+    /* 1 reference for the proxy and 1 for the object */
+    cf->ref		= 2;
     *ppv		= &(cf->lpvtbl_cf);
     *ppProxy		= &(cf->lpvtbl_proxy);
     return S_OK;

dlls/oleaut32/tmarshal.c

@@ -1409,6 +1409,7 @@ PSFacBuf_CreateProxy(
 	proxy->lpvtbl[i] = (DWORD)xasm;
     }
     proxy->lpvtbl2	= &tmproxyvtable;
+    /* 1 reference for the proxy and 1 for the object */
     proxy->ref		= 2;
     proxy->tinfo	= tinfo;
     memcpy(&proxy->iid,riid,sizeof(*riid));

dlls/rpcrt4/cproxy.c

@@ -172,7 +172,8 @@ HRESULT WINAPI StdProxy_Construct(REFIID riid,
     This->PVtbl = vtbl->Vtbl;
 
   This->lpVtbl = &StdProxy_Vtbl;
-  This->RefCount = 1;
+  /* 1 reference for the proxy and 1 for the object */
+  This->RefCount = 2;
   This->stubless = stubless;
   This->piid = vtbl->header.piid;
   This->pUnkOuter = pUnkOuter;
@@ -190,6 +191,9 @@ static void WINAPI StdProxy_Destruct(LPRPCPROXYBUFFER iface)
 {
   ICOM_THIS_MULTI(StdProxyImpl,lpVtbl,iface);
 
+  if (This->pChannel)
+    IRpcProxyBuffer_Disconnect(iface);
+
   IPSFactoryBuffer_Release(This->pPSFactory);
   if (This->thunks) {
     HeapFree(GetProcessHeap(),0,This->PVtbl);
@@ -248,6 +252,7 @@ static HRESULT WINAPI StdProxy_Connect(LPRPCPROXYBUFFER iface,
   TRACE("(%p)->Connect(%p)\n",This,pChannel);
 
   This->pChannel = pChannel;
+  IRpcChannelBuffer_AddRef(pChannel);
   return S_OK;
 }
 
@@ -256,6 +261,7 @@ static VOID WINAPI StdProxy_Disconnect(LPRPCPROXYBUFFER iface)
   ICOM_THIS_MULTI(StdProxyImpl,lpVtbl,iface);
   TRACE("(%p)->Disconnect()\n",This);
 
+  IRpcChannelBuffer_Release(This->pChannel);
   This->pChannel = NULL;
 }