rpcrt4: Fix implicit in attribute handling in write_param_fs.

dlls/oleaut32/tests/tmarshal.c

@@ -1571,6 +1571,14 @@ static HRESULT WINAPI Widget_Coclass_ptr(IWidget *iface, Coclass1 **in, Coclass1
     return S_OK;
 }
 
+static HRESULT WINAPI Widget_no_in_out(IWidget *iface, BSTR str, int i)
+{
+    ok(SysStringLen(str) == 4, "unexpected len\n");
+    ok(!lstrcmpW(str, L"test"), "unexpected str %s\n", wine_dbgstr_w(str));
+    ok(i == 5, "i = %d\n", i);
+    return S_OK;
+}
+
 static const struct IWidgetVtbl Widget_VTable =
 {
     Widget_QueryInterface,
@@ -1629,6 +1637,7 @@ static const struct IWidgetVtbl Widget_VTable =
     Widget_myint,
     Widget_Coclass,
     Widget_Coclass_ptr,
+    Widget_no_in_out,
 };
 
 static HRESULT WINAPI StaticWidget_QueryInterface(IStaticWidget *iface, REFIID riid, void **ppvObject)
@@ -2441,6 +2450,10 @@ static void test_marshal_bstr(IWidget *widget, IDispatch *disp)
     out = in_ptr = in_out = NULL;
     hr = IWidget_bstr(widget, NULL, &out, &in_ptr, &in_out);
     ok(hr == S_OK, "Got hr %#x.\n", hr);
+
+    in = SysAllocString(L"test");
+    hr = IWidget_no_in_out(widget, in, 5);
+    ok(hr == S_OK, "Got hr %#x.\n", hr);
 }
 
 static void test_marshal_variant(IWidget *widget, IDispatch *disp)

dlls/oleaut32/tests/tmarshal.idl

@@ -72,6 +72,7 @@ enum IWidget_dispids
     DISPID_TM_TYPEDEF,
     DISPID_TM_COCLASS,
     DISPID_TM_COCLASS_PTR,
+    DISPID_TM_NOINOUT
 };
 
 static const int DISPID_TM_NEG_RESTRICTED = -26;
@@ -373,6 +374,9 @@ library TestTypelib
 
         [id(DISPID_TM_COCLASS_PTR)]
         HRESULT Coclass_ptr([in] Coclass1 **in, [out] Coclass1 **out, [in, out] Coclass1 **in_out);
+
+        [id(DISPID_TM_NOINOUT)]
+        HRESULT no_in_out(BSTR str, int i);
     }
 
     [

dlls/rpcrt4/ndr_typelib.c

@@ -1026,16 +1026,18 @@ static HRESULT write_param_fs(ITypeInfo *typeinfo, unsigned char *type,
         BOOL is_return, unsigned short *stack_offset)
 {
     USHORT param_flags = desc->paramdesc.wParamFlags;
-    int is_in  = param_flags & PARAMFLAG_FIN;
-    int is_out = param_flags & PARAMFLAG_FOUT;
     TYPEDESC *tdesc = &desc->tdesc, *tfs_tdesc;
     unsigned short server_size;
     unsigned short stack_size = get_stack_size(typeinfo, tdesc);
     unsigned char basetype;
     unsigned short flags;
+    int is_in, is_out;
     size_t off = 0;
     HRESULT hr;
 
+    is_out = param_flags & PARAMFLAG_FOUT;
+    is_in = (param_flags & PARAMFLAG_FIN) || (!is_out && !is_return);
+
     hr = get_param_info(typeinfo, tdesc, is_in, is_out, &server_size, &flags,
             &basetype, &tfs_tdesc);