Marshaling array of structs in COM

Hello,

I'm not an expert of COM programming, so my question may seem easy :-) :

I have a COM object that resides in a ATL service (my threading moddel is
"Free"). That object must return an array of C++ structs to the client
(which is another C++ process).
To achieve this, I'm using the IDL attribute "size_is", but without any
success : the marshaller copies only the first element of my array, as if
"size_is" were not specified.

Here is an simple example, what m I doing wrong ? thanks !

import "oaidl.idl";
import "ocidl.idl";

[
object,
uuid(2B146C74-7968-4E6B-8788-8352A1123648),
dual,
nonextensible,
helpstring("ITestObject Interface"),
pointer_default(unique)
]
interface ITestObject : IDispatch{
[id(8), helpstring("method CopyBuf")] HRESULT CopyBuf([out,
size_is(1,*size)] short *buf[], [out] int* size);
};

[
uuid(7F853A2E-369C-49E7-AAB5-A9768DAD9EA2),
version(1.0),
helpstring("TestComServ 1.0 Type Library")
]
library TestComServLib
{
importlib("stdole2.tlb");

[
uuid(20B2B9E1-88C6-4CE5-874C-109CA91D765B),
helpstring("TestObject Class")
]
coclass TestObject
{
[default] interface ITestObject;
};
};

/* ---------- */
Here is my method :
/* ---------- */

STDMETHODIMP CTestObject::CopyBuf(short *buf[], int *size)
{
*size = 3;
short *arr = (short*) CoTaskMemAlloc(sizeof(short) * *size);
arr[0] = 1;
arr[2] = 2;
arr[3] = 3;

*buf = arr;
return S_OK;
}

/* ---------- */
Here is my client :
/* ---------- */

IClassFactory *pCF;
res = ::CoGetClassObject(CLSID_TestObject, CLSCTX_LOCAL_SERVER, 0,
IID_IClassFactory, (LPVOID*)&pCF);

IUnknown *pUnk;
res = pCF->CreateInstance(NULL, IID_IUnknown, (LPVOID*)&pUnk);
pCF->Release();

ITestObject *obj;
res = pUnk->QueryInterface(IID_ITestObject, (void**)&obj);

int size;
short *buf;
res = obj->CopyBuf(&buf, &size); // ERROR : only buf[0] is valid after the
call

obj->Release();
pUnk->Release();