You can use multiple pointers such as a ref pointer to another ref pointer that points to the character array as shown:
void Analyze(
[in, string] char *pszInput,
[out, string, size_is(STRSIZE)] char **ppszOutput);
When there are multiple levels of pointers, the attributes are associated with the pointer closest to the variable name. The client is still responsible for allocating any memory associated with the response.
The following example allows the stub to call the server without knowing in advance how much data will be returned:
[uuid( ...),
version(3.3),
pointer_default(unique)] //required whenever you
// have pointers to pointers
// pointer has to be unique so
// that it can be NULL if
// necessary
HRESULT GetBars([out] long * pSize,
[out, size_is( , *pSize)]
BAR ** ppBar);//BAR type defined elsewhere
In this example, the stub passes the server a unique pointer, which the server initializes to NULL. The server then allocates a block of BARs, sets the pointer, sets the size argument and returns. Note that in order for the server to have an effect on the caller you must pass a [ref] pointer to a [unique] pointer to your data. Also note the comma in size_is( , *pSize ), which says that the top level pointer is not a sized pointer, but the lower level pointer is a sized pointer.
On the client side, the stub allocates the block, asigns the address to the ppBar argument and unmarshals BAR objects. The size of the block (and the number of unmarshaled BARs) is indicated by the size argument.