rpcrt4: Fix buffer size calculation for arrays with embedded pointers

[Huw Davies]

On Thu, Sep 18, 2014 at 02:29:07PM +0200, Eric Kohl wrote:
> I finally found the bug in the function EmbeddedPointerBufferSize where
> the pointer to the current array element was not incremented while the
> surrounding for loop traversed the array. The pointer was always
> pointing at the first element of the array. I also found the same bug in
> the function EmbeddedPointerMarshall.

Perhaps also EmbeddedPointerFree?  We probably need some tests.

Huw.