ole32: Fix buffer overrun in CLIPFORMAT_UserMarshal.

[Rob Shearman]

The string in format is nul-terminated so use memcpy to copy it into
the buffer and don't try to nul-terminate it manually which causes a
write outside of the allocated buffer length.

Fix a similar off-by-one error in CLIPFORMAT_UserUnmarshal too. This
time it is only reading from beyond the buffer.
---
 dlls/ole32/usrmarshal.c |   10 ++++------
 1 files changed, 4 insertions(+), 6 deletions(-)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0002-ole32-Fix-buffer-overrun-in-CLIPFORMAT_UserMarshal.patch
Type: text/x-patch
Size: 1485 bytes
Desc: not available
URL: <http://www.winehq.org/pipermail/wine-patches/attachments/20091120/50093081/attachment.bin>