r25272: Fix a bunch of callers of pull_ucs2 that passed -1 for dest_len.