ole32: Fix buffer overrun in CLIPFORMAT_UserMarshal.