[PATCH] msxml3: Fix string length handling in I[VB]SAXContentHandler::characters.

[Jacek Caban]

Windows crashes when -1 length is passed. Escaping should just copy 
embedded null bytes.

Signed-off-by: Jacek Caban <jacek(a)codeweavers.com>
---
  dlls/msxml3/mxwriter.c        | 10 ++---
  dlls/msxml3/tests/saxreader.c | 72 ++++++++++++++++++++++++++++++++++-
  2 files changed, 76 insertions(+), 6 deletions(-)