[Bug 20759] Read buffer overflow in NdrConformantArrayMarshall?