[Bug 20840] Read buffer overflow in RtlValidAcl?