Dan Kegel : kernel32: Fix write buffer overrun in format_insertW.