va_list passed to RtlFormatMessage is modified even on error in this
case, if the buffer is not large enough, STATUS_BUFFER_OVERFLOW is
returned and FormatMessage tries again, but the va_list pointer is now
moved to a later argument, so the next call reads off the end,
crashing.
Signed-off-by: Daniel Lehman <dlehman25@gmail.com>
Signed-off-by: Alexandre Julliard <julliard@winehq.org>