The string in format is nul-terminated so use memcpy to copy it into
the buffer and don't try to nul-terminate it manually which causes a
write outside of the allocated buffer length.

Fix a similar off-by-one error in CLIPFORMAT_UserUnmarshal too. This
time it is only reading from beyond the buffer.