oleaut32: Fix size of memory allocated for byrefs in VARIANT_UserMarshal.

dlls/oleaut32/usrmarshal.c

@@ -552,14 +552,29 @@ unsigned char * WINAPI VARIANT_UserUnmarshal(ULONG *pFlags, unsigned char *Buffe
 
     if(header->vt & VT_BYREF)
     {
+        ULONG mem_size;
         Pos += 4;
+
+        switch (header->vt & ~VT_BYREF)
+        {
+        /* these types have a different memory size compared to wire size */
+        case VT_UNKNOWN:
+        case VT_DISPATCH:
+        case VT_BSTR:
+            mem_size = sizeof(void *);
+            break;
+        default:
+            mem_size = type_size;
+            break;
+        }
+
         if (V_VT(pvar) != header->vt)
         {
             VariantClear(pvar);
-            V_BYREF(pvar) = CoTaskMemAlloc(type_size);
+            V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
         }
         else if (!V_BYREF(pvar))
-            V_BYREF(pvar) = CoTaskMemAlloc(type_size);
+            V_BYREF(pvar) = CoTaskMemAlloc(mem_size);
         memcpy(V_BYREF(pvar), Pos, type_size);
         if((header->vt & VT_TYPEMASK) != VT_VARIANT)
             Pos += type_size;