This is done by putting the ORPCTHIS data into the buffer when calling
IRpcChannelBuffer::GetBuffer on the client side and then storing the
amount we increased the buffer in a structure stored in the Handle
field. This is done to present the correct Buffer pointer to the proxy
so that it writes its data after the ORPCTHIS data.

Unmarshal the data on the server side (during RPC_ExecuteCall) and make 
sure the data is consistent according to NDR rules. Also add several 
checks on the unmarshaled data that are specified by the DCOM draft 
specification.

Use the render target index rather than hardcoding 0.

derived from the return value of HMETAFILEPICT_UserMarshal instead of
the value returned by HMETAFILEPICT_UserSize, as the latter
over-estimates the size on Windows.

Remove some unnecessary casts.