One can now pass -1 as array len so that its size will be computed
later on (useful for dealing with forward declarations where size is
not known at array definition).

The string in format is nul-terminated so use memcpy to copy it into
the buffer and don't try to nul-terminate it manually which causes a
write outside of the allocated buffer length.

Fix a similar off-by-one error in CLIPFORMAT_UserUnmarshal too. This
time it is only reading from beyond the buffer.