Tests show that NdrPointerFree (and hence NdrFree) don't check whether 
the memory was allocated with NdrAllocate before freeing it. This makes 
sense as servers don't need to use NdrAllocate to allocate memory being 
returned and so this commit caused that memory to be leaked.

NdrAllocate hasn't been changed as the tests show it is correct and it 
appears that the memory list is used to implement the RpcSs memory model.