WPF XpsSerialization crashes intermittently caused by double free #1554
Description
This is a port of a .NET Framework servicing bug: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/961349
During execution of CreateTTFDeltaEx, the call-chain may re-allocate and move *ppuchDestBuffer. If this happens and an error condition occurs, we will return the buffer that realloc de-allocated. Callers may then double-free *ppuchDestBuffer.
To fix this, set *ppuchDestBuffer to NULL after it is stored in OutputBufferInfo.puchBuffer. After this change, the non-error return will set *ppuchDestBuffer to OutputBufferInfo.puchBuffer as always, but the error case will de-allocate OutputBufferInfo.puchBuffer (as was intended) and return NULL in *ppuchDestBuffer. Callers then cannot double-free the buffer.