[ADVAPI32] Avoid excessive allocation in CheckTokenMembership. CORE-16094

dll/win32/advapi32/token/token.c

···
                                          0,
                                          sizeof(SECURITY_DESCRIPTOR) +
                                              sizeof(ACL) + SidLen +
-                                             sizeof(ACCESS_ALLOWED_ACE));
+                                             FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart));
     if (SecurityDescriptor == NULL)
     {
         Status = STATUS_INSUFFICIENT_RESOURCES;
···
     /* create the DACL */
     Dacl = (PACL)(SecurityDescriptor + 1);
     Status = RtlCreateAcl(Dacl,
-                          sizeof(ACL) + SidLen + sizeof(ACCESS_ALLOWED_ACE),
+                          sizeof(ACL) + SidLen + FIELD_OFFSET(ACCESS_ALLOWED_ACE, SidStart),
                           ACL_REVISION);
     if (!NT_SUCCESS(Status))
     {