oleaut32: Handle non-byref safe arrays in VARIANT_UserFree.
diff --git a/dlls/oleaut32/usrmarshal.c b/dlls/oleaut32/usrmarshal.c
index 49381b3..3f84fab 100644
--- a/dlls/oleaut32/usrmarshal.c
+++ b/dlls/oleaut32/usrmarshal.c
@@ -661,7 +661,12 @@
   if (!ref) return;
 
   if(vt & VT_ARRAY)
-    LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
+  {
+    if (vt & VT_BYREF)
+      LPSAFEARRAY_UserFree(pFlags, V_ARRAYREF(pvar));
+    else
+      LPSAFEARRAY_UserFree(pFlags, &V_ARRAY(pvar));
+  }
   else
   {
     switch (vt)