diff --git a/dlls/ole32/tests/usrmarshal.c b/dlls/ole32/tests/usrmarshal.c
index 839ade07ebb..cff3ae5f122 100644
--- a/dlls/ole32/tests/usrmarshal.c
+++ b/dlls/ole32/tests/usrmarshal.c
@@ -187,31 +187,32 @@ static void test_marshal_CLIPFORMAT(void)
     USER_MARSHAL_CB umcb;
     MIDL_STUB_MESSAGE stub_msg;
     RPC_MESSAGE rpc_msg;
-    unsigned char *buffer;
+    unsigned char *buffer, *buffer_end;
     ULONG i, size;
     CLIPFORMAT cf = RegisterClipboardFormatA("MyFormat");
     CLIPFORMAT cf2;
 
     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, NULL, 0, MSHCTX_DIFFERENTMACHINE);
-    size = CLIPFORMAT_UserSize(&umcb.Flags, 0, &cf);
-    ok(size == 8 + sizeof(cf_marshaled) ||
-       broken(size == 12 + sizeof(cf_marshaled)) ||  /* win64 adds 4 extra (unused) bytes */
-       broken(size == 8 + sizeof(cf_marshaled) - 2), /* win9x and winnt don't include the '\0' */
+    size = CLIPFORMAT_UserSize(&umcb.Flags, 1, &cf);
+    ok(size == 12 + sizeof(cf_marshaled) ||
+       broken(size == 16 + sizeof(cf_marshaled)),  /* win64 adds 4 extra (unused) bytes */
               "CLIPFORMAT: Wrong size %d\n", size);
 
     buffer = HeapAlloc(GetProcessHeap(), 0, size);
     memset( buffer, 0xcc, size );
     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
-    CLIPFORMAT_UserMarshal(&umcb.Flags, buffer, &cf);
-    ok(*(LONG *)(buffer + 0) == WDT_REMOTE_CALL, "CLIPFORMAT: Context should be WDT_REMOTE_CALL instead of 0x%08x\n", *(LONG *)(buffer + 0));
-    ok(*(DWORD *)(buffer + 4) == cf, "CLIPFORMAT: Marshaled value should be 0x%04x instead of 0x%04x\n", cf, *(DWORD *)(buffer + 4));
-    ok(!memcmp(buffer + 8, cf_marshaled, min( sizeof(cf_marshaled), size-8 )), "Marshaled data differs\n");
-    if (size > sizeof(cf_marshaled) + 8)  /* make sure the extra bytes are not used */
-        for (i = sizeof(cf_marshaled) + 8; i < size; i++)
+    buffer_end = CLIPFORMAT_UserMarshal(&umcb.Flags, buffer + 1, &cf);
+    ok(buffer_end == buffer + 12 + sizeof(cf_marshaled), "got %p buffer %p\n", buffer_end, buffer);
+    ok(*(LONG *)(buffer + 4) == WDT_REMOTE_CALL, "CLIPFORMAT: Context should be WDT_REMOTE_CALL instead of 0x%08x\n", *(LONG *)(buffer + 0));
+    ok(*(DWORD *)(buffer + 8) == cf, "CLIPFORMAT: Marshaled value should be 0x%04x instead of 0x%04x\n", cf, *(DWORD *)(buffer + 4));
+    ok(!memcmp(buffer + 12, cf_marshaled, min( sizeof(cf_marshaled), size-12 )), "Marshaled data differs\n");
+    if (size > sizeof(cf_marshaled) + 12)  /* make sure the extra bytes are not used */
+        for (i = sizeof(cf_marshaled) + 12; i < size; i++)
             ok( buffer[i] == 0xcc, "buffer offset %u has been set to %x\n", i, buffer[i] );
 
     init_user_marshal_cb(&umcb, &stub_msg, &rpc_msg, buffer, size, MSHCTX_DIFFERENTMACHINE);
-    CLIPFORMAT_UserUnmarshal(&umcb.Flags, buffer, &cf2);
+    buffer_end = CLIPFORMAT_UserUnmarshal(&umcb.Flags, buffer + 1, &cf2);
+    ok(buffer_end == buffer + 12 + sizeof(cf_marshaled), "got %p buffer %p\n", buffer_end, buffer);
     ok(cf == cf2, "CLIPFORMAT: Didn't unmarshal properly\n");
     HeapFree(GetProcessHeap(), 0, buffer);
 
diff --git a/dlls/ole32/usrmarshal.c b/dlls/ole32/usrmarshal.c
index 6efd99e3902..4ebf7f823dd 100644
--- a/dlls/ole32/usrmarshal.c
+++ b/dlls/ole32/usrmarshal.c
@@ -98,11 +98,11 @@ static const char* debugstr_user_flags(ULONG *pFlags)
  *  the first parameter is an unsigned long.
  *  This function is only intended to be called by the RPC runtime.
  */
-ULONG __RPC_USER CLIPFORMAT_UserSize(ULONG *pFlags, ULONG StartingSize, CLIPFORMAT *pCF)
+ULONG __RPC_USER CLIPFORMAT_UserSize(ULONG *pFlags, ULONG size, CLIPFORMAT *pCF)
 {
-    ULONG size = StartingSize;
+    TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), size, pCF);
 
-    TRACE("(%s, %d, %p\n", debugstr_user_flags(pFlags), StartingSize, pCF);
+    ALIGN_LENGTH(size, 3);
 
     size += 8;
 
@@ -147,6 +147,8 @@ unsigned char * __RPC_USER CLIPFORMAT_UserMarshal(ULONG *pFlags, unsigned char *
 {
     TRACE("(%s, %p, &0x%04x\n", debugstr_user_flags(pFlags), pBuffer, *pCF);
 
+    ALIGN_POINTER(pBuffer, 3);
+
     /* only need to marshal the name if it is not a pre-defined type and
      * we are going remote */
     if ((*pCF >= 0xc000) && (LOWORD(*pFlags) == MSHCTX_DIFFERENTMACHINE))
@@ -209,6 +211,8 @@ unsigned char * __RPC_USER CLIPFORMAT_UserUnmarshal(ULONG *pFlags, unsigned char
 
     TRACE("(%s, %p, %p\n", debugstr_user_flags(pFlags), pBuffer, pCF);
 
+    ALIGN_POINTER(pBuffer, 3);
+
     fContext = *(DWORD *)pBuffer;
     pBuffer += 4;