BMessage::ReplaceData: potential corruption on realloc fail

The method would update the field offsets first, and would not restore
them in case of realloc failure, leaving them pointing to the wrong
place.

headers/os/app/Message.h

@@ -510,6 +510,7 @@ private:
 
 			status_t			_ValidateMessage();
 
+			void				_UpdateOffsets(uint32 offset, int32 change);
 			status_t			_ResizeData(uint32 offset, int32 change);
 
 			uint32				_HashName(const char* name) const;