Apparently, this has been patched and fixed, see https://sourceforge.net/p/mingw-w64/mailman/message/37670051/
VarDecFromStr should take LPCOLESTR and not OLESTR*
GnuWin32 installer deploys trojan CVE-2014-6271