diff --git a/reactos/dll/win32/user32/windows/bitmap.c b/reactos/dll/win32/user32/windows/bitmap.c
index b9016a76986..3124929186d 100644
--- a/reactos/dll/win32/user32/windows/bitmap.c
+++ b/reactos/dll/win32/user32/windows/bitmap.c
@@ -735,7 +735,7 @@ CopyImage(
 
                     /* Fill in biSizeImage */
                     GetDIBits(dc, hnd, 0, ds.dsBm.bmHeight, NULL, bi, DIB_RGB_COLORS);
-                    bits = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bi->bmiHeader.biSizeImage * 2); /* HACK */
+                    bits = HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, bi->bmiHeader.biSizeImage);
 
                     if (bits)
                     {
diff --git a/reactos/dll/win32/user32/windows/dialog.c b/reactos/dll/win32/user32/windows/dialog.c
index e1be9825296..0c7dd3002fb 100644
--- a/reactos/dll/win32/user32/windows/dialog.c
+++ b/reactos/dll/win32/user32/windows/dialog.c
@@ -242,7 +242,7 @@ static const WORD *DIALOG_GetControl32( const WORD *p, DLG_CONTROL_INFO *info,
 
     if (GET_WORD(p) == 0xffff)  /* Is it an integer id? */
     {
-        info->windowName = HeapAlloc( GetProcessHeap(), 0, 10 );
+        info->windowName = HeapAlloc( GetProcessHeap(), 0, sizeof(L"#65535") );
         swprintf((LPWSTR)info->windowName, L"#%d", GET_WORD(p + 1));
         info->windowNameFree = TRUE;
         p += 2;
diff --git a/reactos/dll/win32/user32/windows/menu.c b/reactos/dll/win32/user32/windows/menu.c
index 0a803b7a36d..4eab32578eb 100644
--- a/reactos/dll/win32/user32/windows/menu.c
+++ b/reactos/dll/win32/user32/windows/menu.c
@@ -236,6 +236,7 @@ MenuCleanupRosMenuItemInfo(PROSMENUITEMINFO ItemInfo)
   if (ItemInfo->dwTypeData != NULL)
     {
       HeapFree(GetProcessHeap(), 0, ItemInfo->dwTypeData);
+      ItemInfo->dwTypeData = NULL;
     }
 }