Index: lib/rtl/heap.c
===================================================================
--- lib/rtl/heap.c	(revision 56208)
+++ lib/rtl/heap.c	(working copy)
@@ -476,7 +476,7 @@
             {
                 /* Release reserved memory */
                 ZwFreeVirtualMemory(NtCurrentProcess(),
-                                    (PVOID *)&UcrDescriptor,
+                                    (PVOID *)&UcrSegment,
                                     &ReserveSize,
                                     MEM_RELEASE);
                 return NULL;
@@ -510,7 +510,7 @@
         }
 
         /* There is a whole bunch of new UCR descriptors. Put them into the unused list */
-        while ((PCHAR)UcrDescriptor < ((PCHAR)UcrSegment + UcrSegment->CommittedSize))
+        while ((PCHAR)(UcrDescriptor + 1) < (PCHAR)UcrSegment + UcrSegment->CommittedSize)
         {
             InsertTailList(&Heap->UCRList, &UcrDescriptor->ListEntry);
             UcrDescriptor++;