Index: C:/ROS/reactos/dll/win32/rpcrt4/ndr_marshall.c
===================================================================
--- dll/win32/rpcrt4/ndr_marshall.c	(revision 63837)
+++ dll/win32/rpcrt4/ndr_marshall.c	(working copy)
@@ -1120,7 +1120,7 @@
    * BufferStart and BufferEnd won't be reset when allocating memory for
    * sending the response. we don't have to check for the new buffer here as
    * it won't be used a type memory, only for buffer memory */
-  if (Pointer >= pStubMsg->BufferStart && Pointer < pStubMsg->BufferEnd)
+  if (Pointer >= pStubMsg->BufferStart && Pointer <= pStubMsg->BufferEnd)
       goto notfree;
 
   if (attr & RPC_FC_P_ONSTACK) {