diff --git a/dlls/rpcrt4/ndr_marshall.c b/dlls/rpcrt4/ndr_marshall.c
index 836410b..81afdba 100644
--- a/dlls/rpcrt4/ndr_marshall.c
+++ b/dlls/rpcrt4/ndr_marshall.c
@@ -2853,7 +2857,7 @@ unsigned char * WINAPI NdrComplexStructMarshall(PMIDL_STUB_MESSAGE pStubMsg,
   pFormat += 4;
   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
   pFormat += 2;
-  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
+  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const SHORT*)pFormat;
   pFormat += 2;
 
   pStubMsg->Memory = pMemory;
@@ -2921,7 +2925,7 @@ unsigned char * WINAPI NdrComplexStructUnmarshall(PMIDL_STUB_MESSAGE pStubMsg,
   pFormat += 4;
   if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
   pFormat += 2;
-  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
+  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const SHORT*)pFormat;
   pFormat += 2;
 
   pMemory = ComplexUnmarshall(pStubMsg, *ppMemory, pFormat, pointer_desc, fMustAlloc);
@@ -2975,9 +2979,9 @@ void WINAPI NdrComplexStructBufferSize(PMIDL_STUB_MESSAGE pStubMsg,
   }
 
   pFormat += 4;
-  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;
+  if (*(const SHORT*)pFormat) conf_array = pFormat + *(const SHORT*)pFormat;  
   pFormat += 2;
-  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const WORD*)pFormat;
+  if (*(const WORD*)pFormat) pointer_desc = pFormat + *(const SHORT*)pFormat;
   pFormat += 2;
 
   pStubMsg->Memory = pMemory;