diff --git a/controls/combo.c b/controls/combo.c
index 5af3552f4f4..8d5828f5da5 100644
--- a/controls/combo.c
+++ b/controls/combo.c
@@ -425,7 +425,7 @@ static void CBPaintText(LPHEADCOMBO lphc, HDC32 hdc)
 
    if( lphc->wState & CBF_EDIT )
    {
-	if( CB_HASSTRINGS(lphc) ) SetWindowText32A( lphc->hWndEdit, pText );
+	if( CB_HASSTRINGS(lphc) ) SetWindowText32A( lphc->hWndEdit, pText ? pText : "" );
 	if( lphc->wState & CBF_FOCUSED ) 
 	    SendMessage32A( lphc->hWndEdit, EM_SETSEL32, 0, (LPARAM)(-1));
    }
@@ -491,7 +491,7 @@ static void CBPaintText(LPHEADCOMBO lphc, HDC32 hdc)
 	    {
 		ExtTextOut32A( hDC, rect.left + 1, rect.top + 1,
                                ETO_OPAQUE | ETO_CLIPPED, &rect,
-                               (pText) ? pText : "" , size, NULL );
+                               pText ? pText : "" , size, NULL );
 		if(lphc->wState & CBF_FOCUSED && !(lphc->wState & CBF_DROPPED))
 		    DrawFocusRect32( hDC, &rect );
 	    }
@@ -504,7 +504,8 @@ static void CBPaintText(LPHEADCOMBO lphc, HDC32 hdc)
 	    }
 	}
    }
-   HeapFree( GetProcessHeap(), 0, pText );
+   if (pText)
+	HeapFree( GetProcessHeap(), 0, pText );
 }
 
 /***********************************************************************
diff --git a/dlls/comctl32/tab.c b/dlls/comctl32/tab.c
index 21eca639ab1..50a3afd1755 100644
--- a/dlls/comctl32/tab.c
+++ b/dlls/comctl32/tab.c
@@ -262,7 +262,7 @@ TAB_InsertItem (WND *wndPtr, WPARAM32 wParam, LPARAM lParam)
 	/* post insert copy */
 	if (iItem < infoPtr->uNumItem - 1) {
 	    memcpy (&infoPtr->items[iItem+1], &oldItems[iItem],
-		    (infoPtr->uNumItem - iItem) * sizeof(TAB_ITEM));
+		    (infoPtr->uNumItem - iItem - 1) * sizeof(TAB_ITEM));
 
 	}
 	
diff --git a/memory/heap.c b/memory/heap.c
index 05dc8facfc7..e3eb621b4c1 100644
--- a/memory/heap.c
+++ b/memory/heap.c
@@ -1001,6 +1001,11 @@ BOOL32 WINAPI HeapFree(
     flags &= HEAP_NO_SERIALIZE;
     flags |= heapPtr->flags;
     if (!(flags & HEAP_NO_SERIALIZE)) HeapLock( heap );
+    if (!ptr)
+    {
+	WARN(heap, "(%08x,%08lx,%08lx): asked to free NULL\n",
+                   heap, flags, (DWORD)ptr );
+    }
     if (!ptr || !HeapValidate( heap, HEAP_NO_SERIALIZE, ptr ))
     {
         if (!(flags & HEAP_NO_SERIALIZE)) HeapUnlock( heap );