diff --git a/reactos/lib/kernel32/misc/errormsg.c b/reactos/lib/kernel32/misc/errormsg.c
index 71c2a71c102..1862cdc316a 100644
--- a/reactos/lib/kernel32/misc/errormsg.c
+++ b/reactos/lib/kernel32/misc/errormsg.c
@@ -383,7 +383,7 @@ DWORD WINAPI FormatMessageW(
     LPWSTR from,f;
     DWORD width = dwFlags & FORMAT_MESSAGE_MAX_WIDTH_MASK;
     BOOL eos = FALSE;
-    CHAR ch;
+    WCHAR ch;
 
     TRACE("(0x%lx,%p,%ld,0x%lx,%p,%ld,%p)\n",
           dwFlags,lpSource,dwMessageId,dwLanguageId,lpBuffer,nSize,args);
diff --git a/reactos/lib/rtl/message.c b/reactos/lib/rtl/message.c
index bb786717e2b..c7530293d75 100644
--- a/reactos/lib/rtl/message.c
+++ b/reactos/lib/rtl/message.c
@@ -85,17 +85,20 @@ RtlFindMessage(PVOID BaseAddress,
 	  }
      }
 
+   if (MessageTable->NumberOfBlocks <= i)
+     {
+	return STATUS_MESSAGE_NOT_FOUND;
+     }
+
    MessageEntry = (PRTL_MESSAGE_RESOURCE_ENTRY)((PUCHAR)MessageTable + MessageTable->Blocks[i].OffsetToEntries);
 
    DPRINT("EntryOffset 0x%08lx\n", EntryOffset);
    DPRINT("IdOffset 0x%08lx\n", IdOffset);
 
    DPRINT("MessageEntry: %p\n", MessageEntry);
-   
-   for (i = 0; i < MessageTable->NumberOfBlocks; i++)
+   for (i = 0; i < IdOffset; i++)
      {
-         if (MessageId >= MessageTable->Blocks[i].LowId && MessageId <= MessageTable->Blocks[i].HighId)
-	        MessageEntry = (PRTL_MESSAGE_RESOURCE_ENTRY)((char *)MessageEntry + MessageEntry->Length);
+	MessageEntry = (PRTL_MESSAGE_RESOURCE_ENTRY)((PUCHAR)MessageEntry + (ULONG)MessageEntry->Length);
      }
 
    if (MessageEntry->Flags == 0)