diff --git a/reactos/subsys/win32k/objects/fillshap.c b/reactos/subsys/win32k/objects/fillshap.c
index 8c6a557abb5..6a1a1fc9fe2 100644
--- a/reactos/subsys/win32k/objects/fillshap.c
+++ b/reactos/subsys/win32k/objects/fillshap.c
@@ -925,7 +925,7 @@ NtGdiPolyPolygon(HDC           hDC,
   DC *dc;
   LPPOINT Safept;
   LPINT SafePolyPoints;
-  NTSTATUS Status;
+  NTSTATUS Status = STATUS_SUCCESS;
   BOOL Ret;
 
   dc = DC_LockDc(hDC);
diff --git a/reactos/subsys/win32k/objects/rect.c b/reactos/subsys/win32k/objects/rect.c
index 4ebda5b6dc1..aa2b00ddc9f 100644
--- a/reactos/subsys/win32k/objects/rect.c
+++ b/reactos/subsys/win32k/objects/rect.c
@@ -70,7 +70,7 @@ IntGdiIsEmptyRect(const RECT* Rect)
 BOOL STDCALL
 NtGdiIsEmptyRect(const RECT* UnsafeRect)
 {
-  RECT Rect;
+  RECT Rect = {0};
   NTSTATUS Status = STATUS_SUCCESS;
 
   _SEH_TRY
diff --git a/reactos/subsys/win32k/objects/region.c b/reactos/subsys/win32k/objects/region.c
index 0b39ef1a146..5ceda5da141 100644
--- a/reactos/subsys/win32k/objects/region.c
+++ b/reactos/subsys/win32k/objects/region.c
@@ -2028,7 +2028,7 @@ HRGN
 STDCALL
 NtGdiCreateEllipticRgnIndirect(CONST PRECT Rect)
 {
-  RECT SafeRect;
+  RECT SafeRect = {0};
   NTSTATUS Status = STATUS_SUCCESS;
 
   _SEH_TRY
@@ -2073,7 +2073,7 @@ NtGdiCreateRectRgn(INT LeftRect, INT TopRect, INT RightRect, INT BottomRect)
 HRGN STDCALL
 NtGdiCreateRectRgnIndirect(CONST PRECT rc)
 {
-  RECT SafeRc;
+  RECT SafeRc = {0};
   NTSTATUS Status = STATUS_SUCCESS;
 
   _SEH_TRY
@@ -3510,8 +3510,9 @@ NtGdiCreatePolyPolygonRgn(CONST PPOINT  pt,
       ProbeForRead(PolyCounts,
                    Count * sizeof(INT),
                    1);
+      /* just probe one point for now, we don't know the length of the array yet */
       ProbeForRead(pt,
-                   nPoints * sizeof(POINT),
+                   sizeof(POINT),
                    1);
    }
    _SEH_HANDLE
@@ -3593,10 +3594,13 @@ NtGdiCreatePolyPolygonRgn(CONST PPOINT  pt,
 
    _SEH_TRY
    {
+      ProbeForRead(pt,
+                   nPoints * sizeof(POINT),
+                   1);
       /* pointers were already probed! */
       RtlCopyMemory(Safept,
                     pt,
-                    Count * sizeof(POINT));
+                    nPoints * sizeof(POINT));
    }
    _SEH_HANDLE
    {