diff --git a/reactos/lib/rtl/bitmap.c b/reactos/lib/rtl/bitmap.c
index 871556af411..f0e1bafa364 100644
--- a/reactos/lib/rtl/bitmap.c
+++ b/reactos/lib/rtl/bitmap.c
@@ -421,7 +421,7 @@ RtlNumberOfSetBits(
     }
 
     Shift = 8 - (BitMapHeader->SizeOfBitMap & 7);
-    BitCount += BitCountTable[(*Byte) << Shift];
+    BitCount += BitCountTable[((*Byte) << Shift) & 0xFF];
 
     return BitCount;
 }
@@ -618,6 +618,13 @@ RtlFindNextForwardRunClear(
 {
     ULONG Length;
 
+    /* Check for buffer overrun */
+    if (FromIndex >= BitMapHeader->SizeOfBitMap)
+    {
+        *StartingRunIndex = FromIndex;
+        return 0;
+    }
+
     /* Assume a set run first, count it's length */
     Length = RtlpGetLengthOfRunSet(BitMapHeader, FromIndex, MAXULONG);
     *StartingRunIndex = FromIndex + Length;
@@ -635,6 +642,13 @@ RtlFindNextForwardRunSet(
 {
     ULONG Length;
 
+    /* Check for buffer overrun */
+    if (FromIndex >= BitMapHeader->SizeOfBitMap)
+    {
+        *StartingRunIndex = FromIndex;
+        return 0;
+    }
+
     /* Assume a clear run first, count it's length */
     Length = RtlpGetLengthOfRunClear(BitMapHeader, FromIndex, MAXULONG);
     *StartingRunIndex = FromIndex + Length;