diff --git a/channels/disp/client/disp_main.c b/channels/disp/client/disp_main.c
index 144927962..0f8a11567 100644
--- a/channels/disp/client/disp_main.c
+++ b/channels/disp/client/disp_main.c
@@ -119,8 +119,8 @@ disp_send_display_control_monitor_layout_pdu(GENERIC_CHANNEL_CALLBACK* callback,
 			current.Height = 8192;
 
 		Stream_Write_UINT32(s, current.Flags);              /* Flags (4 bytes) */
-		Stream_Write_UINT32(s, current.Left);               /* Left (4 bytes) */
-		Stream_Write_UINT32(s, current.Top);                /* Top (4 bytes) */
+		Stream_Write_INT32(s, current.Left);                /* Left (4 bytes) */
+		Stream_Write_INT32(s, current.Top);                 /* Top (4 bytes) */
 		Stream_Write_UINT32(s, current.Width);              /* Width (4 bytes) */
 		Stream_Write_UINT32(s, current.Height);             /* Height (4 bytes) */
 		Stream_Write_UINT32(s, current.PhysicalWidth);      /* PhysicalWidth (4 bytes) */
diff --git a/channels/rdpgfx/server/rdpgfx_main.c b/channels/rdpgfx/server/rdpgfx_main.c
index a9c210bc1..2d00fa445 100644
--- a/channels/rdpgfx/server/rdpgfx_main.c
+++ b/channels/rdpgfx/server/rdpgfx_main.c
@@ -293,10 +293,10 @@ static UINT rdpgfx_send_reset_graphics_pdu(RdpgfxServerContext* context,
 	for (UINT32 index = 0; index < pdu->monitorCount; index++)
 	{
 		const MONITOR_DEF* monitor = &(pdu->monitorDefArray[index]);
-		Stream_Write_UINT32(s, monitor->left);   /* left (4 bytes) */
-		Stream_Write_UINT32(s, monitor->top);    /* top (4 bytes) */
-		Stream_Write_UINT32(s, monitor->right);  /* right (4 bytes) */
-		Stream_Write_UINT32(s, monitor->bottom); /* bottom (4 bytes) */
+		Stream_Write_INT32(s, monitor->left);    /* left (4 bytes) */
+		Stream_Write_INT32(s, monitor->top);     /* top (4 bytes) */
+		Stream_Write_INT32(s, monitor->right);   /* right (4 bytes) */
+		Stream_Write_INT32(s, monitor->bottom);  /* bottom (4 bytes) */
 		Stream_Write_UINT32(s, monitor->flags);  /* flags (4 bytes) */
 	}
 
diff --git a/channels/urbdrc/client/data_transfer.c b/channels/urbdrc/client/data_transfer.c
index d9ad5e759..c06979975 100644
--- a/channels/urbdrc/client/data_transfer.c
+++ b/channels/urbdrc/client/data_transfer.c
@@ -493,9 +493,9 @@ static UINT urb_select_configuration(IUDEVICE* pdev, GENERIC_CHANNEL_CALLBACK* c
 	if (MsOutSize > 0)
 	{
 		/** CbTsUrbResult */
-		Stream_Write_UINT32(out, 8 + MsOutSize);
+		Stream_Write_UINT32(out, 8U + (UINT32)MsOutSize);
 		/** TS_URB_RESULT_HEADER Size*/
-		Stream_Write_UINT16(out, 8 + MsOutSize);
+		Stream_Write_UINT16(out, 8U + (UINT32)MsOutSize);
 	}
 	else
 	{
diff --git a/libfreerdp/core/update.c b/libfreerdp/core/update.c
index aad8f17c9..50a6ef85c 100644
--- a/libfreerdp/core/update.c
+++ b/libfreerdp/core/update.c
@@ -2626,8 +2626,8 @@ static BOOL update_send_new_or_existing_window(rdpContext* context,
 
 	if ((orderInfo->fieldFlags & WINDOW_ORDER_FIELD_VIS_OFFSET) != 0)
 	{
-		Stream_Write_UINT32(s, stateOrder->visibleOffsetX);
-		Stream_Write_UINT32(s, stateOrder->visibleOffsetY);
+		Stream_Write_INT32(s, stateOrder->visibleOffsetX);
+		Stream_Write_INT32(s, stateOrder->visibleOffsetY);
 	}
 
 	if ((orderInfo->fieldFlags & WINDOW_ORDER_FIELD_VISIBILITY) != 0)
diff --git a/libfreerdp/crypto/er.c b/libfreerdp/crypto/er.c
index 8616e17b8..0415044c6 100644
--- a/libfreerdp/crypto/er.c
+++ b/libfreerdp/crypto/er.c
@@ -410,13 +410,13 @@ int er_write_integer(wStream* s, INT32 value)
 	else if (value <= 32767 && value >= -32768)
 	{
 		er_write_length(s, 2, FALSE);
-		Stream_Write_UINT16_BE(s, value);
+		Stream_Write_INT16_BE(s, value);
 		return 3;
 	}
 	else
 	{
 		er_write_length(s, 4, FALSE);
-		Stream_Write_UINT32_BE(s, value);
+		Stream_Write_INT32_BE(s, value);
 		return 5;
 	}
 }