为什么 HeapFree(） 不能正常工作?

我在不使用CRT的情况下在MVS中创建了实现。我使用HeapAlloc()和HeapFree()来分配内存。我的示例应该可以在没有内存泄漏的情况下工作。
这是我的代码：

LPCSTR byte2ch(BYTE* data, int size) {
char* datas = (char*)HeapAlloc(GetProcessHeap(), NULL, size);
LPCSTR temp = (reinterpret_cast<char const*>(data));
for (int i = 0; i < size; i++) {
datas[i] = temp[i];
}
LPSTR tempo = datas;
HeapFree(GetProcessHeap(), NULL, (LPVOID)&size);
return tempo;
}
int EntryPoint()
{
BYTE* buffer = 0;
HANDLE hFile;
DWORD dwBytesRead, dwBytesWritten, dwPos;
if (hFile = CreateFileW(L"MinerFinder.exe", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, 0, NULL))
{
LARGE_INTEGER size;
GetFileSizeEx(hFile, &size);
buffer = (BYTE*)HeapAlloc(GetProcessHeap(), NULL, size.QuadPart);
ReadFile(hFile, buffer, size.QuadPart, &dwBytesRead, NULL);
MessageBoxA(NULL, byte2ch(buffer, size.QuadPart), NULL, SW_SHOW);
HeapFree(GetProcessHeap(), NULL, (LPVOID)&size.QuadPart);
MessageBoxA(NULL, "", NULL, SW_SHOW); // there I can see, that memory is leaking...
CloseHandle(hFile);
}
ExitProcess(0);
}  

我的错误在哪里？

编辑 1：

LPCSTR byte2ch(BYTE* data, int size) {
char* datas = (char*)HeapAlloc(GetProcessHeap(), NULL, size);
LPCSTR temp = (reinterpret_cast<char const*>(data));
for (int i = 0; i < size; i++) {
datas[i] = temp[i];
}
LPSTR tempo = datas;
HeapFree(GetProcessHeap(), NULL, datas);
return tempo;
}

当我HeapFree()程序突然崩溃时。什么？