Wine Cross Reference
wine/dlls/crypt32/tests/encode.c

   /*
    * Unit test suite for crypt32.dll's CryptEncodeObjectEx/CryptDecodeObjectEx
    *
    * Copyright 2005 Juan Lang
    *
    * This library is free software; you can redistribute it and/or
    * modify it under the terms of the GNU Lesser General Public
    * License as published by the Free Software Foundation; either
    * version 2.1 of the License, or (at your option) any later version.
   *
   * This library is distributed in the hope that it will be useful,
   * but WITHOUT ANY WARRANTY; without even the implied warranty of
   * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
   * Lesser General Public License for more details.
   *
   * You should have received a copy of the GNU Lesser General Public
   * License along with this library; if not, write to the Free Software
   * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA
   */
  #include <stdio.h>
  #include <stdarg.h>
  #include <windef.h>
  #include <winbase.h>
  #include <winerror.h>
  #include <wincrypt.h>
  
  #include "wine/test.h"
  
  
  static BOOL (WINAPI *pCryptDecodeObjectEx)(DWORD,LPCSTR,const BYTE*,DWORD,DWORD,PCRYPT_DECODE_PARA,void*,DWORD*);
  static BOOL (WINAPI *pCryptEncodeObjectEx)(DWORD,LPCSTR,const void*,DWORD,PCRYPT_ENCODE_PARA,void*,DWORD*);
  
  struct encodedInt
  {
      int val;
      const BYTE *encoded;
  };
  
  static const BYTE bin1[] = {0x02,0x01,0x01};
  static const BYTE bin2[] = {0x02,0x01,0x7f};
  static const BYTE bin3[] = {0x02,0x02,0x00,0x80};
  static const BYTE bin4[] = {0x02,0x02,0x01,0x00};
  static const BYTE bin5[] = {0x02,0x01,0x80};
  static const BYTE bin6[] = {0x02,0x02,0xff,0x7f};
  static const BYTE bin7[] = {0x02,0x04,0xba,0xdd,0xf0,0x0d};
  
  static const struct encodedInt ints[] = {
   { 1,          bin1 },
   { 127,        bin2 },
   { 128,        bin3 },
   { 256,        bin4 },
   { -128,       bin5 },
   { -129,       bin6 },
   { 0xbaddf00d, bin7 },
  };
  
  struct encodedBigInt
  {
      const BYTE *val;
      const BYTE *encoded;
      const BYTE *decoded;
  };
  
  static const BYTE bin8[] = {0xff,0xff,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0};
  static const BYTE bin9[] = {0x02,0x0a,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0xff,0xff,0};
  static const BYTE bin10[] = {0xff,0xff,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0};
  
  static const BYTE bin11[] = {0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0xff,0xff,0xff,0};
  static const BYTE bin12[] = {0x02,0x09,0xff,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0};
  static const BYTE bin13[] = {0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0xff,0};
  
  static const struct encodedBigInt bigInts[] = {
   { bin8, bin9, bin10 },
   { bin11, bin12, bin13 },
  };
  
  static const BYTE bin14[] = {0xff,0xff,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0};
  static const BYTE bin15[] = {0x02,0x0a,0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0xff,0xff,0};
  static const BYTE bin16[] = {0x08,0x07,0x06,0x05,0x04,0x03,0x02,0x01,0xff,0xff,0xff,0};
  static const BYTE bin17[] = {0x02,0x0c,0x00,0xff,0xff,0xff,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0};
  
  /* Decoded is the same as original, so don't bother storing a separate copy */
  static const struct encodedBigInt bigUInts[] = {
   { bin14, bin15, NULL },
   { bin16, bin17, NULL },
  };
  
  static void test_encodeInt(DWORD dwEncoding)
  {
      DWORD bufSize = 0;
      int i;
      BOOL ret;
      CRYPT_INTEGER_BLOB blob;
      BYTE *buf = NULL;
  
      /* CryptEncodeObjectEx with NULL bufSize crashes..
      ret = pCryptEncodeObjectEx(3, X509_INTEGER, &ints[0].val, 0, NULL, NULL,
       NULL);
       */
     /* check bogus encoding */
     ret = pCryptEncodeObjectEx(0, X509_INTEGER, &ints[0].val, 0, NULL, NULL,
      &bufSize);
     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
      "Expected ERROR_FILE_NOT_FOUND, got %d\n", GetLastError());
     if (0)
     {
         /* check with NULL integer buffer.  Windows XP incorrectly returns an
          * NTSTATUS (crashes on win9x).
          */
         ret = pCryptEncodeObjectEx(dwEncoding, X509_INTEGER, NULL, 0, NULL, NULL,
          &bufSize);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     for (i = 0; i < sizeof(ints) / sizeof(ints[0]); i++)
     {
         /* encode as normal integer */
         ret = pCryptEncodeObjectEx(dwEncoding, X509_INTEGER, &ints[i].val, 0,
          NULL, NULL, &bufSize);
         ok(ret, "Expected success, got %d\n", GetLastError());
         ret = pCryptEncodeObjectEx(dwEncoding, X509_INTEGER, &ints[i].val,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %d\n", GetLastError());
         if (buf)
         {
             ok(buf[0] == 2, "Got unexpected type %d for integer (expected 2)\n",
              buf[0]);
             ok(buf[1] == ints[i].encoded[1], "Got length %d, expected %d\n",
              buf[1], ints[i].encoded[1]);
             ok(!memcmp(buf + 1, ints[i].encoded + 1, ints[i].encoded[1] + 1),
              "Encoded value of 0x%08x didn't match expected\n", ints[i].val);
             LocalFree(buf);
         }
         /* encode as multibyte integer */
         blob.cbData = sizeof(ints[i].val);
         blob.pbData = (BYTE *)&ints[i].val;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, &blob,
          0, NULL, NULL, &bufSize);
         ok(ret, "Expected success, got %d\n", GetLastError());
         ret = pCryptEncodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, &blob,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %d\n", GetLastError());
         if (buf)
         {
             ok(buf[0] == 2, "Got unexpected type %d for integer (expected 2)\n",
              buf[0]);
             ok(buf[1] == ints[i].encoded[1], "Got length %d, expected %d\n",
              buf[1], ints[i].encoded[1]);
             ok(!memcmp(buf + 1, ints[i].encoded + 1, ints[i].encoded[1] + 1),
              "Encoded value of 0x%08x didn't match expected\n", ints[i].val);
             LocalFree(buf);
         }
     }
     /* encode a couple bigger ints, just to show it's little-endian and leading
      * sign bytes are dropped
      */
     for (i = 0; i < sizeof(bigInts) / sizeof(bigInts[0]); i++)
     {
         blob.cbData = strlen((const char*)bigInts[i].val);
         blob.pbData = (BYTE *)bigInts[i].val;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, &blob,
          0, NULL, NULL, &bufSize);
         ok(ret, "Expected success, got %d\n", GetLastError());
         ret = pCryptEncodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, &blob,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %d\n", GetLastError());
         if (buf)
         {
             ok(buf[0] == 2, "Got unexpected type %d for integer (expected 2)\n",
              buf[0]);
             ok(buf[1] == bigInts[i].encoded[1], "Got length %d, expected %d\n",
              buf[1], bigInts[i].encoded[1]);
             ok(!memcmp(buf + 1, bigInts[i].encoded + 1,
              bigInts[i].encoded[1] + 1),
              "Encoded value didn't match expected\n");
             LocalFree(buf);
         }
     }
     /* and, encode some uints */
     for (i = 0; i < sizeof(bigUInts) / sizeof(bigUInts[0]); i++)
     {
         blob.cbData = strlen((const char*)bigUInts[i].val);
         blob.pbData = (BYTE*)bigUInts[i].val;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_MULTI_BYTE_UINT, &blob,
          0, NULL, NULL, &bufSize);
         ok(ret, "Expected success, got %d\n", GetLastError());
         ret = pCryptEncodeObjectEx(dwEncoding, X509_MULTI_BYTE_UINT, &blob,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %d\n", GetLastError());
         if (buf)
         {
             ok(buf[0] == 2, "Got unexpected type %d for integer (expected 2)\n",
              buf[0]);
             ok(buf[1] == bigUInts[i].encoded[1], "Got length %d, expected %d\n",
              buf[1], bigUInts[i].encoded[1]);
             ok(!memcmp(buf + 1, bigUInts[i].encoded + 1,
              bigUInts[i].encoded[1] + 1),
              "Encoded value didn't match expected\n");
             LocalFree(buf);
         }
     }
 }
 
 static void test_decodeInt(DWORD dwEncoding)
 {
     static const BYTE bigInt[] = { 2, 5, 0xff, 0xfe, 0xff, 0xfe, 0xff };
     static const BYTE testStr[] = { 0x16, 4, 't', 'e', 's', 't' };
     static const BYTE longForm[] = { 2, 0x81, 0x01, 0x01 };
     static const BYTE bigBogus[] = { 0x02, 0x84, 0x01, 0xff, 0xff, 0xf9 };
     static const BYTE extraBytes[] = { 2, 1, 1, 0, 0, 0, 0 };
     BYTE *buf = NULL;
     DWORD bufSize = 0;
     int i;
     BOOL ret;
 
     /* CryptDecodeObjectEx with NULL bufSize crashes..
     ret = pCryptDecodeObjectEx(3, X509_INTEGER, &ints[0].encoded,
      ints[0].encoded[1] + 2, 0, NULL, NULL, NULL);
      */
     /* check bogus encoding */
     ret = pCryptDecodeObjectEx(3, X509_INTEGER, (BYTE *)&ints[0].encoded,
      ints[0].encoded[1] + 2, 0, NULL, NULL, &bufSize);
     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
      "Expected ERROR_FILE_NOT_FOUND, got %d\n", GetLastError());
     /* check with NULL integer buffer */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_INTEGER, NULL, 0, 0, NULL, NULL,
      &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_EOD ||
      GetLastError() == OSS_BAD_ARG /* Win9x */),
      "Expected CRYPT_E_ASN1_EOD or OSS_BAD_ARG, got %08x\n", GetLastError());
     /* check with a valid, but too large, integer */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_INTEGER, bigInt, bigInt[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok((!ret && GetLastError() == CRYPT_E_ASN1_LARGE) ||
      broken(ret) /* Win9x */,
      "Expected CRYPT_E_ASN1_LARGE, got %d\n", GetLastError());
     /* check with a DER-encoded string */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_INTEGER, testStr, testStr[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_BADTAG ||
      GetLastError() == OSS_PDU_MISMATCH /* Win9x */ ),
      "Expected CRYPT_E_ASN1_BADTAG or OSS_PDU_MISMATCH, got %08x\n",
      GetLastError());
     for (i = 0; i < sizeof(ints) / sizeof(ints[0]); i++)
     {
         /* When the output buffer is NULL, this always succeeds */
         SetLastError(0xdeadbeef);
         ret = pCryptDecodeObjectEx(dwEncoding, X509_INTEGER,
          ints[i].encoded, ints[i].encoded[1] + 2, 0, NULL, NULL,
          &bufSize);
         ok(ret && GetLastError() == NOERROR,
          "Expected success and NOERROR, got %d\n", GetLastError());
         ret = pCryptDecodeObjectEx(dwEncoding, X509_INTEGER,
          ints[i].encoded, ints[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %d\n", GetLastError());
         ok(bufSize == sizeof(int), "Wrong size %d\n", bufSize);
         ok(buf != NULL, "Expected allocated buffer\n");
         if (buf)
         {
             ok(!memcmp(buf, &ints[i].val, bufSize), "Expected %d, got %d\n",
              ints[i].val, *(int *)buf);
             LocalFree(buf);
         }
     }
     for (i = 0; i < sizeof(bigInts) / sizeof(bigInts[0]); i++)
     {
         ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER,
          bigInts[i].encoded, bigInts[i].encoded[1] + 2, 0, NULL, NULL,
          &bufSize);
         ok(ret && GetLastError() == NOERROR,
          "Expected success and NOERROR, got %d\n", GetLastError());
         ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER,
          bigInts[i].encoded, bigInts[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %d\n", GetLastError());
         ok(bufSize >= sizeof(CRYPT_INTEGER_BLOB), "Wrong size %d\n", bufSize);
         ok(buf != NULL, "Expected allocated buffer\n");
         if (buf)
         {
             CRYPT_INTEGER_BLOB *blob = (CRYPT_INTEGER_BLOB *)buf;
 
             ok(blob->cbData == strlen((const char*)bigInts[i].decoded),
              "Expected len %d, got %d\n", lstrlenA((const char*)bigInts[i].decoded),
              blob->cbData);
             ok(!memcmp(blob->pbData, bigInts[i].decoded, blob->cbData),
              "Unexpected value\n");
             LocalFree(buf);
         }
     }
     for (i = 0; i < sizeof(bigUInts) / sizeof(bigUInts[0]); i++)
     {
         ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_UINT,
          bigUInts[i].encoded, bigUInts[i].encoded[1] + 2, 0, NULL, NULL,
          &bufSize);
         ok(ret && GetLastError() == NOERROR,
          "Expected success and NOERROR, got %d\n", GetLastError());
         ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_UINT,
          bigUInts[i].encoded, bigUInts[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %d\n", GetLastError());
         ok(bufSize >= sizeof(CRYPT_INTEGER_BLOB), "Wrong size %d\n", bufSize);
         ok(buf != NULL, "Expected allocated buffer\n");
         if (buf)
         {
             CRYPT_INTEGER_BLOB *blob = (CRYPT_INTEGER_BLOB *)buf;
 
             ok(blob->cbData == strlen((const char*)bigUInts[i].val),
              "Expected len %d, got %d\n", lstrlenA((const char*)bigUInts[i].val),
              blob->cbData);
             ok(!memcmp(blob->pbData, bigUInts[i].val, blob->cbData),
              "Unexpected value\n");
             LocalFree(buf);
         }
     }
     /* Decode the value 1 with long-form length */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, longForm,
      sizeof(longForm), CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(*(int *)buf == 1, "Expected 1, got %d\n", *(int *)buf);
         LocalFree(buf);
     }
     /* check with extra bytes at the end */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_INTEGER, extraBytes,
      sizeof(extraBytes), CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(*(int *)buf == 1, "Expected 1, got %d\n", *(int *)buf);
         LocalFree(buf);
     }
     /* Try to decode some bogus large items */
     /* The buffer size is smaller than the encoded length, so this should fail
      * with CRYPT_E_ASN1_EOD if it's being decoded.
      * Under XP it fails with CRYPT_E_ASN1_LARGE, which means there's a limit
      * on the size decoded, but in ME it fails with CRYPT_E_ASN1_EOD or crashes.
      * So this test unfortunately isn't useful.
     ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, tooBig,
      0x7fffffff, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == CRYPT_E_ASN1_LARGE,
      "Expected CRYPT_E_ASN1_LARGE, got %08x\n", GetLastError());
      */
     /* This will try to decode the buffer and overflow it, check that it's
      * caught.
      */
     if (0)
     {
     /* a large buffer isn't guaranteed to crash, it depends on memory allocation order */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_MULTI_BYTE_INTEGER, bigBogus,
      0x01ffffff, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
      "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
 }
 
 static const BYTE bin18[] = {0x0a,0x01,0x01};
 static const BYTE bin19[] = {0x0a,0x05,0x00,0xff,0xff,0xff,0x80};
 
 /* These are always encoded unsigned, and aren't constrained to be any
  * particular value
  */
 static const struct encodedInt enums[] = {
  { 1,    bin18 },
  { -128, bin19 },
 };
 
 /* X509_CRL_REASON_CODE is also an enumerated type, but it's #defined to
  * X509_ENUMERATED.
  */
 static const LPCSTR enumeratedTypes[] = { X509_ENUMERATED,
  szOID_CRL_REASON_CODE };
 
 static void test_encodeEnumerated(DWORD dwEncoding)
 {
     DWORD i, j;
 
     for (i = 0; i < sizeof(enumeratedTypes) / sizeof(enumeratedTypes[0]); i++)
     {
         for (j = 0; j < sizeof(enums) / sizeof(enums[0]); j++)
         {
             BOOL ret;
             BYTE *buf = NULL;
             DWORD bufSize = 0;
 
             ret = pCryptEncodeObjectEx(dwEncoding, enumeratedTypes[i],
              &enums[j].val, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf,
              &bufSize);
             ok(ret, "CryptEncodeObjectEx failed: %d\n", GetLastError());
             if (buf)
             {
                 ok(buf[0] == 0xa,
                  "Got unexpected type %d for enumerated (expected 0xa)\n",
                  buf[0]);
                 ok(buf[1] == enums[j].encoded[1],
                  "Got length %d, expected %d\n", buf[1], enums[j].encoded[1]);
                 ok(!memcmp(buf + 1, enums[j].encoded + 1,
                  enums[j].encoded[1] + 1),
                  "Encoded value of 0x%08x didn't match expected\n",
                  enums[j].val);
                 LocalFree(buf);
             }
         }
     }
 }
 
 static void test_decodeEnumerated(DWORD dwEncoding)
 {
     DWORD i, j;
 
     for (i = 0; i < sizeof(enumeratedTypes) / sizeof(enumeratedTypes[0]); i++)
     {
         for (j = 0; j < sizeof(enums) / sizeof(enums[0]); j++)
         {
             BOOL ret;
             DWORD bufSize = sizeof(int);
             int val;
 
             ret = pCryptDecodeObjectEx(dwEncoding, enumeratedTypes[i],
              enums[j].encoded, enums[j].encoded[1] + 2, 0, NULL,
              &val, &bufSize);
             ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
             ok(bufSize == sizeof(int),
              "Got unexpected size %d for enumerated\n", bufSize);
             ok(val == enums[j].val, "Unexpected value %d, expected %d\n",
              val, enums[j].val);
         }
     }
 }
 
 struct encodedFiletime
 {
     SYSTEMTIME sysTime;
     const BYTE *encodedTime;
 };
 
 static void testTimeEncoding(DWORD dwEncoding, LPCSTR structType,
  const struct encodedFiletime *time)
 {
     FILETIME ft = { 0 };
     BYTE *buf = NULL;
     DWORD bufSize = 0;
     BOOL ret;
 
     ret = SystemTimeToFileTime(&time->sysTime, &ft);
     ok(ret, "SystemTimeToFileTime failed: %d\n", GetLastError());
     ret = pCryptEncodeObjectEx(dwEncoding, structType, &ft,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     /* years other than 1950-2050 are not allowed for encodings other than
      * X509_CHOICE_OF_TIME.
      */
     if (structType == X509_CHOICE_OF_TIME ||
      (time->sysTime.wYear >= 1950 && time->sysTime.wYear <= 2050))
     {
         ok(ret, "CryptEncodeObjectEx failed: %d (0x%08x)\n", GetLastError(),
          GetLastError());
         ok(buf != NULL, "Expected an allocated buffer\n");
         if (buf)
         {
             ok(buf[0] == time->encodedTime[0],
              "Expected type 0x%02x, got 0x%02x\n", time->encodedTime[0],
              buf[0]);
             ok(buf[1] == time->encodedTime[1], "Expected %d bytes, got %d\n",
              time->encodedTime[1], bufSize);
             ok(!memcmp(time->encodedTime + 2, buf + 2, time->encodedTime[1]),
              "Got unexpected value for time encoding\n");
             LocalFree(buf);
         }
     }
     else
         ok((!ret && GetLastError() == CRYPT_E_BAD_ENCODE) ||
          broken(GetLastError() == ERROR_SUCCESS),
          "Expected CRYPT_E_BAD_ENCODE, got 0x%08x\n", GetLastError());
 }
 
 static const char *printSystemTime(const SYSTEMTIME *st)
 {
     static char buf[25];
 
     sprintf(buf, "%02d-%02d-%04d %02d:%02d:%02d.%03d", st->wMonth, st->wDay,
      st->wYear, st->wHour, st->wMinute, st->wSecond, st->wMilliseconds);
     return buf;
 }
 
 static const char *printFileTime(const FILETIME *ft)
 {
     static char buf[25];
     SYSTEMTIME st;
 
     FileTimeToSystemTime(ft, &st);
     sprintf(buf, "%02d-%02d-%04d %02d:%02d:%02d.%03d", st.wMonth, st.wDay,
      st.wYear, st.wHour, st.wMinute, st.wSecond, st.wMilliseconds);
     return buf;
 }
 
 static void compareTime(const SYSTEMTIME *expected, const FILETIME *got)
 {
     SYSTEMTIME st;
 
     FileTimeToSystemTime(got, &st);
     ok((expected->wYear == st.wYear &&
      expected->wMonth == st.wMonth &&
      expected->wDay == st.wDay &&
      expected->wHour == st.wHour &&
      expected->wMinute == st.wMinute &&
      expected->wSecond == st.wSecond &&
      abs(expected->wMilliseconds - st.wMilliseconds) <= 1) ||
      /* Some Windows systems only seem to be accurate in their time decoding to
       * within about an hour.
       */
      broken(expected->wYear == st.wYear &&
      expected->wMonth == st.wMonth &&
      expected->wDay == st.wDay &&
      abs(expected->wHour - st.wHour) <= 1),
      "Got unexpected value for time decoding:\nexpected %s, got %s\n",
      printSystemTime(expected), printFileTime(got));
 }
 
 static void testTimeDecoding(DWORD dwEncoding, LPCSTR structType,
  const struct encodedFiletime *time)
 {
     FILETIME ft = { 0 };
     DWORD size = sizeof(ft);
     BOOL ret;
 
     ret = pCryptDecodeObjectEx(dwEncoding, structType, time->encodedTime,
      time->encodedTime[1] + 2, 0, NULL, &ft, &size);
     /* years other than 1950-2050 are not allowed for encodings other than
      * X509_CHOICE_OF_TIME.
      */
     if (structType == X509_CHOICE_OF_TIME ||
      (time->sysTime.wYear >= 1950 && time->sysTime.wYear <= 2050))
     {
         ok(ret || broken(GetLastError() == OSS_DATA_ERROR),
          "CryptDecodeObjectEx failed: %d (0x%08x)\n", GetLastError(),
          GetLastError());
         if (ret)
             compareTime(&time->sysTime, &ft);
     }
     else
         ok(!ret && (GetLastError() == CRYPT_E_ASN1_BADTAG ||
          GetLastError() == OSS_PDU_MISMATCH /* Win9x */ ),
          "Expected CRYPT_E_ASN1_BADTAG or OSS_PDU_MISMATCH, got %08x\n",
          GetLastError());
 }
 
 static const BYTE bin20[] = {
     0x17,0x0d,'','5','','6','','6','1','6','1','','','','Z'};
 static const BYTE bin21[] = {
     0x18,0x0f,'1','9','4','5','','6','','6','1','6','1','','','','Z'};
 static const BYTE bin22[] = {
     0x18,0x0f,'2','1','4','5','','6','','6','1','6','1','','','','Z'};
 
 static const struct encodedFiletime times[] = {
  { { 2005, 6, 1, 6, 16, 10, 0, 0 }, bin20 },
  { { 1945, 6, 1, 6, 16, 10, 0, 0 }, bin21 },
  { { 2145, 6, 1, 6, 16, 10, 0, 0 }, bin22 },
 };
 
 static void test_encodeFiletime(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(times) / sizeof(times[0]); i++)
     {
         testTimeEncoding(dwEncoding, X509_CHOICE_OF_TIME, &times[i]);
         testTimeEncoding(dwEncoding, PKCS_UTC_TIME, &times[i]);
         testTimeEncoding(dwEncoding, szOID_RSA_signingTime, &times[i]);
     }
 }
 
 static const BYTE bin23[] = {
     0x18,0x13,'1','9','4','5','','6','','6','1','6','1','','','','.','','','','Z'};
 static const BYTE bin24[] = {
     0x18,0x13,'1','9','4','5','','6','','6','1','6','1','','','','.','9','9','9','Z'};
 static const BYTE bin25[] = {
     0x18,0x13,'1','9','4','5','','6','','6','1','6','1','','','','+','','1','',''};
 static const BYTE bin26[] = {
     0x18,0x13,'1','9','4','5','','6','','6','1','6','1','','','','-','','1','',''};
 static const BYTE bin27[] = {
     0x18,0x13,'1','9','4','5','','6','','6','1','6','1','','','','-','','1','1','5'};
 static const BYTE bin28[] = {
     0x18,0x0a,'2','1','4','5','','6','','6','1','6'};
 static const BYTE bin29[] = {
     0x17,0x0a,'4','5','','6','','6','1','6','1',''};
 static const BYTE bin30[] = {
     0x17,0x0b,'4','5','','6','','6','1','6','1','','Z'};
 static const BYTE bin31[] = {
     0x17,0x0d,'4','5','','6','','6','1','6','1','','+','','1'};
 static const BYTE bin32[] = {
     0x17,0x0d,'4','5','','6','','6','1','6','1','','-','','1'};
 static const BYTE bin33[] = {
     0x17,0x0f,'4','5','','6','','6','1','6','1','','+','','1','',''};
 static const BYTE bin34[] = {
     0x17,0x0f,'4','5','','6','','6','1','6','1','','-','','1','',''};
 static const BYTE bin35[] = {
     0x17,0x08, '4','5','','6','','6','1','6'};
 static const BYTE bin36[] = {
     0x18,0x0f, 'a','a','a','a','a','a','a','a','a','a','a','a','a','a','Z'};
 static const BYTE bin37[] = {
     0x18,0x04, '2','1','4','5'};
 static const BYTE bin38[] = {
     0x18,0x08, '2','1','4','5','','6','','6'};
 
 static void test_decodeFiletime(DWORD dwEncoding)
 {
     static const struct encodedFiletime otherTimes[] = {
      { { 1945, 6, 1, 6, 16, 10, 0, 0 },   bin23 },
      { { 1945, 6, 1, 6, 16, 10, 0, 999 }, bin24 },
      { { 1945, 6, 1, 6, 17, 10, 0, 0 },   bin25 },
      { { 1945, 6, 1, 6, 15, 10, 0, 0 },   bin26 },
      { { 1945, 6, 1, 6, 14, 55, 0, 0 },   bin27 },
      { { 2145, 6, 1, 6, 16,  0, 0, 0 },   bin28 },
      { { 2045, 6, 1, 6, 16, 10, 0, 0 },   bin29 },
      { { 2045, 6, 1, 6, 16, 10, 0, 0 },   bin30 },
      { { 2045, 6, 1, 6, 17, 10, 0, 0 },   bin31 },
      { { 2045, 6, 1, 6, 15, 10, 0, 0 },   bin32 },
      { { 2045, 6, 1, 6, 17, 10, 0, 0 },   bin33 },
      { { 2045, 6, 1, 6, 15, 10, 0, 0 },   bin34 },
     };
     /* An oddball case that succeeds in Windows, but doesn't seem correct
      { { 2145, 6, 1, 2, 11, 31, 0, 0 },   "\x18" "\x13" "21450606161000-9999" },
      */
     static const unsigned char *bogusTimes[] = {
      /* oddly, this succeeds on Windows, with year 2765
      "\x18" "\x0f" "21r50606161000Z",
       */
      bin35,
      bin36,
      bin37,
      bin38,
     };
     DWORD i, size;
     FILETIME ft1 = { 0 }, ft2 = { 0 };
     BOOL ret;
 
     /* Check bogus length with non-NULL buffer */
     ret = SystemTimeToFileTime(&times[0].sysTime, &ft1);
     ok(ret, "SystemTimeToFileTime failed: %d\n", GetLastError());
     size = 1;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_CHOICE_OF_TIME,
      times[0].encodedTime, times[0].encodedTime[1] + 2, 0, NULL, &ft2, &size);
     ok(!ret && GetLastError() == ERROR_MORE_DATA,
      "Expected ERROR_MORE_DATA, got %d\n", GetLastError());
     /* Normal tests */
     for (i = 0; i < sizeof(times) / sizeof(times[0]); i++)
     {
         testTimeDecoding(dwEncoding, X509_CHOICE_OF_TIME, &times[i]);
         testTimeDecoding(dwEncoding, PKCS_UTC_TIME, &times[i]);
         testTimeDecoding(dwEncoding, szOID_RSA_signingTime, &times[i]);
     }
     for (i = 0; i < sizeof(otherTimes) / sizeof(otherTimes[0]); i++)
     {
         testTimeDecoding(dwEncoding, X509_CHOICE_OF_TIME, &otherTimes[i]);
         testTimeDecoding(dwEncoding, PKCS_UTC_TIME, &otherTimes[i]);
         testTimeDecoding(dwEncoding, szOID_RSA_signingTime, &otherTimes[i]);
     }
     for (i = 0; i < sizeof(bogusTimes) / sizeof(bogusTimes[0]); i++)
     {
         size = sizeof(ft1);
         ret = pCryptDecodeObjectEx(dwEncoding, X509_CHOICE_OF_TIME,
          bogusTimes[i], bogusTimes[i][1] + 2, 0, NULL, &ft1, &size);
         ok((!ret && (GetLastError() == CRYPT_E_ASN1_CORRUPT ||
                      GetLastError() == OSS_DATA_ERROR /* Win9x */)) ||
            broken(ret), /* Win9x and NT4 for bin38 */
          "Expected CRYPT_E_ASN1_CORRUPT or OSS_DATA_ERROR, got %08x\n",
          GetLastError());
     }
 }
 
 static const char commonName[] = "Juan Lang";
 static const char surName[] = "Lang";
 
 static const BYTE emptySequence[] = { 0x30, 0 };
 static const BYTE emptyRDNs[] = { 0x30, 0x02, 0x31, 0 };
 static const BYTE twoRDNs[] = {
     0x30,0x23,0x31,0x21,0x30,0x0c,0x06,0x03,0x55,0x04,0x04,
     0x13,0x05,0x4c,0x61,0x6e,0x67,0x00,0x30,0x11,0x06,0x03,0x55,0x04,0x03,
     0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0};
 static const BYTE encodedTwoRDNs[] = {
 0x30,0x2e,0x31,0x2c,0x30,0x2a,0x06,0x03,0x55,0x04,0x03,0x30,0x23,0x31,0x21,
 0x30,0x0c,0x06,0x03,0x55,0x04,0x04,0x13,0x05,0x4c,0x61,0x6e,0x67,0x00,0x30,
 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 0x6e,0x67,0x00,
 };
 
 static const BYTE us[] = { 0x55, 0x53 };
 static const BYTE minnesota[] = { 0x4d, 0x69, 0x6e, 0x6e, 0x65, 0x73, 0x6f,
  0x74, 0x61 };
 static const BYTE minneapolis[] = { 0x4d, 0x69, 0x6e, 0x6e, 0x65, 0x61, 0x70,
  0x6f, 0x6c, 0x69, 0x73 };
 static const BYTE codeweavers[] = { 0x43, 0x6f, 0x64, 0x65, 0x57, 0x65, 0x61,
  0x76, 0x65, 0x72, 0x73 };
 static const BYTE wine[] = { 0x57, 0x69, 0x6e, 0x65, 0x20, 0x44, 0x65, 0x76,
  0x65, 0x6c, 0x6f, 0x70, 0x6d, 0x65, 0x6e, 0x74 };
 static const BYTE localhostAttr[] = { 0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f,
  0x73, 0x74 };
 static const BYTE aric[] = { 0x61, 0x72, 0x69, 0x63, 0x40, 0x63, 0x6f, 0x64,
  0x65, 0x77, 0x65, 0x61, 0x76, 0x65, 0x72, 0x73, 0x2e, 0x63, 0x6f, 0x6d };
 
 #define RDNA(arr)   oid_ ## arr, CERT_RDN_PRINTABLE_STRING, { sizeof(arr), (LPBYTE)arr }
 #define RDNIA5(arr) oid_ ## arr, CERT_RDN_IA5_STRING,       { sizeof(arr), (LPBYTE)arr }
 
 static CHAR oid_us[]            = "2.5.4.6",
             oid_minnesota[]     = "2.5.4.8",
             oid_minneapolis[]   = "2.5.4.7",
             oid_codeweavers[]   = "2.5.4.10",
             oid_wine[]          = "2.5.4.11",
             oid_localhostAttr[] = "2.5.4.3",
             oid_aric[]          = "1.2.840.113549.1.9.1";
 static CERT_RDN_ATTR rdnAttrs[] = { { RDNA(us) },
                                     { RDNA(minnesota) },
                                     { RDNA(minneapolis) },
                                     { RDNA(codeweavers) },
                                     { RDNA(wine) },
                                     { RDNA(localhostAttr) },
                                     { RDNIA5(aric) } };
 static CERT_RDN_ATTR decodedRdnAttrs[] = { { RDNA(us) },
                                            { RDNA(localhostAttr) },
                                            { RDNA(minnesota) },
                                            { RDNA(minneapolis) },
                                            { RDNA(codeweavers) },
                                            { RDNA(wine) },
                                            { RDNIA5(aric) } };
 
 #undef RDNIA5
 #undef RDNA
 
 static const BYTE encodedRDNAttrs[] = {
 0x30,0x81,0x96,0x31,0x81,0x93,0x30,0x09,0x06,0x03,0x55,0x04,0x06,0x13,0x02,0x55,
 0x53,0x30,0x10,0x06,0x03,0x55,0x04,0x03,0x13,0x09,0x6c,0x6f,0x63,0x61,0x6c,0x68,
 0x6f,0x73,0x74,0x30,0x10,0x06,0x03,0x55,0x04,0x08,0x13,0x09,0x4d,0x69,0x6e,0x6e,
 0x65,0x73,0x6f,0x74,0x61,0x30,0x12,0x06,0x03,0x55,0x04,0x07,0x13,0x0b,0x4d,0x69,
 0x6e,0x6e,0x65,0x61,0x70,0x6f,0x6c,0x69,0x73,0x30,0x12,0x06,0x03,0x55,0x04,0x0a,
 0x13,0x0b,0x43,0x6f,0x64,0x65,0x57,0x65,0x61,0x76,0x65,0x72,0x73,0x30,0x17,0x06,
 0x03,0x55,0x04,0x0b,0x13,0x10,0x57,0x69,0x6e,0x65,0x20,0x44,0x65,0x76,0x65,0x6c,
 0x6f,0x70,0x6d,0x65,0x6e,0x74,0x30,0x21,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,
 0x01,0x09,0x01,0x16,0x14,0x61,0x72,0x69,0x63,0x40,0x63,0x6f,0x64,0x65,0x77,0x65,
 0x61,0x76,0x65,0x72,0x73,0x2e,0x63,0x6f,0x6d
 };
 
 static void test_encodeName(DWORD dwEncoding)
 {
     CERT_RDN_ATTR attrs[2];
     CERT_RDN rdn;
     CERT_NAME_INFO info;
     static CHAR oid_common_name[] = szOID_COMMON_NAME,
                 oid_sur_name[]    = szOID_SUR_NAME;
     BYTE *buf = NULL;
     DWORD size = 0;
     BOOL ret;
 
     if (0)
     {
         /* Test with NULL pvStructInfo (crashes on win9x) */
         ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, NULL,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* Test with empty CERT_NAME_INFO */
     info.cRDN = 0;
     info.rgRDN = NULL;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(!memcmp(buf, emptySequence, sizeof(emptySequence)),
          "Got unexpected encoding for empty name\n");
         LocalFree(buf);
     }
     if (0)
     {
         /* Test with bogus CERT_RDN (crashes on win9x) */
         info.cRDN = 1;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* Test with empty CERT_RDN */
     rdn.cRDNAttr = 0;
     rdn.rgRDNAttr = NULL;
     info.cRDN = 1;
     info.rgRDN = &rdn;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(!memcmp(buf, emptyRDNs, sizeof(emptyRDNs)),
          "Got unexpected encoding for empty RDN array\n");
         LocalFree(buf);
     }
     if (0)
     {
         /* Test with bogus attr array (crashes on win9x) */
         rdn.cRDNAttr = 1;
         rdn.rgRDNAttr = NULL;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* oddly, a bogus OID is accepted by Windows XP; not testing.
     attrs[0].pszObjId = "bogus";
     attrs[0].dwValueType = CERT_RDN_PRINTABLE_STRING;
     attrs[0].Value.cbData = sizeof(commonName);
     attrs[0].Value.pbData = commonName;
     rdn.cRDNAttr = 1;
     rdn.rgRDNAttr = attrs;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret, "Expected failure, got success\n");
      */
     /* Check with two CERT_RDN_ATTRs.  Note DER encoding forces the order of
      * the encoded attributes to be swapped.
      */
     attrs[0].pszObjId = oid_common_name;
     attrs[0].dwValueType = CERT_RDN_PRINTABLE_STRING;
     attrs[0].Value.cbData = sizeof(commonName);
     attrs[0].Value.pbData = (BYTE *)commonName;
     attrs[1].pszObjId = oid_sur_name;
     attrs[1].dwValueType = CERT_RDN_PRINTABLE_STRING;
     attrs[1].Value.cbData = sizeof(surName);
     attrs[1].Value.pbData = (BYTE *)surName;
     rdn.cRDNAttr = 2;
     rdn.rgRDNAttr = attrs;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(!memcmp(buf, twoRDNs, sizeof(twoRDNs)),
          "Got unexpected encoding for two RDN array\n");
         LocalFree(buf);
     }
     /* A name can be "encoded" with previously encoded RDN attrs. */
     attrs[0].dwValueType = CERT_RDN_ENCODED_BLOB;
     attrs[0].Value.pbData = (LPBYTE)twoRDNs;
     attrs[0].Value.cbData = sizeof(twoRDNs);
     rdn.cRDNAttr = 1;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(encodedTwoRDNs), "Unexpected size %d\n", size);
         ok(!memcmp(buf, encodedTwoRDNs, size),
          "Unexpected value for re-endoded two RDN array\n");
         LocalFree(buf);
     }
     /* CERT_RDN_ANY_TYPE is too vague for X509_NAMEs, check the return */
     rdn.cRDNAttr = 1;
     attrs[0].dwValueType = CERT_RDN_ANY_TYPE;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == E_INVALIDARG,
      "Expected E_INVALIDARG, got %08x\n", GetLastError());
     /* Test a more complex name */
     rdn.cRDNAttr = sizeof(rdnAttrs) / sizeof(rdnAttrs[0]);
     rdn.rgRDNAttr = rdnAttrs;
     info.cRDN = 1;
     info.rgRDN = &rdn;
     buf = NULL;
     size = 0;
     ret = pCryptEncodeObjectEx(X509_ASN_ENCODING, X509_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (ret)
     {
         ok(size == sizeof(encodedRDNAttrs), "Wrong size %d\n", size);
         ok(!memcmp(buf, encodedRDNAttrs, size), "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 static WCHAR commonNameW[] = { 'J','u','a','n',' ','L','a','n','g',0 };
 static WCHAR surNameW[] = { 'L','a','n','g',0 };
 
 static const BYTE twoRDNsNoNull[] = {
  0x30,0x21,0x31,0x1f,0x30,0x0b,0x06,0x03,0x55,0x04,0x04,0x13,0x04,0x4c,0x61,
  0x6e,0x67,0x30,0x10,0x06,0x03,0x55,0x04,0x03,0x13,0x09,0x4a,0x75,0x61,0x6e,
  0x20,0x4c,0x61,0x6e,0x67 };
 static const BYTE anyType[] = {
  0x30,0x2f,0x31,0x2d,0x30,0x2b,0x06,0x03,0x55,0x04,0x03,0x1e,0x24,0x23,0x30,
  0x21,0x31,0x0c,0x30,0x03,0x06,0x04,0x55,0x13,0x04,0x4c,0x05,0x6e,0x61,0x00,
  0x67,0x11,0x30,0x03,0x06,0x04,0x55,0x13,0x03,0x4a,0x0a,0x61,0x75,0x20,0x6e,
  0x61,0x4c,0x67,0x6e };
 
 static void test_encodeUnicodeName(DWORD dwEncoding)
 {
     CERT_RDN_ATTR attrs[2];
     CERT_RDN rdn;
     CERT_NAME_INFO info;
     static CHAR oid_common_name[] = szOID_COMMON_NAME,
                 oid_sur_name[]    = szOID_SUR_NAME;
     BYTE *buf = NULL;
     DWORD size = 0;
     BOOL ret;
 
     if (0)
     {
         /* Test with NULL pvStructInfo (crashes on win9x) */
         ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME, NULL,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* Test with empty CERT_NAME_INFO */
     info.cRDN = 0;
     info.rgRDN = NULL;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(!memcmp(buf, emptySequence, sizeof(emptySequence)),
          "Got unexpected encoding for empty name\n");
         LocalFree(buf);
     }
     /* Check with one CERT_RDN_ATTR, that has an invalid character for the
      * encoding (the NULL).
      */
     attrs[0].pszObjId = oid_common_name;
     attrs[0].dwValueType = CERT_RDN_PRINTABLE_STRING;
     attrs[0].Value.cbData = sizeof(commonNameW);
     attrs[0].Value.pbData = (BYTE *)commonNameW;
     rdn.cRDNAttr = 1;
     rdn.rgRDNAttr = attrs;
     info.cRDN = 1;
     info.rgRDN = &rdn;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_INVALID_PRINTABLE_STRING,
      "Expected CRYPT_E_INVALID_PRINTABLE_STRING, got %08x\n", GetLastError());
     ok(size == 9, "Unexpected error index %08x\n", size);
     /* Check with two NULL-terminated CERT_RDN_ATTRs.  Note DER encoding
      * forces the order of the encoded attributes to be swapped.
      */
     attrs[0].pszObjId = oid_common_name;
     attrs[0].dwValueType = CERT_RDN_PRINTABLE_STRING;
     attrs[0].Value.cbData = 0;
     attrs[0].Value.pbData = (BYTE *)commonNameW;
     attrs[1].pszObjId = oid_sur_name;
     attrs[1].dwValueType = CERT_RDN_PRINTABLE_STRING;
     attrs[1].Value.cbData = 0;
     attrs[1].Value.pbData = (BYTE *)surNameW;
     rdn.cRDNAttr = 2;
     rdn.rgRDNAttr = attrs;
     info.cRDN = 1;
     info.rgRDN = &rdn;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(!memcmp(buf, twoRDNsNoNull, sizeof(twoRDNsNoNull)),
          "Got unexpected encoding for two RDN array\n");
         LocalFree(buf);
     }
     /* A name can be "encoded" with previously encoded RDN attrs. */
     attrs[0].dwValueType = CERT_RDN_ENCODED_BLOB;
     attrs[0].Value.pbData = (LPBYTE)twoRDNs;
     attrs[0].Value.cbData = sizeof(twoRDNs);
     rdn.cRDNAttr = 1;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(encodedTwoRDNs), "Unexpected size %d\n", size);
         ok(!memcmp(buf, encodedTwoRDNs, size),
          "Unexpected value for re-endoded two RDN array\n");
         LocalFree(buf);
     }
     /* Unicode names infer the type for CERT_RDN_ANY_TYPE */
     rdn.cRDNAttr = 1;
     attrs[0].dwValueType = CERT_RDN_ANY_TYPE;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     todo_wine ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(anyType), "Unexpected size %d\n", size);
         ok(!memcmp(buf, anyType, size), "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 static void compareNameValues(const CERT_NAME_VALUE *expected,
  const CERT_NAME_VALUE *got)
 {
     if (expected->dwValueType == CERT_RDN_UTF8_STRING &&
         got->dwValueType == CERT_RDN_ENCODED_BLOB)
     {
         win_skip("Can't handle CERT_RDN_UTF8_STRING\n");
         return;
     }
 
     ok(got->dwValueType == expected->dwValueType,
      "Expected string type %d, got %d\n", expected->dwValueType,
      got->dwValueType);
     ok(got->Value.cbData == expected->Value.cbData,
      "String type %d: unexpected data size, got %d, expected %d\n",
      expected->dwValueType, got->Value.cbData, expected->Value.cbData);
     if (got->Value.cbData && got->Value.pbData)
         ok(!memcmp(got->Value.pbData, expected->Value.pbData,
          min(got->Value.cbData, expected->Value.cbData)),
          "String type %d: unexpected value\n", expected->dwValueType);
 }
 
 static void compareRDNAttrs(const CERT_RDN_ATTR *expected,
  const CERT_RDN_ATTR *got)
 {
     if (expected->pszObjId && strlen(expected->pszObjId))
     {
         ok(got->pszObjId != NULL, "Expected OID %s, got NULL\n",
          expected->pszObjId);
         if (got->pszObjId)
         {
             ok(!strcmp(got->pszObjId, expected->pszObjId),
              "Got unexpected OID %s, expected %s\n", got->pszObjId,
              expected->pszObjId);
         }
     }
     compareNameValues((const CERT_NAME_VALUE *)&expected->dwValueType,
      (const CERT_NAME_VALUE *)&got->dwValueType);
 }
 
 static void compareRDNs(const CERT_RDN *expected, const CERT_RDN *got)
 {
     ok(got->cRDNAttr == expected->cRDNAttr,
      "Expected %d RDN attrs, got %d\n", expected->cRDNAttr, got->cRDNAttr);
     if (got->cRDNAttr)
     {
         DWORD i;
 
         for (i = 0; i < got->cRDNAttr; i++)
             compareRDNAttrs(&expected->rgRDNAttr[i], &got->rgRDNAttr[i]);
     }
 }
 
 static void compareNames(const CERT_NAME_INFO *expected,
  const CERT_NAME_INFO *got)
 {
     ok(got->cRDN == expected->cRDN, "Expected %d RDNs, got %d\n",
      expected->cRDN, got->cRDN);
     if (got->cRDN)
     {
         DWORD i;
 
         for (i = 0; i < got->cRDN; i++)
             compareRDNs(&expected->rgRDN[i], &got->rgRDN[i]);
     }
 }
 
 static const BYTE emptyIndefiniteSequence[] = { 0x30,0x80,0x00,0x00 };
 static const BYTE twoRDNsExtraBytes[] = {
     0x30,0x23,0x31,0x21,0x30,0x0c,0x06,0x03,0x55,0x04,0x04,
     0x13,0x05,0x4c,0x61,0x6e,0x67,0x00,0x30,0x11,0x06,0x03,0x55,0x04,0x03,
     0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0,0,0,0,0,0};
 
 static void test_decodeName(DWORD dwEncoding)
 {
     BYTE *buf = NULL;
     DWORD bufSize = 0;
     BOOL ret;
     CERT_RDN rdn;
     CERT_NAME_INFO info = { 1, &rdn };
 
     /* test empty name */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME, emptySequence,
      emptySequence[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     /* Interestingly, in Windows, if cRDN is 0, rgRGN may not be NULL.  My
      * decoder works the same way, so only test the count.
      */
     if (buf)
     {
         ok(bufSize == sizeof(CERT_NAME_INFO), "Wrong bufSize %d\n", bufSize);
         ok(((CERT_NAME_INFO *)buf)->cRDN == 0,
          "Expected 0 RDNs in empty info, got %d\n",
          ((CERT_NAME_INFO *)buf)->cRDN);
         LocalFree(buf);
     }
     /* test empty name with indefinite-length encoding */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME, emptyIndefiniteSequence,
      sizeof(emptyIndefiniteSequence), CRYPT_DECODE_ALLOC_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (ret)
     {
         ok(bufSize == sizeof(CERT_NAME_INFO), "Wrong bufSize %d\n", bufSize);
         ok(((CERT_NAME_INFO *)buf)->cRDN == 0,
          "Expected 0 RDNs in empty info, got %d\n",
          ((CERT_NAME_INFO *)buf)->cRDN);
         LocalFree(buf);
     }
     /* test empty RDN */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME, emptyRDNs,
      emptyRDNs[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_NAME_INFO *info = (CERT_NAME_INFO *)buf;
 
         ok(bufSize == sizeof(CERT_NAME_INFO) + sizeof(CERT_RDN) &&
          info->cRDN == 1 && info->rgRDN && info->rgRDN[0].cRDNAttr == 0,
          "Got unexpected value for empty RDN\n");
         LocalFree(buf);
     }
     /* test two RDN attrs */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME, twoRDNs,
      twoRDNs[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         static CHAR oid_sur_name[]    = szOID_SUR_NAME,
                     oid_common_name[] = szOID_COMMON_NAME;
 
         CERT_RDN_ATTR attrs[] = {
          { oid_sur_name, CERT_RDN_PRINTABLE_STRING, { sizeof(surName),
           (BYTE *)surName } },
          { oid_common_name, CERT_RDN_PRINTABLE_STRING, { sizeof(commonName),
           (BYTE *)commonName } },
         };
 
         rdn.cRDNAttr = sizeof(attrs) / sizeof(attrs[0]);
         rdn.rgRDNAttr = attrs;
         compareNames(&info, (CERT_NAME_INFO *)buf);
         LocalFree(buf);
     }
     /* test that two RDN attrs with extra bytes succeeds */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME, twoRDNsExtraBytes,
      sizeof(twoRDNsExtraBytes), 0, NULL, NULL, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     /* And, a slightly more complicated name */
     buf = NULL;
     bufSize = 0;
     ret = pCryptDecodeObjectEx(X509_ASN_ENCODING, X509_NAME, encodedRDNAttrs,
      sizeof(encodedRDNAttrs), CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (ret)
     {
         rdn.cRDNAttr = sizeof(decodedRdnAttrs) / sizeof(decodedRdnAttrs[0]);
         rdn.rgRDNAttr = decodedRdnAttrs;
         compareNames(&info, (CERT_NAME_INFO *)buf);
         LocalFree(buf);
     }
 }
 
 static void test_decodeUnicodeName(DWORD dwEncoding)
 {
     BYTE *buf = NULL;
     DWORD bufSize = 0;
     BOOL ret;
     CERT_RDN rdn;
     CERT_NAME_INFO info = { 1, &rdn };
 
     /* test empty name */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_UNICODE_NAME, emptySequence,
      emptySequence[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(bufSize == sizeof(CERT_NAME_INFO),
          "Got wrong bufSize %d\n", bufSize);
         ok(((CERT_NAME_INFO *)buf)->cRDN == 0,
          "Expected 0 RDNs in empty info, got %d\n",
          ((CERT_NAME_INFO *)buf)->cRDN);
         LocalFree(buf);
     }
     /* test empty RDN */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_UNICODE_NAME, emptyRDNs,
      emptyRDNs[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_NAME_INFO *info = (CERT_NAME_INFO *)buf;
 
         ok(bufSize == sizeof(CERT_NAME_INFO) + sizeof(CERT_RDN) &&
          info->cRDN == 1 && info->rgRDN && info->rgRDN[0].cRDNAttr == 0,
          "Got unexpected value for empty RDN\n");
         LocalFree(buf);
     }
     /* test two RDN attrs */
     bufSize = 0;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_UNICODE_NAME, twoRDNsNoNull,
      sizeof(twoRDNsNoNull),
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         static CHAR oid_sur_name[]    = szOID_SUR_NAME,
                     oid_common_name[] = szOID_COMMON_NAME;
 
         CERT_RDN_ATTR attrs[] = {
          { oid_sur_name, CERT_RDN_PRINTABLE_STRING,
          { lstrlenW(surNameW) * sizeof(WCHAR), (BYTE *)surNameW } },
          { oid_common_name, CERT_RDN_PRINTABLE_STRING,
          { lstrlenW(commonNameW) * sizeof(WCHAR), (BYTE *)commonNameW } },
         };
 
         rdn.cRDNAttr = sizeof(attrs) / sizeof(attrs[0]);
         rdn.rgRDNAttr = attrs;
         compareNames(&info, (CERT_NAME_INFO *)buf);
         LocalFree(buf);
     }
 }
 
 struct EncodedNameValue
 {
     CERT_NAME_VALUE value;
     const BYTE *encoded;
     DWORD encodedSize;
 };
 
 static const char bogusIA5[] = "\x80";
 static const char bogusPrintable[] = "~";
 static const char bogusNumeric[] = "A";
 static const BYTE bin42[] = { 0x16,0x02,0x80,0x00 };
 static const BYTE bin43[] = { 0x13,0x02,0x7e,0x00 };
 static const BYTE bin44[] = { 0x12,0x02,0x41,0x00 };
 static BYTE octetCommonNameValue[] = {
  0x04,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE numericCommonNameValue[] = {
  0x12,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE printableCommonNameValue[] = {
  0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE t61CommonNameValue[] = {
  0x14,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE videotexCommonNameValue[] = {
  0x15,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE ia5CommonNameValue[] = {
  0x16,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE graphicCommonNameValue[] = {
  0x19,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE visibleCommonNameValue[] = {
  0x1a,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE generalCommonNameValue[] = {
  0x1b,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static BYTE bmpCommonNameValue[] = {
  0x1e,0x14,0x00,0x4a,0x00,0x75,0x00,0x61,0x00,0x6e,0x00,0x20,0x00,0x4c,0x00,
  0x61,0x00,0x6e,0x00,0x67,0x00,0x00 };
 static BYTE utf8CommonNameValue[] = {
  0x0c,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 static char embedded_null[] = "foo\0com";
 static BYTE ia5EmbeddedNull[] = {
  0x16,0x07,0x66,0x6f,0x6f,0x00,0x63,0x6f,0x6d };
 
 static struct EncodedNameValue nameValues[] = {
  { { CERT_RDN_OCTET_STRING, { sizeof(commonName), (BYTE *)commonName } },
      octetCommonNameValue, sizeof(octetCommonNameValue) },
  { { CERT_RDN_NUMERIC_STRING, { sizeof(commonName), (BYTE *)commonName } },
      numericCommonNameValue, sizeof(numericCommonNameValue) },
  { { CERT_RDN_PRINTABLE_STRING, { sizeof(commonName), (BYTE *)commonName } },
      printableCommonNameValue, sizeof(printableCommonNameValue) },
  { { CERT_RDN_T61_STRING, { sizeof(commonName), (BYTE *)commonName } },
      t61CommonNameValue, sizeof(t61CommonNameValue) },
  { { CERT_RDN_VIDEOTEX_STRING, { sizeof(commonName), (BYTE *)commonName } },
      videotexCommonNameValue, sizeof(videotexCommonNameValue) },
  { { CERT_RDN_IA5_STRING, { sizeof(commonName), (BYTE *)commonName } },
      ia5CommonNameValue, sizeof(ia5CommonNameValue) },
  { { CERT_RDN_GRAPHIC_STRING, { sizeof(commonName), (BYTE *)commonName } },
      graphicCommonNameValue, sizeof(graphicCommonNameValue) },
  { { CERT_RDN_VISIBLE_STRING, { sizeof(commonName), (BYTE *)commonName } },
      visibleCommonNameValue, sizeof(visibleCommonNameValue) },
  { { CERT_RDN_GENERAL_STRING, { sizeof(commonName), (BYTE *)commonName } },
      generalCommonNameValue, sizeof(generalCommonNameValue) },
  { { CERT_RDN_BMP_STRING, { sizeof(commonNameW), (BYTE *)commonNameW } },
      bmpCommonNameValue, sizeof(bmpCommonNameValue) },
  { { CERT_RDN_UTF8_STRING, { sizeof(commonNameW), (BYTE *)commonNameW } },
      utf8CommonNameValue, sizeof(utf8CommonNameValue) },
  /* The following tests succeed under Windows, but really should fail,
   * they contain characters that are illegal for the encoding.  I'm
   * including them to justify my lazy encoding.
   */
  { { CERT_RDN_IA5_STRING, { sizeof(bogusIA5), (BYTE *)bogusIA5 } }, bin42,
      sizeof(bin42) },
  { { CERT_RDN_PRINTABLE_STRING, { sizeof(bogusPrintable),
      (BYTE *)bogusPrintable } }, bin43, sizeof(bin43) },
  { { CERT_RDN_NUMERIC_STRING, { sizeof(bogusNumeric), (BYTE *)bogusNumeric } },
      bin44, sizeof(bin44) },
 };
 /* This is kept separate, because the decoding doesn't return to the original
  * value.
  */
 static struct EncodedNameValue embeddedNullNameValue = {
  { CERT_RDN_IA5_STRING, { sizeof(embedded_null) - 1, (BYTE *)embedded_null } },
    ia5EmbeddedNull, sizeof(ia5EmbeddedNull) };
 
 static void test_encodeNameValue(DWORD dwEncoding)
 {
     BYTE *buf = NULL;
     DWORD size = 0, i;
     BOOL ret;
     CERT_NAME_VALUE value = { 0, { 0, NULL } };
 
     value.dwValueType = CERT_RDN_ENCODED_BLOB;
     value.Value.pbData = printableCommonNameValue;
     value.Value.cbData = sizeof(printableCommonNameValue);
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME_VALUE, &value,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(printableCommonNameValue), "Unexpected size %d\n",
          size);
         ok(!memcmp(buf, printableCommonNameValue, size),
          "Unexpected encoding\n");
         LocalFree(buf);
     }
     for (i = 0; i < sizeof(nameValues) / sizeof(nameValues[0]); i++)
     {
         ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME_VALUE,
          &nameValues[i].value, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(ret || broken(GetLastError() == OSS_PDU_MISMATCH) /* NT4/Win9x */,
          "Type %d: CryptEncodeObjectEx failed: %08x\n",
          nameValues[i].value.dwValueType, GetLastError());
         if (ret)
         {
             ok(size == nameValues[i].encodedSize,
              "Expected size %d, got %d\n", nameValues[i].encodedSize, size);
             ok(!memcmp(buf, nameValues[i].encoded, size),
              "Got unexpected encoding\n");
             LocalFree(buf);
         }
     }
     ret = pCryptEncodeObjectEx(dwEncoding, X509_NAME_VALUE,
      &embeddedNullNameValue.value, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret || broken(GetLastError() == OSS_PDU_MISMATCH) /* NT4/Win9x */,
      "Type %d: CryptEncodeObjectEx failed: %08x\n",
      embeddedNullNameValue.value.dwValueType, GetLastError());
     if (ret)
     {
         ok(size == embeddedNullNameValue.encodedSize,
          "Expected size %d, got %d\n", embeddedNullNameValue.encodedSize, size);
         ok(!memcmp(buf, embeddedNullNameValue.encoded, size),
          "Got unexpected encoding\n");
         LocalFree(buf);
     }
 }
 
 static void test_decodeNameValue(DWORD dwEncoding)
 {
     int i;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
     BOOL ret;
 
     for (i = 0; i < sizeof(nameValues) / sizeof(nameValues[0]); i++)
     {
         ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME_VALUE,
          nameValues[i].encoded, nameValues[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
          &buf, &bufSize);
         ok(ret, "Value type %d: CryptDecodeObjectEx failed: %08x\n",
          nameValues[i].value.dwValueType, GetLastError());
         if (ret)
         {
             compareNameValues(&nameValues[i].value,
              (const CERT_NAME_VALUE *)buf);
             LocalFree(buf);
         }
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_NAME_VALUE,
      embeddedNullNameValue.encoded, embeddedNullNameValue.encodedSize,
      CRYPT_DECODE_ALLOC_FLAG | CRYPT_DECODE_SHARE_OID_STRING_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "Value type %d: CryptDecodeObjectEx failed: %08x\n",
      embeddedNullNameValue.value.dwValueType, GetLastError());
     if (ret)
     {
         CERT_NAME_VALUE rdnEncodedValue = { CERT_RDN_ENCODED_BLOB,
          { sizeof(ia5EmbeddedNull), ia5EmbeddedNull } };
         CERT_NAME_VALUE embeddedNullValue = { CERT_RDN_IA5_STRING,
          { sizeof(embedded_null) - 1, (BYTE *)embedded_null } };
         const CERT_NAME_VALUE *got = (const CERT_NAME_VALUE *)buf,
          *expected = NULL;
 
         /* Some Windows versions decode name values with embedded NULLs,
          * others leave them encoded, even with the same version of crypt32.
          * Accept either.
          */
         ok(got->dwValueType == CERT_RDN_ENCODED_BLOB ||
          got->dwValueType == CERT_RDN_IA5_STRING,
          "Expected CERT_RDN_ENCODED_BLOB or CERT_RDN_IA5_STRING, got %d\n",
          got->dwValueType);
         if (got->dwValueType == CERT_RDN_ENCODED_BLOB)
             expected = &rdnEncodedValue;
         else if (got->dwValueType == CERT_RDN_IA5_STRING)
             expected = &embeddedNullValue;
         if (expected)
         {
             ok(got->Value.cbData == expected->Value.cbData,
              "String type %d: unexpected data size, got %d, expected %d\n",
              got->dwValueType, got->Value.cbData, expected->Value.cbData);
             if (got->Value.cbData && got->Value.pbData)
                 ok(!memcmp(got->Value.pbData, expected->Value.pbData,
                  min(got->Value.cbData, expected->Value.cbData)),
                  "String type %d: unexpected value\n", expected->dwValueType);
         }
         LocalFree(buf);
     }
 }
 
 static const BYTE emptyURL[] = { 0x30, 0x02, 0x86, 0x00 };
 static const BYTE emptyURLExtraBytes[] = { 0x30, 0x02, 0x86, 0x00, 0, 0, 0 };
 static const WCHAR url[] = { 'h','t','t','p',':','/','/','w','i','n','e',
  'h','q','.','o','r','g',0 };
 static const BYTE encodedURL[] = { 0x30, 0x13, 0x86, 0x11, 0x68, 0x74,
  0x74, 0x70, 0x3a, 0x2f, 0x2f, 0x77, 0x69, 0x6e, 0x65, 0x68, 0x71, 0x2e,
  0x6f, 0x72, 0x67 };
 static const WCHAR nihongoURL[] = { 'h','t','t','p',':','/','/',0x226f,
  0x575b, 0 };
 static const WCHAR dnsName[] = { 'w','i','n','e','h','q','.','o','r','g',0 };
 static const BYTE encodedDnsName[] = { 0x30, 0x0c, 0x82, 0x0a, 0x77, 0x69,
  0x6e, 0x65, 0x68, 0x71, 0x2e, 0x6f, 0x72, 0x67 };
 static const BYTE localhost[] = { 127, 0, 0, 1 };
 static const BYTE encodedIPAddr[] = { 0x30, 0x06, 0x87, 0x04, 0x7f, 0x00, 0x00,
  0x01 };
 static const unsigned char encodedCommonName[] = {
     0x30,0x15,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,'J','u','a','n',' ','L','a','n','g',0};
 static const BYTE encodedOidName[] = { 0x30,0x04,0x88,0x02,0x2a,0x03 };
 static const BYTE encodedDirectoryName[] = {
 0x30,0x19,0xa4,0x17,0x30,0x15,0x31,0x13,0x30,0x11,0x06,0x03,0x55,0x04,0x03,
 0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,0x00 };
 
 static void test_encodeAltName(DWORD dwEncoding)
 {
     CERT_ALT_NAME_INFO info = { 0 };
     CERT_ALT_NAME_ENTRY entry = { 0 };
     BYTE *buf = NULL;
     DWORD size = 0;
     BOOL ret;
     char oid[] = "1.2.3";
 
     /* Test with empty info */
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(emptySequence), "Wrong size %d\n", size);
         ok(!memcmp(buf, emptySequence, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Test with an empty entry */
     info.cAltEntry = 1;
     info.rgAltEntry = &entry;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == E_INVALIDARG,
      "Expected E_INVALIDARG, got %08x\n", GetLastError());
     /* Test with an empty pointer */
     entry.dwAltNameChoice = CERT_ALT_NAME_URL;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(emptyURL), "Wrong size %d\n", size);
         ok(!memcmp(buf, emptyURL, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Test with a real URL */
     U(entry).pwszURL = (LPWSTR)url;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(encodedURL), "Wrong size %d\n", size);
         ok(!memcmp(buf, encodedURL, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Now with the URL containing an invalid IA5 char */
     U(entry).pwszURL = (LPWSTR)nihongoURL;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_INVALID_IA5_STRING,
      "Expected CRYPT_E_INVALID_IA5_STRING, got %08x\n", GetLastError());
     /* The first invalid character is at index 7 */
     ok(GET_CERT_ALT_NAME_VALUE_ERR_INDEX(size) == 7,
      "Expected invalid char at index 7, got %d\n",
      GET_CERT_ALT_NAME_VALUE_ERR_INDEX(size));
     /* Now with the URL missing a scheme */
     U(entry).pwszURL = (LPWSTR)dnsName;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         /* This succeeds, but it shouldn't, so don't worry about conforming */
         LocalFree(buf);
     }
     /* Now with a DNS name */
     entry.dwAltNameChoice = CERT_ALT_NAME_DNS_NAME;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(encodedDnsName), "Wrong size %d\n", size);
         ok(!memcmp(buf, encodedDnsName, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Test with an IP address */
     entry.dwAltNameChoice = CERT_ALT_NAME_IP_ADDRESS;
     U(entry).IPAddress.cbData = sizeof(localhost);
     U(entry).IPAddress.pbData = (LPBYTE)localhost;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(encodedIPAddr), "Wrong size %d\n", size);
         ok(!memcmp(buf, encodedIPAddr, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Test with OID */
     entry.dwAltNameChoice = CERT_ALT_NAME_REGISTERED_ID;
     U(entry).pszRegisteredID = oid;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(encodedOidName), "Wrong size %d\n", size);
         ok(!memcmp(buf, encodedOidName, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Test with directory name */
     entry.dwAltNameChoice = CERT_ALT_NAME_DIRECTORY_NAME;
     U(entry).DirectoryName.cbData = sizeof(encodedCommonName);
     U(entry).DirectoryName.pbData = (LPBYTE)encodedCommonName;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(encodedDirectoryName), "Wrong size %d\n", size);
         ok(!memcmp(buf, encodedDirectoryName, size), "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 static void test_decodeAltName(DWORD dwEncoding)
 {
     static const BYTE unimplementedType[] = { 0x30, 0x06, 0x85, 0x04, 0x7f,
      0x00, 0x00, 0x01 };
     static const BYTE bogusType[] = { 0x30, 0x06, 0x89, 0x04, 0x7f, 0x00, 0x00,
      0x01 };
     static const BYTE dns_embedded_null[] = { 0x30,0x10,0x82,0x0e,0x66,0x6f,
      0x6f,0x2e,0x63,0x6f,0x6d,0x00,0x62,0x61,0x64,0x64,0x69,0x65 };
     static const BYTE dns_embedded_bell[] = { 0x30,0x10,0x82,0x0e,0x66,0x6f,
      0x6f,0x2e,0x63,0x6f,0x6d,0x07,0x62,0x61,0x64,0x64,0x69,0x65 };
     static const BYTE url_embedded_null[] = { 0x30,0x10,0x86,0x0e,0x66,0x6f,
      0x6f,0x2e,0x63,0x6f,0x6d,0x00,0x62,0x61,0x64,0x64,0x69,0x65 };
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
     CERT_ALT_NAME_INFO *info;
 
     /* Test some bogus ones first */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      unimplementedType, sizeof(unimplementedType), CRYPT_DECODE_ALLOC_FLAG,
      NULL, &buf, &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_BADTAG ||
      GetLastError() == OSS_DATA_ERROR /* Win9x */),
      "Expected CRYPT_E_ASN1_BADTAG or OSS_DATA_ERROR, got %08x\n",
      GetLastError());
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      bogusType, sizeof(bogusType), CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
      &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_CORRUPT ||
      GetLastError() == OSS_DATA_ERROR /* Win9x */),
      "Expected CRYPT_E_ASN1_CORRUPT or OSS_DATA_ERROR, got %08x\n",
      GetLastError());
     /* Now expected cases */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, emptySequence,
      emptySequence[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 0, "Expected 0 entries, got %d\n",
          info->cAltEntry);
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, emptyURL,
      emptyURL[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_URL,
          "Expected CERT_ALT_NAME_URL, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         ok(U(info->rgAltEntry[0]).pwszURL == NULL || !*U(info->rgAltEntry[0]).pwszURL,
          "Expected empty URL\n");
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      emptyURLExtraBytes, sizeof(emptyURLExtraBytes), 0, NULL, NULL, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, encodedURL,
      encodedURL[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_URL,
          "Expected CERT_ALT_NAME_URL, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         ok(!lstrcmpW(U(info->rgAltEntry[0]).pwszURL, url), "Unexpected URL\n");
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, encodedDnsName,
      encodedDnsName[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_DNS_NAME,
          "Expected CERT_ALT_NAME_DNS_NAME, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         ok(!lstrcmpW(U(info->rgAltEntry[0]).pwszDNSName, dnsName),
          "Unexpected DNS name\n");
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, encodedIPAddr,
      encodedIPAddr[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_IP_ADDRESS,
          "Expected CERT_ALT_NAME_IP_ADDRESS, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         ok(U(info->rgAltEntry[0]).IPAddress.cbData == sizeof(localhost),
          "Unexpected IP address length %d\n",
           U(info->rgAltEntry[0]).IPAddress.cbData);
         ok(!memcmp(U(info->rgAltEntry[0]).IPAddress.pbData, localhost,
          sizeof(localhost)), "Unexpected IP address value\n");
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME, encodedOidName,
      sizeof(encodedOidName), CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_REGISTERED_ID,
          "Expected CERT_ALT_NAME_REGISTERED_ID, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         ok(!strcmp(U(info->rgAltEntry[0]).pszRegisteredID, "1.2.3"),
            "Expected OID 1.2.3, got %s\n", U(info->rgAltEntry[0]).pszRegisteredID);
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      encodedDirectoryName, sizeof(encodedDirectoryName),
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_DIRECTORY_NAME,
          "Expected CERT_ALT_NAME_DIRECTORY_NAME, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         ok(U(info->rgAltEntry[0]).DirectoryName.cbData ==
          sizeof(encodedCommonName), "Unexpected directory name length %d\n",
           U(info->rgAltEntry[0]).DirectoryName.cbData);
         ok(!memcmp(U(info->rgAltEntry[0]).DirectoryName.pbData,
          encodedCommonName, sizeof(encodedCommonName)),
          "Unexpected directory name value\n");
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      dns_embedded_null, sizeof(dns_embedded_null), CRYPT_DECODE_ALLOC_FLAG,
      NULL, &buf, &bufSize);
     /* Fails on WinXP with CRYPT_E_ASN1_RULE.  I'm not too concerned about the
      * particular failure, just that it doesn't decode.
      * It succeeds on (broken) Windows versions that haven't addressed
      * embedded NULLs in alternate names.
      */
     ok(!ret || broken(ret), "expected failure\n");
     /* An embedded bell character is allowed, however. */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      dns_embedded_bell, sizeof(dns_embedded_bell), CRYPT_DECODE_ALLOC_FLAG,
      NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (ret)
     {
         info = (CERT_ALT_NAME_INFO *)buf;
 
         ok(info->cAltEntry == 1, "Expected 1 entries, got %d\n",
          info->cAltEntry);
         ok(info->rgAltEntry[0].dwAltNameChoice == CERT_ALT_NAME_DNS_NAME,
          "Expected CERT_ALT_NAME_DNS_NAME, got %d\n",
          info->rgAltEntry[0].dwAltNameChoice);
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
      url_embedded_null, sizeof(dns_embedded_null), CRYPT_DECODE_ALLOC_FLAG,
      NULL, &buf, &bufSize);
     /* Again, fails on WinXP with CRYPT_E_ASN1_RULE.  I'm not too concerned
      * about the particular failure, just that it doesn't decode.
      * It succeeds on (broken) Windows versions that haven't addressed
      * embedded NULLs in alternate names.
      */
     ok(!ret || broken(ret), "expected failure\n");
 }
 
 struct UnicodeExpectedError
 {
     DWORD   valueType;
     LPCWSTR str;
     DWORD   errorIndex;
     DWORD   error;
 };
 
 static const WCHAR oneW[] = { '1',0 };
 static const WCHAR aW[] = { 'a',0 };
 static const WCHAR quoteW[] = { '"', 0 };
 
 static struct UnicodeExpectedError unicodeErrors[] = {
  { CERT_RDN_ANY_TYPE,         oneW,       0, CRYPT_E_NOT_CHAR_STRING },
  { CERT_RDN_ENCODED_BLOB,     oneW,       0, CRYPT_E_NOT_CHAR_STRING },
  { CERT_RDN_OCTET_STRING,     oneW,       0, CRYPT_E_NOT_CHAR_STRING },
  { CERT_RDN_NUMERIC_STRING,   aW,         0, CRYPT_E_INVALID_NUMERIC_STRING },
  { CERT_RDN_PRINTABLE_STRING, quoteW,     0, CRYPT_E_INVALID_PRINTABLE_STRING },
  { CERT_RDN_IA5_STRING,       nihongoURL, 7, CRYPT_E_INVALID_IA5_STRING },
 };
 
 struct UnicodeExpectedResult
 {
     DWORD           valueType;
     LPCWSTR         str;
     CRYPT_DATA_BLOB encoded;
 };
 
 static BYTE oneNumeric[] = { 0x12, 0x01, 0x31 };
 static BYTE onePrintable[] = { 0x13, 0x01, 0x31 };
 static BYTE oneTeletex[] = { 0x14, 0x01, 0x31 };
 static BYTE oneVideotex[] = { 0x15, 0x01, 0x31 };
 static BYTE oneIA5[] = { 0x16, 0x01, 0x31 };
 static BYTE oneGraphic[] = { 0x19, 0x01, 0x31 };
 static BYTE oneVisible[] = { 0x1a, 0x01, 0x31 };
 static BYTE oneUniversal[] = { 0x1c, 0x04, 0x00, 0x00, 0x00, 0x31 };
 static BYTE oneGeneral[] = { 0x1b, 0x01, 0x31 };
 static BYTE oneBMP[] = { 0x1e, 0x02, 0x00, 0x31 };
 static BYTE oneUTF8[] = { 0x0c, 0x01, 0x31 };
 static BYTE nihongoT61[] = { 0x14,0x09,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,0x6f,
  0x5b };
 static BYTE nihongoGeneral[] = { 0x1b,0x09,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,
  0x6f,0x5b };
 static BYTE nihongoBMP[] = { 0x1e,0x12,0x00,0x68,0x00,0x74,0x00,0x74,0x00,0x70,
  0x00,0x3a,0x00,0x2f,0x00,0x2f,0x22,0x6f,0x57,0x5b };
 static BYTE nihongoUTF8[] = { 0x0c,0x0d,0x68,0x74,0x74,0x70,0x3a,0x2f,0x2f,
  0xe2,0x89,0xaf,0xe5,0x9d,0x9b };
 
 static struct UnicodeExpectedResult unicodeResults[] = {
  { CERT_RDN_NUMERIC_STRING,   oneW, { sizeof(oneNumeric), oneNumeric } },
  { CERT_RDN_PRINTABLE_STRING, oneW, { sizeof(onePrintable), onePrintable } },
  { CERT_RDN_TELETEX_STRING,   oneW, { sizeof(oneTeletex), oneTeletex } },
  { CERT_RDN_VIDEOTEX_STRING,  oneW, { sizeof(oneVideotex), oneVideotex } },
  { CERT_RDN_IA5_STRING,       oneW, { sizeof(oneIA5), oneIA5 } },
  { CERT_RDN_GRAPHIC_STRING,   oneW, { sizeof(oneGraphic), oneGraphic } },
  { CERT_RDN_VISIBLE_STRING,   oneW, { sizeof(oneVisible), oneVisible } },
  { CERT_RDN_UNIVERSAL_STRING, oneW, { sizeof(oneUniversal), oneUniversal } },
  { CERT_RDN_GENERAL_STRING,   oneW, { sizeof(oneGeneral), oneGeneral } },
  { CERT_RDN_BMP_STRING,       oneW, { sizeof(oneBMP), oneBMP } },
  { CERT_RDN_UTF8_STRING,      oneW, { sizeof(oneUTF8), oneUTF8 } },
  { CERT_RDN_BMP_STRING,     nihongoURL, { sizeof(nihongoBMP), nihongoBMP } },
  { CERT_RDN_UTF8_STRING,    nihongoURL, { sizeof(nihongoUTF8), nihongoUTF8 } },
 };
 
 static struct UnicodeExpectedResult unicodeWeirdness[] = {
  { CERT_RDN_TELETEX_STRING, nihongoURL, { sizeof(nihongoT61), nihongoT61 } },
  { CERT_RDN_GENERAL_STRING, nihongoURL, { sizeof(nihongoGeneral), nihongoGeneral } },
 };
 
 static void test_encodeUnicodeNameValue(DWORD dwEncoding)
 {
     BYTE *buf = NULL;
     DWORD size = 0, i;
     BOOL ret;
     CERT_NAME_VALUE value;
 
     if (0)
     {
         /* Crashes on win9x */
         ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, NULL,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* Have to have a string of some sort */
     value.dwValueType = 0; /* aka CERT_RDN_ANY_TYPE */
     value.Value.pbData = NULL;
     value.Value.cbData = 0;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_NOT_CHAR_STRING,
      "Expected CRYPT_E_NOT_CHAR_STRING, got %08x\n", GetLastError());
     value.dwValueType = CERT_RDN_ENCODED_BLOB;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_NOT_CHAR_STRING,
      "Expected CRYPT_E_NOT_CHAR_STRING, got %08x\n", GetLastError());
     value.dwValueType = CERT_RDN_ANY_TYPE;
     value.Value.pbData = (LPBYTE)oneW;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_NOT_CHAR_STRING,
      "Expected CRYPT_E_NOT_CHAR_STRING, got %08x\n", GetLastError());
     value.Value.cbData = sizeof(oneW);
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_NOT_CHAR_STRING,
      "Expected CRYPT_E_NOT_CHAR_STRING, got %08x\n", GetLastError());
     /* An encoded string with specified length isn't good enough either */
     value.dwValueType = CERT_RDN_ENCODED_BLOB;
     value.Value.pbData = oneUniversal;
     value.Value.cbData = sizeof(oneUniversal);
     ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && GetLastError() == CRYPT_E_NOT_CHAR_STRING,
      "Expected CRYPT_E_NOT_CHAR_STRING, got %08x\n", GetLastError());
     /* More failure checking */
     value.Value.cbData = 0;
     for (i = 0; i < sizeof(unicodeErrors) / sizeof(unicodeErrors[0]); i++)
     {
         value.Value.pbData = (LPBYTE)unicodeErrors[i].str;
         value.dwValueType = unicodeErrors[i].valueType;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == unicodeErrors[i].error,
          "Value type %d: expected %08x, got %08x\n", value.dwValueType,
          unicodeErrors[i].error, GetLastError());
         ok(size == unicodeErrors[i].errorIndex,
          "Expected error index %d, got %d\n", unicodeErrors[i].errorIndex,
          size);
     }
     /* cbData can be zero if the string is NULL-terminated */
     value.Value.cbData = 0;
     for (i = 0; i < sizeof(unicodeResults) / sizeof(unicodeResults[0]); i++)
     {
         value.Value.pbData = (LPBYTE)unicodeResults[i].str;
         value.dwValueType = unicodeResults[i].valueType;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(ret || broken(GetLastError() == OSS_PDU_MISMATCH /* Win9x */),
          "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(size == unicodeResults[i].encoded.cbData,
              "Value type %d: expected size %d, got %d\n",
              value.dwValueType, unicodeResults[i].encoded.cbData, size);
             ok(!memcmp(unicodeResults[i].encoded.pbData, buf, size),
              "Value type %d: unexpected value\n", value.dwValueType);
             LocalFree(buf);
         }
     }
     /* These "encode," but they do so by truncating each unicode character
      * rather than properly encoding it.  Kept separate from the proper results,
      * because the encoded forms won't decode to their original strings.
      */
     for (i = 0; i < sizeof(unicodeWeirdness) / sizeof(unicodeWeirdness[0]); i++)
     {
         value.Value.pbData = (LPBYTE)unicodeWeirdness[i].str;
         value.dwValueType = unicodeWeirdness[i].valueType;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE, &value,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(size == unicodeWeirdness[i].encoded.cbData,
              "Value type %d: expected size %d, got %d\n",
              value.dwValueType, unicodeWeirdness[i].encoded.cbData, size);
             ok(!memcmp(unicodeWeirdness[i].encoded.pbData, buf, size),
              "Value type %d: unexpected value\n", value.dwValueType);
             LocalFree(buf);
         }
     }
 }
 
 static inline int strncmpW( const WCHAR *str1, const WCHAR *str2, int n )
 {
     if (n <= 0) return 0;
     while ((--n > 0) && *str1 && (*str1 == *str2)) { str1++; str2++; }
     return *str1 - *str2;
 }
 
 static void test_decodeUnicodeNameValue(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(unicodeResults) / sizeof(unicodeResults[0]); i++)
     {
         BYTE *buf = NULL;
         BOOL ret;
         DWORD size = 0;
 
         ret = pCryptDecodeObjectEx(dwEncoding, X509_UNICODE_NAME_VALUE,
          unicodeResults[i].encoded.pbData, unicodeResults[i].encoded.cbData,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(ret || broken(GetLastError() == CRYPT_E_NOT_CHAR_STRING /* Win9x */),
          "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         if (ret && buf)
         {
             PCERT_NAME_VALUE value = (PCERT_NAME_VALUE)buf;
 
             ok(value->dwValueType == unicodeResults[i].valueType,
              "Expected value type %d, got %d\n", unicodeResults[i].valueType,
              value->dwValueType);
             ok(!strncmpW((LPWSTR)value->Value.pbData, unicodeResults[i].str,
              value->Value.cbData / sizeof(WCHAR)),
              "Unexpected decoded value for index %d (value type %d)\n", i,
              unicodeResults[i].valueType);
             LocalFree(buf);
         }
     }
 }
 
 struct encodedOctets
 {
     const BYTE *val;
     const BYTE *encoded;
 };
 
 static const unsigned char bin46[] = { 'h','i',0 };
 static const unsigned char bin47[] = { 0x04,0x02,'h','i',0 };
 static const unsigned char bin48[] = {
      's','o','m','e','l','o','n','g',0xff,'s','t','r','i','n','g',0 };
 static const unsigned char bin49[] = {
      0x04,0x0f,'s','o','m','e','l','o','n','g',0xff,'s','t','r','i','n','g',0 };
 static const unsigned char bin50[] = { 0 };
 static const unsigned char bin51[] = { 0x04,0x00,0 };
 
 static const struct encodedOctets octets[] = {
     { bin46, bin47 },
     { bin48, bin49 },
     { bin50, bin51 },
 };
 
 static void test_encodeOctets(DWORD dwEncoding)
 {
     CRYPT_DATA_BLOB blob;
     DWORD i;
 
     for (i = 0; i < sizeof(octets) / sizeof(octets[0]); i++)
     {
         BYTE *buf = NULL;
         BOOL ret;
         DWORD bufSize = 0;
 
         blob.cbData = strlen((const char*)octets[i].val);
         blob.pbData = (BYTE*)octets[i].val;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_OCTET_STRING, &blob,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %d\n", GetLastError());
         if (buf)
         {
             ok(buf[0] == 4,
              "Got unexpected type %d for octet string (expected 4)\n", buf[0]);
             ok(buf[1] == octets[i].encoded[1], "Got length %d, expected %d\n",
              buf[1], octets[i].encoded[1]);
             ok(!memcmp(buf + 1, octets[i].encoded + 1,
              octets[i].encoded[1] + 1), "Got unexpected value\n");
             LocalFree(buf);
         }
     }
 }
 
 static void test_decodeOctets(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(octets) / sizeof(octets[0]); i++)
     {
         BYTE *buf = NULL;
         BOOL ret;
         DWORD bufSize = 0;
 
         ret = pCryptDecodeObjectEx(dwEncoding, X509_OCTET_STRING,
          octets[i].encoded, octets[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         ok(bufSize >= sizeof(CRYPT_DATA_BLOB) + octets[i].encoded[1],
          "Expected size >= %d, got %d\n",
            (int)sizeof(CRYPT_DATA_BLOB) + octets[i].encoded[1], bufSize);
         ok(buf != NULL, "Expected allocated buffer\n");
         if (buf)
         {
             CRYPT_DATA_BLOB *blob = (CRYPT_DATA_BLOB *)buf;
 
             if (blob->cbData)
                 ok(!memcmp(blob->pbData, octets[i].val, blob->cbData),
                  "Unexpected value\n");
             LocalFree(buf);
         }
     }
 }
 
 static const BYTE bytesToEncode[] = { 0xff, 0xff };
 
 struct encodedBits
 {
     DWORD cUnusedBits;
     const BYTE *encoded;
     DWORD cbDecoded;
     const BYTE *decoded;
 };
 
 static const unsigned char bin52[] = { 0x03,0x03,0x00,0xff,0xff };
 static const unsigned char bin53[] = { 0xff,0xff };
 static const unsigned char bin54[] = { 0x03,0x03,0x01,0xff,0xfe };
 static const unsigned char bin55[] = { 0xff,0xfe };
 static const unsigned char bin56[] = { 0x03,0x02,0x01,0xfe };
 static const unsigned char bin57[] = { 0xfe };
 static const unsigned char bin58[] = { 0x03,0x01,0x00 };
 
 static const struct encodedBits bits[] = {
     /* normal test cases */
     { 0, bin52, 2, bin53 },
     { 1, bin54, 2, bin55 },
     /* strange test case, showing cUnusedBits >= 8 is allowed */
     { 9, bin56, 1, bin57 },
 };
 
 static void test_encodeBits(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(bits) / sizeof(bits[0]); i++)
     {
         CRYPT_BIT_BLOB blob;
         BOOL ret;
         BYTE *buf = NULL;
         DWORD bufSize = 0;
 
         blob.cbData = sizeof(bytesToEncode);
         blob.pbData = (BYTE *)bytesToEncode;
         blob.cUnusedBits = bits[i].cUnusedBits;
         ret = pCryptEncodeObjectEx(dwEncoding, X509_BITS, &blob,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(bufSize == bits[i].encoded[1] + 2,
              "%d: Got unexpected size %d, expected %d\n", i, bufSize,
              bits[i].encoded[1] + 2);
             ok(!memcmp(buf, bits[i].encoded, bits[i].encoded[1] + 2),
              "%d: Unexpected value\n", i);
             LocalFree(buf);
         }
     }
 }
 
 static void test_decodeBits(DWORD dwEncoding)
 {
     static const BYTE ber[] = "\x03\x02\x01\xff";
     static const BYTE berDecoded = 0xfe;
     DWORD i;
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
 
     /* normal cases */
     for (i = 0; i < sizeof(bits) / sizeof(bits[0]); i++)
     {
         ret = pCryptDecodeObjectEx(dwEncoding, X509_BITS, bits[i].encoded,
          bits[i].encoded[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
          &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             CRYPT_BIT_BLOB *blob;
 
             ok(bufSize >= sizeof(CRYPT_BIT_BLOB) + bits[i].cbDecoded,
                "Got unexpected size %d\n", bufSize);
             blob = (CRYPT_BIT_BLOB *)buf;
             ok(blob->cbData == bits[i].cbDecoded,
              "Got unexpected length %d, expected %d\n", blob->cbData,
              bits[i].cbDecoded);
             if (blob->cbData && bits[i].cbDecoded)
                 ok(!memcmp(blob->pbData, bits[i].decoded, bits[i].cbDecoded),
                  "Unexpected value\n");
             LocalFree(buf);
         }
     }
     /* special case: check that something that's valid in BER but not in DER
      * decodes successfully
      */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_BITS, ber, ber[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CRYPT_BIT_BLOB *blob;
 
         ok(bufSize >= sizeof(CRYPT_BIT_BLOB) + sizeof(berDecoded),
            "Got unexpected size %d\n", bufSize);
         blob = (CRYPT_BIT_BLOB *)buf;
         ok(blob->cbData == sizeof(berDecoded),
            "Got unexpected length %d\n", blob->cbData);
         if (blob->cbData)
             ok(*blob->pbData == berDecoded, "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 struct Constraints2
 {
     CERT_BASIC_CONSTRAINTS2_INFO info;
     const BYTE *encoded;
 };
 
 static const unsigned char bin59[] = { 0x30,0x00 };
 static const unsigned char bin60[] = { 0x30,0x03,0x01,0x01,0xff };
 static const unsigned char bin61[] = { 0x30,0x03,0x02,0x01,0x00 };
 static const unsigned char bin62[] = { 0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
 static const struct Constraints2 constraints2[] = {
  /* empty constraints */
  { { FALSE, FALSE, 0}, bin59 },
  /* can be a CA */
  { { TRUE,  FALSE, 0}, bin60 },
  /* has path length constraints set (MSDN implies fCA needs to be TRUE as well,
   * but that's not the case
   */
  { { FALSE, TRUE,  0}, bin61 },
  /* can be a CA and has path length constraints set */
  { { TRUE,  TRUE,  1}, bin62 },
 };
 
 static const BYTE emptyConstraint[] = { 0x30, 0x03, 0x03, 0x01, 0x00 };
 static const BYTE encodedDomainName[] = { 0x30, 0x2b, 0x31, 0x29, 0x30, 0x11,
  0x06, 0x0a, 0x09, 0x92, 0x26, 0x89, 0x93, 0xf2, 0x2c, 0x64, 0x01, 0x19, 0x16,
  0x03, 0x6f, 0x72, 0x67, 0x30, 0x14, 0x06, 0x0a, 0x09, 0x92, 0x26, 0x89, 0x93,
  0xf2, 0x2c, 0x64, 0x01, 0x19, 0x16, 0x06, 0x77, 0x69, 0x6e, 0x65, 0x68, 0x71 };
 static const BYTE constraintWithDomainName[] = { 0x30, 0x32, 0x03, 0x01, 0x00,
  0x30, 0x2d, 0x30, 0x2b, 0x31, 0x29, 0x30, 0x11, 0x06, 0x0a, 0x09, 0x92, 0x26,
  0x89, 0x93, 0xf2, 0x2c, 0x64, 0x01, 0x19, 0x16, 0x03, 0x6f, 0x72, 0x67, 0x30,
  0x14, 0x06, 0x0a, 0x09, 0x92, 0x26, 0x89, 0x93, 0xf2, 0x2c, 0x64, 0x01, 0x19,
  0x16, 0x06, 0x77, 0x69, 0x6e, 0x65, 0x68, 0x71 };
 
 static void test_encodeBasicConstraints(DWORD dwEncoding)
 {
     DWORD i, bufSize = 0;
     CERT_BASIC_CONSTRAINTS_INFO info = { { 0 } };
     CERT_NAME_BLOB nameBlob = { sizeof(encodedDomainName),
      (LPBYTE)encodedDomainName };
     BOOL ret;
     BYTE *buf = NULL;
 
     /* First test with the simpler info2 */
     for (i = 0; i < sizeof(constraints2) / sizeof(constraints2[0]); i++)
     {
         ret = pCryptEncodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS2,
          &constraints2[i].info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf,
          &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(bufSize == constraints2[i].encoded[1] + 2,
              "Expected %d bytes, got %d\n", constraints2[i].encoded[1] + 2,
              bufSize);
             ok(!memcmp(buf, constraints2[i].encoded,
              constraints2[i].encoded[1] + 2), "Unexpected value\n");
             LocalFree(buf);
         }
     }
     /* Now test with more complex basic constraints */
     info.SubjectType.cbData = 0;
     info.fPathLenConstraint = FALSE;
     info.cSubtreesConstraint = 0;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(bufSize == sizeof(emptyConstraint), "Wrong size %d\n", bufSize);
         ok(!memcmp(buf, emptyConstraint, sizeof(emptyConstraint)),
          "Unexpected value\n");
         LocalFree(buf);
     }
     /* None of the certs I examined had any subtree constraint, but I test one
      * anyway just in case.
      */
     info.cSubtreesConstraint = 1;
     info.rgSubtreesConstraint = &nameBlob;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(bufSize == sizeof(constraintWithDomainName), "Wrong size %d\n", bufSize);
         ok(!memcmp(buf, constraintWithDomainName,
          sizeof(constraintWithDomainName)), "Unexpected value\n");
         LocalFree(buf);
     }
     /* FIXME: test encoding with subject type. */
 }
 
 static const unsigned char bin63[] = { 0x30,0x06,0x01,0x01,0x01,0x02,0x01,0x01 };
 
 static void test_decodeBasicConstraints(DWORD dwEncoding)
 {
     static const BYTE inverted[] = { 0x30, 0x06, 0x02, 0x01, 0x01, 0x01, 0x01,
      0xff };
     static const struct Constraints2 badBool = { { TRUE, TRUE, 1 }, bin63 };
     DWORD i;
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
 
     /* First test with simpler info2 */
     for (i = 0; i < sizeof(constraints2) / sizeof(constraints2[0]); i++)
     {
         ret = pCryptDecodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS2,
          constraints2[i].encoded, constraints2[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed for item %d: %08x\n", i,
          GetLastError());
         if (buf)
         {
             CERT_BASIC_CONSTRAINTS2_INFO *info =
              (CERT_BASIC_CONSTRAINTS2_INFO *)buf;
 
             ok(!memcmp(info, &constraints2[i].info, sizeof(*info)),
              "Unexpected value for item %d\n", i);
             LocalFree(buf);
         }
     }
     /* Check with the order of encoded elements inverted */
     buf = (PBYTE)1;
     ret = pCryptDecodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS2,
      inverted, inverted[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
      &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_CORRUPT ||
      GetLastError() == OSS_DATA_ERROR /* Win9x */),
      "Expected CRYPT_E_ASN1_CORRUPT or OSS_DATA_ERROR, got %08x\n",
      GetLastError());
     ok(!buf, "Expected buf to be set to NULL\n");
     /* Check with a non-DER bool */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS2,
      badBool.encoded, badBool.encoded[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_BASIC_CONSTRAINTS2_INFO *info =
          (CERT_BASIC_CONSTRAINTS2_INFO *)buf;
 
         ok(!memcmp(info, &badBool.info, sizeof(*info)), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Check with a non-basic constraints value */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS2,
      encodedCommonName, encodedCommonName[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_CORRUPT ||
      GetLastError() == OSS_DATA_ERROR /* Win9x */),
      "Expected CRYPT_E_ASN1_CORRUPT or OSS_DATA_ERROR, got %08x\n",
      GetLastError());
     /* Now check with the more complex CERT_BASIC_CONSTRAINTS_INFO */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS,
      emptyConstraint, sizeof(emptyConstraint), CRYPT_DECODE_ALLOC_FLAG, NULL,
      &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_BASIC_CONSTRAINTS_INFO *info = (CERT_BASIC_CONSTRAINTS_INFO *)buf;
 
         ok(info->SubjectType.cbData == 0, "Expected no subject type\n");
         ok(!info->fPathLenConstraint, "Expected no path length constraint\n");
         ok(info->cSubtreesConstraint == 0, "Expected no subtree constraints\n");
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_BASIC_CONSTRAINTS,
      constraintWithDomainName, sizeof(constraintWithDomainName),
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_BASIC_CONSTRAINTS_INFO *info = (CERT_BASIC_CONSTRAINTS_INFO *)buf;
 
         ok(info->SubjectType.cbData == 0, "Expected no subject type\n");
         ok(!info->fPathLenConstraint, "Expected no path length constraint\n");
         ok(info->cSubtreesConstraint == 1, "Expected a subtree constraint\n");
         if (info->cSubtreesConstraint && info->rgSubtreesConstraint)
         {
             ok(info->rgSubtreesConstraint[0].cbData ==
              sizeof(encodedDomainName), "Wrong size %d\n",
              info->rgSubtreesConstraint[0].cbData);
             ok(!memcmp(info->rgSubtreesConstraint[0].pbData, encodedDomainName,
              sizeof(encodedDomainName)), "Unexpected value\n");
         }
         LocalFree(buf);
     }
 }
 
 /* These are terrible public keys of course, I'm just testing encoding */
 static const BYTE modulus1[] = { 0,0,0,1,1,1,1,1 };
 static const BYTE modulus2[] = { 1,1,1,1,1,0,0,0 };
 static const BYTE modulus3[] = { 0x80,1,1,1,1,0,0,0 };
 static const BYTE modulus4[] = { 1,1,1,1,1,0,0,0x80 };
 static const BYTE mod1_encoded[] = { 0x30,0x0f,0x02,0x08,0x01,0x01,0x01,0x01,0x01,0x00,0x00,0x00,0x02,0x03,0x01,0x00,0x01 };
 static const BYTE mod2_encoded[] = { 0x30,0x0c,0x02,0x05,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x01,0x00,0x01 };
 static const BYTE mod3_encoded[] = { 0x30,0x0c,0x02,0x05,0x01,0x01,0x01,0x01,0x80,0x02,0x03,0x01,0x00,0x01 };
 static const BYTE mod4_encoded[] = { 0x30,0x10,0x02,0x09,0x00,0x80,0x00,0x00,0x01,0x01,0x01,0x01,0x01,0x02,0x03,0x01,0x00,0x01 };
 
 struct EncodedRSAPubKey
 {
     const BYTE *modulus;
     size_t modulusLen;
     const BYTE *encoded;
     size_t decodedModulusLen;
 };
 
 struct EncodedRSAPubKey rsaPubKeys[] = {
     { modulus1, sizeof(modulus1), mod1_encoded, sizeof(modulus1) },
     { modulus2, sizeof(modulus2), mod2_encoded, 5 },
     { modulus3, sizeof(modulus3), mod3_encoded, 5 },
     { modulus4, sizeof(modulus4), mod4_encoded, 8 },
 };
 
 static void test_encodeRsaPublicKey(DWORD dwEncoding)
 {
     BYTE toEncode[sizeof(BLOBHEADER) + sizeof(RSAPUBKEY) + sizeof(modulus1)];
     BLOBHEADER *hdr = (BLOBHEADER *)toEncode;
     RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(toEncode + sizeof(BLOBHEADER));
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0, i;
 
     /* Try with a bogus blob type */
     hdr->bType = 2;
     hdr->bVersion = CUR_BLOB_VERSION;
     hdr->reserved = 0;
     hdr->aiKeyAlg = CALG_RSA_KEYX;
     rsaPubKey->magic = 0x31415352;
     rsaPubKey->bitlen = sizeof(modulus1) * 8;
     rsaPubKey->pubexp = 65537;
     memcpy(toEncode + sizeof(BLOBHEADER) + sizeof(RSAPUBKEY), modulus1,
      sizeof(modulus1));
 
     ret = pCryptEncodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
      toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == E_INVALIDARG,
      "Expected E_INVALIDARG, got %08x\n", GetLastError());
     /* Now with a bogus reserved field */
     hdr->bType = PUBLICKEYBLOB;
     hdr->reserved = 1;
     ret = pCryptEncodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
      toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     if (buf)
     {
         ok(bufSize == rsaPubKeys[0].encoded[1] + 2,
          "Expected size %d, got %d\n", rsaPubKeys[0].encoded[1] + 2, bufSize);
         ok(!memcmp(buf, rsaPubKeys[0].encoded, bufSize), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Now with a bogus blob version */
     hdr->reserved = 0;
     hdr->bVersion = 0;
     ret = pCryptEncodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
      toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     if (buf)
     {
         ok(bufSize == rsaPubKeys[0].encoded[1] + 2,
          "Expected size %d, got %d\n", rsaPubKeys[0].encoded[1] + 2, bufSize);
         ok(!memcmp(buf, rsaPubKeys[0].encoded, bufSize), "Unexpected value\n");
         LocalFree(buf);
     }
     /* And with a bogus alg ID */
     hdr->bVersion = CUR_BLOB_VERSION;
     hdr->aiKeyAlg = CALG_DES;
     ret = pCryptEncodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
      toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     if (buf)
     {
         ok(bufSize == rsaPubKeys[0].encoded[1] + 2,
          "Expected size %d, got %d\n", rsaPubKeys[0].encoded[1] + 2, bufSize);
         ok(!memcmp(buf, rsaPubKeys[0].encoded, bufSize), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Check a couple of RSA-related OIDs */
     hdr->aiKeyAlg = CALG_RSA_KEYX;
     ret = pCryptEncodeObjectEx(dwEncoding, szOID_RSA_RSA,
      toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
     ret = pCryptEncodeObjectEx(dwEncoding, szOID_RSA_SHA1RSA,
      toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
     /* Finally, all valid */
     hdr->aiKeyAlg = CALG_RSA_KEYX;
     for (i = 0; i < sizeof(rsaPubKeys) / sizeof(rsaPubKeys[0]); i++)
     {
         memcpy(toEncode + sizeof(BLOBHEADER) + sizeof(RSAPUBKEY),
          rsaPubKeys[i].modulus, rsaPubKeys[i].modulusLen);
         ret = pCryptEncodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
          toEncode, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(bufSize == rsaPubKeys[i].encoded[1] + 2,
              "Expected size %d, got %d\n", rsaPubKeys[i].encoded[1] + 2,
              bufSize);
             ok(!memcmp(buf, rsaPubKeys[i].encoded, bufSize),
              "Unexpected value\n");
             LocalFree(buf);
         }
     }
 }
 
 static void test_decodeRsaPublicKey(DWORD dwEncoding)
 {
     DWORD i;
     LPBYTE buf = NULL;
     DWORD bufSize = 0;
     BOOL ret;
 
     /* Try with a bad length */
     ret = pCryptDecodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
      rsaPubKeys[0].encoded, rsaPubKeys[0].encoded[1],
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_EOD ||
      GetLastError() == OSS_MORE_INPUT /* Win9x/NT4 */),
      "Expected CRYPT_E_ASN1_EOD or OSS_MORE_INPUT, got %08x\n",
      GetLastError());
     /* Try with a couple of RSA-related OIDs */
     ret = pCryptDecodeObjectEx(dwEncoding, szOID_RSA_RSA,
      rsaPubKeys[0].encoded, rsaPubKeys[0].encoded[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
     ret = pCryptDecodeObjectEx(dwEncoding, szOID_RSA_SHA1RSA,
      rsaPubKeys[0].encoded, rsaPubKeys[0].encoded[1] + 2,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(!ret && GetLastError() == ERROR_FILE_NOT_FOUND,
      "Expected ERROR_FILE_NOT_FOUND, got %08x\n", GetLastError());
     /* Now try success cases */
     for (i = 0; i < sizeof(rsaPubKeys) / sizeof(rsaPubKeys[0]); i++)
     {
         bufSize = 0;
         ret = pCryptDecodeObjectEx(dwEncoding, RSA_CSP_PUBLICKEYBLOB,
          rsaPubKeys[i].encoded, rsaPubKeys[i].encoded[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             BLOBHEADER *hdr = (BLOBHEADER *)buf;
             RSAPUBKEY *rsaPubKey = (RSAPUBKEY *)(buf + sizeof(BLOBHEADER));
 
             ok(bufSize >= sizeof(BLOBHEADER) + sizeof(RSAPUBKEY) +
              rsaPubKeys[i].decodedModulusLen,
              "Wrong size %d\n", bufSize);
             ok(hdr->bType == PUBLICKEYBLOB,
              "Expected type PUBLICKEYBLOB (%d), got %d\n", PUBLICKEYBLOB,
              hdr->bType);
             ok(hdr->bVersion == CUR_BLOB_VERSION,
              "Expected version CUR_BLOB_VERSION (%d), got %d\n",
              CUR_BLOB_VERSION, hdr->bVersion);
             ok(hdr->reserved == 0, "Expected reserved 0, got %d\n",
              hdr->reserved);
             ok(hdr->aiKeyAlg == CALG_RSA_KEYX,
              "Expected CALG_RSA_KEYX, got %08x\n", hdr->aiKeyAlg);
             ok(rsaPubKey->magic == 0x31415352,
              "Expected magic RSA1, got %08x\n", rsaPubKey->magic);
             ok(rsaPubKey->bitlen == rsaPubKeys[i].decodedModulusLen * 8,
              "Wrong bit len %d\n", rsaPubKey->bitlen);
             ok(rsaPubKey->pubexp == 65537, "Expected pubexp 65537, got %d\n",
              rsaPubKey->pubexp);
             ok(!memcmp(buf + sizeof(BLOBHEADER) + sizeof(RSAPUBKEY),
              rsaPubKeys[i].modulus, rsaPubKeys[i].decodedModulusLen),
              "Unexpected modulus\n");
             LocalFree(buf);
         }
     }
 }
 
 static const BYTE intSequence[] = { 0x30, 0x1b, 0x02, 0x01, 0x01, 0x02, 0x01,
  0x7f, 0x02, 0x02, 0x00, 0x80, 0x02, 0x02, 0x01, 0x00, 0x02, 0x01, 0x80, 0x02,
  0x02, 0xff, 0x7f, 0x02, 0x04, 0xba, 0xdd, 0xf0, 0x0d };
 
 static const BYTE mixedSequence[] = { 0x30, 0x27, 0x17, 0x0d, 0x30, 0x35, 0x30,
  0x36, 0x30, 0x36, 0x31, 0x36, 0x31, 0x30, 0x30, 0x30, 0x5a, 0x02, 0x01, 0x7f,
  0x02, 0x02, 0x00, 0x80, 0x02, 0x02, 0x01, 0x00, 0x02, 0x01, 0x80, 0x02, 0x02,
  0xff, 0x7f, 0x02, 0x04, 0xba, 0xdd, 0xf0, 0x0d };
 
 static void test_encodeSequenceOfAny(DWORD dwEncoding)
 {
     CRYPT_DER_BLOB blobs[sizeof(ints) / sizeof(ints[0])];
     CRYPT_SEQUENCE_OF_ANY seq;
     DWORD i;
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
 
     /* Encode a homogeneous sequence */
     for (i = 0; i < sizeof(ints) / sizeof(ints[0]); i++)
     {
         blobs[i].cbData = ints[i].encoded[1] + 2;
         blobs[i].pbData = (BYTE *)ints[i].encoded;
     }
     seq.cValue = sizeof(ints) / sizeof(ints[0]);
     seq.rgValue = blobs;
 
     ret = pCryptEncodeObjectEx(dwEncoding, X509_SEQUENCE_OF_ANY, &seq,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(bufSize == sizeof(intSequence), "Wrong size %d\n", bufSize);
         ok(!memcmp(buf, intSequence, intSequence[1] + 2), "Unexpected value\n");
         LocalFree(buf);
     }
     /* Change the type of the first element in the sequence, and give it
      * another go
      */
     blobs[0].cbData = times[0].encodedTime[1] + 2;
     blobs[0].pbData = (BYTE *)times[0].encodedTime;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_SEQUENCE_OF_ANY, &seq,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(bufSize == sizeof(mixedSequence), "Wrong size %d\n", bufSize);
         ok(!memcmp(buf, mixedSequence, mixedSequence[1] + 2),
          "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 static void test_decodeSequenceOfAny(DWORD dwEncoding)
 {
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
 
     ret = pCryptDecodeObjectEx(dwEncoding, X509_SEQUENCE_OF_ANY, intSequence,
      intSequence[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CRYPT_SEQUENCE_OF_ANY *seq = (CRYPT_SEQUENCE_OF_ANY *)buf;
         DWORD i;
 
         ok(seq->cValue == sizeof(ints) / sizeof(ints[0]),
          "Wrong elements %d\n", seq->cValue);
         for (i = 0; i < min(seq->cValue, sizeof(ints) / sizeof(ints[0])); i++)
         {
             ok(seq->rgValue[i].cbData == ints[i].encoded[1] + 2,
              "Expected %d bytes, got %d\n", ints[i].encoded[1] + 2,
              seq->rgValue[i].cbData);
             ok(!memcmp(seq->rgValue[i].pbData, ints[i].encoded,
              ints[i].encoded[1] + 2), "Unexpected value\n");
         }
         LocalFree(buf);
     }
     ret = pCryptDecodeObjectEx(dwEncoding, X509_SEQUENCE_OF_ANY, mixedSequence,
      mixedSequence[1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL, &buf,
      &bufSize);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CRYPT_SEQUENCE_OF_ANY *seq = (CRYPT_SEQUENCE_OF_ANY *)buf;
 
         ok(seq->cValue == sizeof(ints) / sizeof(ints[0]),
          "Wrong elements %d\n", seq->cValue);
         /* Just check the first element since it's all that changed */
         ok(seq->rgValue[0].cbData == times[0].encodedTime[1] + 2,
          "Expected %d bytes, got %d\n", times[0].encodedTime[1] + 2,
          seq->rgValue[0].cbData);
         ok(!memcmp(seq->rgValue[0].pbData, times[0].encodedTime,
          times[0].encodedTime[1] + 2), "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 struct encodedExtensions
 {
     CERT_EXTENSIONS exts;
     const BYTE *encoded;
 };
 
 static BYTE crit_ext_data[] = { 0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
 static BYTE noncrit_ext_data[] = { 0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
 static CHAR oid_basic_constraints2[] = szOID_BASIC_CONSTRAINTS2;
 static CERT_EXTENSION criticalExt =
  { oid_basic_constraints2, TRUE, { 8, crit_ext_data } };
 static CERT_EXTENSION nonCriticalExt =
  { oid_basic_constraints2, FALSE, { 8, noncrit_ext_data } };
 static CHAR oid_short[] = "1.1";
 static CERT_EXTENSION extWithShortOid =
  { oid_short, FALSE, { 0, NULL } };
 
 static const BYTE ext0[] = { 0x30,0x00 };
 static const BYTE ext1[] = { 0x30,0x14,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,
                              0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
 static const BYTE ext2[] = { 0x30,0x11,0x30,0x0f,0x06,0x03,0x55,0x1d,0x13,0x04,
                              0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
 static const BYTE ext3[] = { 0x30,0x07,0x30,0x05,0x06,0x01,0x29,0x04,0x00 };
 
 static const struct encodedExtensions exts[] = {
  { { 0, NULL }, ext0 },
  { { 1, &criticalExt }, ext1 },
  { { 1, &nonCriticalExt }, ext2 },
  { { 1, &extWithShortOid }, ext3 }
 };
 
 static void test_encodeExtensions(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(exts) / sizeof(exts[i]); i++)
     {
         BOOL ret;
         BYTE *buf = NULL;
         DWORD bufSize = 0;
 
         ret = pCryptEncodeObjectEx(dwEncoding, X509_EXTENSIONS, &exts[i].exts,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(bufSize == exts[i].encoded[1] + 2,
              "Expected %d bytes, got %d\n", exts[i].encoded[1] + 2, bufSize);
             ok(!memcmp(buf, exts[i].encoded, exts[i].encoded[1] + 2),
              "Unexpected value\n");
             LocalFree(buf);
         }
     }
 }
 
 static void test_decodeExtensions(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(exts) / sizeof(exts[i]); i++)
     {
         BOOL ret;
         BYTE *buf = NULL;
         DWORD bufSize = 0;
 
         ret = pCryptDecodeObjectEx(dwEncoding, X509_EXTENSIONS,
          exts[i].encoded, exts[i].encoded[1] + 2, CRYPT_DECODE_ALLOC_FLAG,
          NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             CERT_EXTENSIONS *ext = (CERT_EXTENSIONS *)buf;
             DWORD j;
 
             ok(ext->cExtension == exts[i].exts.cExtension,
              "Expected %d extensions, see %d\n", exts[i].exts.cExtension,
              ext->cExtension);
             for (j = 0; j < min(ext->cExtension, exts[i].exts.cExtension); j++)
             {
                 ok(!strcmp(ext->rgExtension[j].pszObjId,
                  exts[i].exts.rgExtension[j].pszObjId),
                  "Expected OID %s, got %s\n",
                  exts[i].exts.rgExtension[j].pszObjId,
                  ext->rgExtension[j].pszObjId);
                 ok(!memcmp(ext->rgExtension[j].Value.pbData,
                  exts[i].exts.rgExtension[j].Value.pbData,
                  exts[i].exts.rgExtension[j].Value.cbData),
                  "Unexpected value\n");
             }
             LocalFree(buf);
         }
     }
 }
 
 /* MS encodes public key info with a NULL if the algorithm identifier's
  * parameters are empty.  However, when encoding an algorithm in a CERT_INFO,
  * it encodes them by omitting the algorithm parameters.  It accepts either
  * form for decoding.
  */
 struct encodedPublicKey
 {
     CERT_PUBLIC_KEY_INFO info;
     const BYTE *encoded;
     const BYTE *encodedNoNull;
     CERT_PUBLIC_KEY_INFO decoded;
 };
 
 static const BYTE aKey[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb, 0xc, 0xd,
  0xe, 0xf };
 static const BYTE params[] = { 0x02, 0x01, 0x01 };
 
 static const unsigned char bin64[] = {
     0x30,0x0b,0x30,0x06,0x06,0x02,0x2a,0x03,0x05,0x00,0x03,0x01,0x00};
 static const unsigned char bin65[] = {
     0x30,0x09,0x30,0x04,0x06,0x02,0x2a,0x03,0x03,0x01,0x00};
 static const unsigned char bin66[] = {
     0x30,0x0f,0x30,0x0a,0x06,0x06,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x05,0x00,0x03,0x01,0x00};
 static const unsigned char bin67[] = {
     0x30,0x0d,0x30,0x08,0x06,0x06,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x03,0x01,0x00};
 static const unsigned char bin68[] = {
     0x30,0x1f,0x30,0x0a,0x06,0x06,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x05,0x00,0x03,0x11,0x00,0x00,0x01,
     0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f};
 static const unsigned char bin69[] = {
     0x30,0x1d,0x30,0x08,0x06,0x06,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x03,0x11,0x00,0x00,0x01,
     0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f};
 static const unsigned char bin70[] = {
     0x30,0x20,0x30,0x0b,0x06,0x06,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x01,0x01,
     0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,
     0x0f};
 static const unsigned char bin71[] = {
     0x30,0x20,0x30,0x0b,0x06,0x06,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x02,0x01,0x01,
     0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,
     0x0f};
 static unsigned char bin72[] = { 0x05,0x00};
 
 static CHAR oid_bogus[] = "1.2.3",
             oid_rsa[]   = szOID_RSA;
 
 static const struct encodedPublicKey pubKeys[] = {
  /* with a bogus OID */
  { { { oid_bogus, { 0, NULL } }, { 0, NULL, 0 } },
   bin64, bin65,
   { { oid_bogus, { 2, bin72 } }, { 0, NULL, 0 } } },
  /* some normal keys */
  { { { oid_rsa, { 0, NULL } }, { 0, NULL, 0} },
   bin66, bin67,
   { { oid_rsa, { 2, bin72 } }, { 0, NULL, 0 } } },
  { { { oid_rsa, { 0, NULL } }, { sizeof(aKey), (BYTE *)aKey, 0} },
   bin68, bin69,
   { { oid_rsa, { 2, bin72 } }, { sizeof(aKey), (BYTE *)aKey, 0} } },
  /* with add'l parameters--note they must be DER-encoded */
  { { { oid_rsa, { sizeof(params), (BYTE *)params } }, { sizeof(aKey),
   (BYTE *)aKey, 0 } },
   bin70, bin71,
   { { oid_rsa, { sizeof(params), (BYTE *)params } }, { sizeof(aKey),
   (BYTE *)aKey, 0 } } },
 };
 
 static void test_encodePublicKeyInfo(DWORD dwEncoding)
 {
     DWORD i;
 
     for (i = 0; i < sizeof(pubKeys) / sizeof(pubKeys[0]); i++)
     {
         BOOL ret;
         BYTE *buf = NULL;
         DWORD bufSize = 0;
 
         ret = pCryptEncodeObjectEx(dwEncoding, X509_PUBLIC_KEY_INFO,
          &pubKeys[i].info, CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf,
          &bufSize);
         ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
          "CryptEncodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             ok(bufSize == pubKeys[i].encoded[1] + 2,
              "Expected %d bytes, got %d\n", pubKeys[i].encoded[1] + 2, bufSize);
             if (bufSize == pubKeys[i].encoded[1] + 2)
                 ok(!memcmp(buf, pubKeys[i].encoded, pubKeys[i].encoded[1] + 2),
                  "Unexpected value\n");
             LocalFree(buf);
         }
     }
 }
 
 static void comparePublicKeyInfo(const CERT_PUBLIC_KEY_INFO *expected,
  const CERT_PUBLIC_KEY_INFO *got)
 {
     ok(!strcmp(expected->Algorithm.pszObjId, got->Algorithm.pszObjId),
      "Expected OID %s, got %s\n", expected->Algorithm.pszObjId,
      got->Algorithm.pszObjId);
     ok(expected->Algorithm.Parameters.cbData ==
      got->Algorithm.Parameters.cbData,
      "Expected parameters of %d bytes, got %d\n",
      expected->Algorithm.Parameters.cbData, got->Algorithm.Parameters.cbData);
     if (expected->Algorithm.Parameters.cbData)
         ok(!memcmp(expected->Algorithm.Parameters.pbData,
          got->Algorithm.Parameters.pbData, got->Algorithm.Parameters.cbData),
          "Unexpected algorithm parameters\n");
     ok(expected->PublicKey.cbData == got->PublicKey.cbData,
      "Expected public key of %d bytes, got %d\n",
      expected->PublicKey.cbData, got->PublicKey.cbData);
     if (expected->PublicKey.cbData)
         ok(!memcmp(expected->PublicKey.pbData, got->PublicKey.pbData,
          got->PublicKey.cbData), "Unexpected public key value\n");
 }
 
 static void test_decodePublicKeyInfo(DWORD dwEncoding)
 {
     static const BYTE bogusPubKeyInfo[] = { 0x30, 0x22, 0x30, 0x0d, 0x06, 0x06,
      0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x01, 0x01, 0x03,
      0x11, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09,
      0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f };
     DWORD i;
     BOOL ret;
     BYTE *buf = NULL;
     DWORD bufSize = 0;
 
     for (i = 0; i < sizeof(pubKeys) / sizeof(pubKeys[0]); i++)
     {
         /* The NULL form decodes to the decoded member */
         ret = pCryptDecodeObjectEx(dwEncoding, X509_PUBLIC_KEY_INFO,
          pubKeys[i].encoded, pubKeys[i].encoded[1] + 2, CRYPT_DECODE_ALLOC_FLAG,
          NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             comparePublicKeyInfo(&pubKeys[i].decoded,
              (CERT_PUBLIC_KEY_INFO *)buf);
             LocalFree(buf);
         }
         /* The non-NULL form decodes to the original */
         ret = pCryptDecodeObjectEx(dwEncoding, X509_PUBLIC_KEY_INFO,
          pubKeys[i].encodedNoNull, pubKeys[i].encodedNoNull[1] + 2,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &bufSize);
         ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
         if (buf)
         {
             comparePublicKeyInfo(&pubKeys[i].info, (CERT_PUBLIC_KEY_INFO *)buf);
             LocalFree(buf);
         }
     }
     /* Test with bogus (not valid DER) parameters */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_PUBLIC_KEY_INFO,
      bogusPubKeyInfo, bogusPubKeyInfo[1] + 2, CRYPT_DECODE_ALLOC_FLAG,
      NULL, &buf, &bufSize);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_CORRUPT ||
      GetLastError() == OSS_DATA_ERROR /* Win9x */),
      "Expected CRYPT_E_ASN1_CORRUPT or OSS_DATA_ERROR, got %08x\n",
      GetLastError());
 }
 
 static const BYTE v1Cert[] = { 0x30, 0x33, 0x02, 0x00, 0x30, 0x02, 0x06, 0x00,
  0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30,
  0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30,
  0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x07, 0x30,
  0x02, 0x06, 0x00, 0x03, 0x01, 0x00 };
 static const BYTE v2Cert[] = { 0x30, 0x38, 0xa0, 0x03, 0x02, 0x01, 0x01, 0x02,
  0x00, 0x30, 0x02, 0x06, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31,
  0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f,
  0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30,
  0x30, 0x5a, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01, 0x00 };
 static const BYTE v3Cert[] = { 0x30, 0x38, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02,
  0x00, 0x30, 0x02, 0x06, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31,
  0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f,
  0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30,
  0x30, 0x5a, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01, 0x00 };
 static const BYTE v4Cert[] = {
 0x30,0x38,0xa0,0x03,0x02,0x01,0x03,0x02,0x00,0x30,0x02,0x06,0x00,0x30,0x22,
 0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,
 0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,
 0x30,0x30,0x30,0x5a,0x30,0x07,0x30,0x02,0x06,0x00,0x03,0x01,0x00 };
 static const BYTE v1CertWithConstraints[] = { 0x30, 0x4b, 0x02, 0x00, 0x30,
  0x02, 0x06, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31,
  0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36,
  0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a,
  0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14,
  0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30,
  0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 static const BYTE v1CertWithSerial[] = { 0x30, 0x4c, 0x02, 0x01, 0x01, 0x30,
  0x02, 0x06, 0x00, 0x30, 0x22, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31,
  0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36,
  0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a,
  0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01, 0x00, 0xa3, 0x16, 0x30, 0x14,
  0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30,
  0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 static const BYTE bigCert[] = { 0x30, 0x7a, 0x02, 0x01, 0x01, 0x30, 0x02, 0x06,
  0x00, 0x30, 0x15, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
  0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20, 0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x22,
  0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30, 0x31, 0x30, 0x30, 0x30,
  0x30, 0x30, 0x30, 0x5a, 0x18, 0x0f, 0x31, 0x36, 0x30, 0x31, 0x30, 0x31, 0x30,
  0x31, 0x30, 0x30, 0x30, 0x30, 0x30, 0x30, 0x5a, 0x30, 0x15, 0x31, 0x13, 0x30,
  0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a, 0x4a, 0x75, 0x61, 0x6e, 0x20,
  0x4c, 0x61, 0x6e, 0x67, 0x00, 0x30, 0x07, 0x30, 0x02, 0x06, 0x00, 0x03, 0x01,
  0x00, 0xa3, 0x16, 0x30, 0x14, 0x30, 0x12, 0x06, 0x03, 0x55, 0x1d, 0x13, 0x01,
  0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01, 0x01, 0xff, 0x02, 0x01, 0x01 };
 static const BYTE v1CertWithPubKey[] = {
 0x30,0x81,0x95,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 0x67,0x00,0x30,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 0x01,0x01,0x05,0x00,0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
 0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,
 0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,
 0x01,0x01 };
 static const BYTE v1CertWithPubKeyNoNull[] = {
 0x30,0x81,0x93,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 0x67,0x00,0x30,0x20,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 0x01,0x01,0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
 0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0xa3,0x16,0x30,0x14,0x30,0x12,0x06,0x03,0x55,
 0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,0xff,0x02,0x01,0x01 };
 static const BYTE v1CertWithSubjectKeyId[] = {
 0x30,0x7b,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,0x11,
 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,
 0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,
 0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,0x06,
 0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,0x67,
 0x00,0x30,0x07,0x30,0x02,0x06,0x00,0x03,0x01,0x00,0xa3,0x17,0x30,0x15,0x30,
 0x13,0x06,0x03,0x55,0x1d,0x0e,0x04,0x0c,0x04,0x0a,0x4a,0x75,0x61,0x6e,0x20,
 0x4c,0x61,0x6e,0x67,0x00 };
 static const BYTE v1CertWithIssuerUniqueId[] = {
 0x30,0x38,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,
 0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,
 0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,
 0x30,0x07,0x30,0x02,0x06,0x00,0x03,0x01,0x00,0x81,0x02,0x00,0x01 };
 static const BYTE v1CertWithSubjectIssuerSerialAndIssuerUniqueId[] = {
 0x30,0x81,0x99,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 0x67,0x00,0x30,0x22,0x30,0x0d,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 0x01,0x01,0x05,0x00,0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,
 0x08,0x09,0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0x81,0x02,0x00,0x01,0xa3,0x16,0x30,
 0x14,0x30,0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,
 0x01,0x01,0xff,0x02,0x01,0x01 };
 static const BYTE v1CertWithSubjectIssuerSerialAndIssuerUniqueIdNoNull[] = {
 0x30,0x81,0x97,0x02,0x01,0x01,0x30,0x02,0x06,0x00,0x30,0x15,0x31,0x13,0x30,
 0x11,0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,
 0x6e,0x67,0x00,0x30,0x22,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,0x30,0x31,
 0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x18,0x0f,0x31,0x36,0x30,0x31,0x30,0x31,
 0x30,0x31,0x30,0x30,0x30,0x30,0x30,0x30,0x5a,0x30,0x15,0x31,0x13,0x30,0x11,
 0x06,0x03,0x55,0x04,0x03,0x13,0x0a,0x4a,0x75,0x61,0x6e,0x20,0x4c,0x61,0x6e,
 0x67,0x00,0x30,0x20,0x30,0x0b,0x06,0x09,0x2a,0x86,0x48,0x86,0xf7,0x0d,0x01,
 0x01,0x01,0x03,0x11,0x00,0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,
 0x0a,0x0b,0x0c,0x0d,0x0e,0x0f,0x81,0x02,0x00,0x01,0xa3,0x16,0x30,0x14,0x30,
 0x12,0x06,0x03,0x55,0x1d,0x13,0x01,0x01,0xff,0x04,0x08,0x30,0x06,0x01,0x01,
 0xff,0x02,0x01,0x01 };
 
 static const BYTE serialNum[] = { 0x01 };
 
 static void test_encodeCertToBeSigned(DWORD dwEncoding)
 {
     BOOL ret;
     BYTE *buf = NULL;
     DWORD size = 0;
     CERT_INFO info = { 0 };
     static char oid_rsa_rsa[] = szOID_RSA_RSA;
     static char oid_subject_key_identifier[] = szOID_SUBJECT_KEY_IDENTIFIER;
     CERT_EXTENSION ext;
 
     if (0)
     {
         /* Test with NULL pvStructInfo (crashes on win9x) */
         ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, NULL,
          CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* Test with a V1 cert */
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == v1Cert[1] + 2, "Expected size %d, got %d\n",
          v1Cert[1] + 2, size);
         ok(!memcmp(buf, v1Cert, size), "Got unexpected value\n");
         LocalFree(buf);
     }
     /* Test v2 cert */
     info.dwVersion = CERT_V2;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(v2Cert), "Wrong size %d\n", size);
         ok(!memcmp(buf, v2Cert, size), "Got unexpected value\n");
         LocalFree(buf);
     }
     /* Test v3 cert */
     info.dwVersion = CERT_V3;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(v3Cert), "Wrong size %d\n", size);
         ok(!memcmp(buf, v3Cert, size), "Got unexpected value\n");
         LocalFree(buf);
     }
     /* A v4 cert? */
     info.dwVersion = 3; /* Not a typo, CERT_V3 is 2 */
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(v4Cert), "Wrong size %d\n", size);
         ok(!memcmp(buf, v4Cert, size), "Unexpected value\n");
         LocalFree(buf);
     }
     /* see if a V1 cert can have basic constraints set (RFC3280 says no, but
      * API doesn't prevent it)
      */
     info.dwVersion = CERT_V1;
     info.cExtension = 1;
     info.rgExtension = &criticalExt;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret || GetLastError() == OSS_BAD_PTR /* Win9x */,
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(v1CertWithConstraints), "Wrong size %d\n", size);
         ok(!memcmp(buf, v1CertWithConstraints, size), "Got unexpected value\n");
         LocalFree(buf);
     }
     /* test v1 cert with a serial number */
     info.SerialNumber.cbData = sizeof(serialNum);
     info.SerialNumber.pbData = (BYTE *)serialNum;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(v1CertWithSerial), "Wrong size %d\n", size);
         ok(!memcmp(buf, v1CertWithSerial, size), "Got unexpected value\n");
         LocalFree(buf);
     }
     /* Test v1 cert with an issuer name, serial number, and issuer unique id */
     info.dwVersion = CERT_V1;
     info.cExtension = 0;
     info.IssuerUniqueId.cbData = sizeof(serialNum);
     info.IssuerUniqueId.pbData = (BYTE *)serialNum;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret || broken(GetLastError() == OSS_BAD_PTR /* Win98 */),
      "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(v1CertWithIssuerUniqueId), "Wrong size %d\n", size);
         ok(!memcmp(buf, v1CertWithIssuerUniqueId, size),
          "Got unexpected value\n");
         LocalFree(buf);
     }
     /* Test v1 cert with an issuer name, a subject name, and a serial number */
     info.IssuerUniqueId.cbData = 0;
     info.IssuerUniqueId.pbData = NULL;
     info.cExtension = 1;
     info.rgExtension = &criticalExt;
     info.Issuer.cbData = sizeof(encodedCommonName);
     info.Issuer.pbData = (BYTE *)encodedCommonName;
     info.Subject.cbData = sizeof(encodedCommonName);
     info.Subject.pbData = (BYTE *)encodedCommonName;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(bigCert), "Wrong size %d\n", size);
         ok(!memcmp(buf, bigCert, size), "Got unexpected value\n");
         LocalFree(buf);
     }
     /* Add a public key */
     info.SubjectPublicKeyInfo.Algorithm.pszObjId = oid_rsa_rsa;
     info.SubjectPublicKeyInfo.PublicKey.cbData = sizeof(aKey);
     info.SubjectPublicKeyInfo.PublicKey.pbData = (LPBYTE)aKey;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(v1CertWithPubKey) ||
          size == sizeof(v1CertWithPubKeyNoNull), "Wrong size %d\n", size);
         if (size == sizeof(v1CertWithPubKey))
             ok(!memcmp(buf, v1CertWithPubKey, size), "Got unexpected value\n");
         else if (size == sizeof(v1CertWithPubKeyNoNull))
             ok(!memcmp(buf, v1CertWithPubKeyNoNull, size),
              "Got unexpected value\n");
         LocalFree(buf);
     }
     /* Again add an issuer unique id */
     info.IssuerUniqueId.cbData = sizeof(serialNum);
     info.IssuerUniqueId.pbData = (BYTE *)serialNum;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptEncodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         ok(size == sizeof(v1CertWithSubjectIssuerSerialAndIssuerUniqueId) ||
          size == sizeof(v1CertWithSubjectIssuerSerialAndIssuerUniqueIdNoNull),
          "Wrong size %d\n", size);
         if (size == sizeof(v1CertWithSubjectIssuerSerialAndIssuerUniqueId))
             ok(!memcmp(buf, v1CertWithSubjectIssuerSerialAndIssuerUniqueId,
              size), "unexpected value\n");
         else if (size ==
          sizeof(v1CertWithSubjectIssuerSerialAndIssuerUniqueIdNoNull))
             ok(!memcmp(buf,
              v1CertWithSubjectIssuerSerialAndIssuerUniqueIdNoNull, size),
              "unexpected value\n");
         LocalFree(buf);
     }
     /* Remove the public key, and add a subject key identifier extension */
     info.IssuerUniqueId.cbData = 0;
     info.IssuerUniqueId.pbData = NULL;
     info.SubjectPublicKeyInfo.Algorithm.pszObjId = NULL;
     info.SubjectPublicKeyInfo.PublicKey.cbData = 0;
     info.SubjectPublicKeyInfo.PublicKey.pbData = NULL;
     ext.pszObjId = oid_subject_key_identifier;
     ext.fCritical = FALSE;
     ext.Value.cbData = sizeof(octetCommonNameValue);
     ext.Value.pbData = octetCommonNameValue;
     info.cExtension = 1;
     info.rgExtension = &ext;
     ret = pCryptEncodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, &info,
      CRYPT_ENCODE_ALLOC_FLAG, NULL, &buf, &size);
     if (buf)
     {
         ok(size == sizeof(v1CertWithSubjectKeyId), "Wrong size %d\n", size);
         ok(!memcmp(buf, v1CertWithSubjectKeyId, size), "Unexpected value\n");
         LocalFree(buf);
     }
 }
 
 static void test_decodeCertToBeSigned(DWORD dwEncoding)
 {
     static const BYTE *corruptCerts[] = { v1Cert, v2Cert, v3Cert, v4Cert,
      v1CertWithConstraints, v1CertWithSerial, v1CertWithIssuerUniqueId };
     BOOL ret;
     BYTE *buf = NULL;
     DWORD size = 0, i;
 
     /* Test with NULL pbEncoded */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, NULL, 0,
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(!ret && (GetLastError() == CRYPT_E_ASN1_EOD ||
      GetLastError() == OSS_BAD_ARG /* Win9x */),
      "Expected CRYPT_E_ASN1_EOD or OSS_BAD_ARG, got %08x\n", GetLastError());
     if (0)
     {
         /* Crashes on win9x */
         ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, NULL, 1,
          CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &size);
         ok(!ret && GetLastError() == STATUS_ACCESS_VIOLATION,
          "Expected STATUS_ACCESS_VIOLATION, got %08x\n", GetLastError());
     }
     /* The following certs all fail with CRYPT_E_ASN1_CORRUPT or
      * CRYPT_E_ASN1_BADTAG, because at a minimum a cert must have a non-zero
      * serial number, an issuer, a subject, and a public key.
      */
     for (i = 0; i < sizeof(corruptCerts) / sizeof(corruptCerts[0]); i++)
     {
         ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED,
          corruptCerts[i], corruptCerts[i][1] + 2, CRYPT_DECODE_ALLOC_FLAG, NULL,
          &buf, &size);
         ok(!ret, "Expected failure\n");
     }
     /* The following succeeds, even though v1 certs are not allowed to have
      * extensions.
      */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED,
      v1CertWithSubjectKeyId, sizeof(v1CertWithSubjectKeyId),
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (ret)
     {
         CERT_INFO *info = (CERT_INFO *)buf;
 
         ok(size >= sizeof(CERT_INFO), "Wrong size %d\n", size);
         ok(info->dwVersion == CERT_V1, "expected CERT_V1, got %d\n",
          info->dwVersion);
         ok(info->cExtension == 1, "expected 1 extension, got %d\n",
          info->cExtension);
         LocalFree(buf);
     }
     /* The following also succeeds, even though V1 certs are not allowed to
      * have issuer unique ids.
      */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED,
      v1CertWithSubjectIssuerSerialAndIssuerUniqueId,
      sizeof(v1CertWithSubjectIssuerSerialAndIssuerUniqueId),
      CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (ret)
     {
         CERT_INFO *info = (CERT_INFO *)buf;
 
         ok(size >= sizeof(CERT_INFO), "Wrong size %d\n", size);
         ok(info->dwVersion == CERT_V1, "expected CERT_V1, got %d\n",
          info->dwVersion);
         ok(info->IssuerUniqueId.cbData == sizeof(serialNum),
          "unexpected issuer unique id size %d\n", info->IssuerUniqueId.cbData);
         ok(!memcmp(info->IssuerUniqueId.pbData, serialNum, sizeof(serialNum)),
          "unexpected issuer unique id value\n");
         LocalFree(buf);
     }
     /* Now check with serial number, subject and issuer specified */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED, bigCert,
      sizeof(bigCert), CRYPT_DECODE_ALLOC_FLAG, NULL, &buf, &size);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_INFO *info = (CERT_INFO *)buf;
 
         ok(size >= sizeof(CERT_INFO), "Wrong size %d\n", size);
         ok(info->SerialNumber.cbData == 1,
          "Expected serial number size 1, got %d\n", info->SerialNumber.cbData);
         ok(*info->SerialNumber.pbData == *serialNum,
          "Expected serial number %d, got %d\n", *serialNum,
          *info->SerialNumber.pbData);
         ok(info->Issuer.cbData == sizeof(encodedCommonName),
          "Wrong size %d\n", info->Issuer.cbData);
         ok(!memcmp(info->Issuer.pbData, encodedCommonName, info->Issuer.cbData),
          "Unexpected issuer\n");
         ok(info->Subject.cbData == sizeof(encodedCommonName),
          "Wrong size %d\n", info->Subject.cbData);
         ok(!memcmp(info->Subject.pbData, encodedCommonName,
          info->Subject.cbData), "Unexpected subject\n");
         LocalFree(buf);
     }
     /* Check again with pub key specified */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_CERT_TO_BE_SIGNED,
      v1CertWithPubKey, sizeof(v1CertWithPubKey), CRYPT_DECODE_ALLOC_FLAG, NULL,
      &buf, &size);
     ok(ret, "CryptDecodeObjectEx failed: %08x\n", GetLastError());
     if (buf)
     {
         CERT_INFO *info = (CERT_INFO *)buf;
 
         ok(size >= sizeof(CERT_INFO), "Wrong size %d\n", size);
         ok(info->SerialNumber.cbData == 1,
          "Expected serial number size 1, got %d\n", info->SerialNumber.cbData);
         ok(*info->SerialNumber.pbData == *serialNum,
          "Expected serial number %d, got %d\n", *serialNum,
          *info->SerialNumber.pbData);
         ok(info->Issuer.cbData == sizeof(encodedCommonName),
          "Wrong size %d\n", info->Issuer.cbData);
         ok(!memcmp(info->Issuer.pbData, encodedCommonName, info->Issuer.cbData),
          "Unexpected issuer\n");
         ok(info->Subject.cbData == sizeof(encodedCommonName),
          "Wrong size %d\n", info->Subject.cbData);
         ok(!memcmp(info->Subject.pbData, encodedCommonName,
          info->Subject.cbData), "Unexpected subject\n");
         ok(!strcmp(info->SubjectPublicKeyInfo.Algorithm.pszObjId,
          szOID_RSA_RSA), "Expected szOID_RSA_RSA, got %s\n",
          info->SubjectPublicKeyInfo.Algorithm.pszObjId);
         ok(info->SubjectPublicKeyInfo.PublicKey.cbData == sizeof(aKey),
          "Wrong size %d\n", info->SubjectPublicKeyInfo.PublicKey.cbData);
         ok(!memcmp(info->SubjectPublicKeyInfo.PublicKey.pbData, aKey,
          sizeof(aKey)), "Unexpected public key\n");
         LocalFree(