diff --git a/modules/rostests/winetests/rsaenh/rsaenh.c b/modules/rostests/winetests/rsaenh/rsaenh.c
index bc8e798cdd7..3e782be279c 100644
--- a/modules/rostests/winetests/rsaenh/rsaenh.c
+++ b/modules/rostests/winetests/rsaenh/rsaenh.c
@@ -1815,7 +1815,7 @@ static void test_hmac(void) {
         0xcf, 0x10, 0x6b, 0xb6, 0x7d, 0x0f, 0x13, 0x32 };
     int i;
 
-    for (i=0; i<sizeof(abData)/sizeof(BYTE); i++) abData[i] = (BYTE)i;
+    for (i=0; i < ARRAY_SIZE(abData); i++) abData[i] = (BYTE)i;
 
     if (!derive_key(CALG_RC2, &hKey, 56)) return;
 
@@ -1829,7 +1829,7 @@ static void test_hmac(void) {
     result = CryptHashData(hHash, abData, sizeof(abData), 0);
     ok(result, "%08x\n", GetLastError());
 
-    dwLen = sizeof(abData)/sizeof(BYTE);
+    dwLen = ARRAY_SIZE(abData);
     result = CryptGetHashParam(hHash, HP_HASHVAL, abData, &dwLen, 0);
     ok(result, "%08x\n", GetLastError());
 
@@ -1855,8 +1855,8 @@ static void test_mac(void) {
     static const BYTE mac_40[8] = { 0xb7, 0xa2, 0x46, 0xe9, 0x11, 0x31, 0xe0, 0xad};
     int i;
 
-    for (i=0; i<sizeof(abData)/sizeof(BYTE); i++) abData[i] = (BYTE)i;
-    for (i=0; i<sizeof(abData)/sizeof(BYTE); i++) abEnc[i] = (BYTE)i;
+    for (i=0; i < ARRAY_SIZE(abData); i++) abData[i] = (BYTE)i;
+    for (i=0; i < ARRAY_SIZE(abData); i++) abEnc[i] = (BYTE)i;
 
     if (!derive_key(CALG_RC2, &hKey, 40)) return;
 
@@ -1871,7 +1871,7 @@ static void test_mac(void) {
     result = CryptHashData(hHash, abData, sizeof(abData), 0);
     ok(result, "%08x\n", GetLastError());
 
-    dwLen = sizeof(abData)/sizeof(BYTE);
+    dwLen = ARRAY_SIZE(abData);
     result = CryptGetHashParam(hHash, HP_HASHVAL, abData, &dwLen, 0);
     ok(result && dwLen == 8, "%08x, dwLen: %d\n", GetLastError(), dwLen);
 
@@ -2282,6 +2282,7 @@ static void test_rsa_encrypt(void)
     BYTE abData[2048] = "Wine rocks!";
     BOOL result;
     DWORD dwVal, dwLen;
+    DWORD err;
 
     /* It is allowed to use the key exchange key for encryption/decryption */
     result = CryptGetUserKey(hProv, AT_KEYEXCHANGE, &hRSAKey);
@@ -2297,6 +2298,7 @@ static void test_rsa_encrypt(void)
     }
     ok(result, "CryptEncrypt failed: %08x\n", GetLastError());
     ok(dwLen == 128, "Unexpected length %d\n", dwLen);
+    /* PKCS1 V1.5 */
     dwLen = 12;
     result = CryptEncrypt(hRSAKey, 0, TRUE, 0, abData, &dwLen, (DWORD)sizeof(abData));
     ok (result, "%08x\n", GetLastError());
@@ -2304,7 +2306,52 @@ static void test_rsa_encrypt(void)
 
     result = CryptDecrypt(hRSAKey, 0, TRUE, 0, abData, &dwLen);
     ok (result && dwLen == 12 && !memcmp(abData, "Wine rocks!", 12), "%08x\n", GetLastError());
-    
+
+    /* OAEP, RFC 8017 PKCS #1 V2.2 */
+    /* Test minimal buffer length requirement */
+    dwLen = 1;
+    SetLastError(0xdeadbeef);
+    result = CryptEncrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen, 20 * 2 + 2);
+    err = GetLastError();
+    ok(!result && err == ERROR_MORE_DATA, "%08x\n", err);
+
+    /* Test data length limit */
+    dwLen = sizeof(abData) - (20 * 2 + 2) + 1;
+    result = CryptEncrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen, (DWORD)sizeof(abData));
+    err = GetLastError();
+    ok(!result && err == NTE_BAD_LEN, "%08x\n", err);
+
+    /* Test malformed data */
+    dwLen = 12;
+    SetLastError(0xdeadbeef);
+    memcpy(abData, "Wine rocks!", dwLen);
+    result = CryptDecrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen);
+    err = GetLastError();
+    /* NTE_DOUBLE_ENCRYPT on xp or 2003 */
+    ok(!result && (err == NTE_BAD_DATA || broken(err == NTE_DOUBLE_ENCRYPT)), "%08x\n", err);
+
+    /* Test decrypt with insufficient buffer */
+    dwLen = 12;
+    SetLastError(0xdeadbeef);
+    memcpy(abData, "Wine rocks!", 12);
+    result = CryptEncrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen, (DWORD)sizeof(abData));
+    ok(result, "%08x\n", GetLastError());
+    dwLen = 11;
+    SetLastError(0xdeadbeef);
+    result = CryptDecrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen);
+    err = GetLastError();
+    /* broken on xp or 2003 */
+    ok((!result && dwLen == 11 && err == NTE_BAD_DATA) || broken(result == TRUE && dwLen == 12 && err == ERROR_NO_TOKEN),
+       "%08x %d %08x\n", result, dwLen, err);
+
+    /* Test normal encryption and decryption */
+    dwLen = 12;
+    memcpy(abData, "Wine rocks!", dwLen);
+    result = CryptEncrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen, (DWORD)sizeof(abData));
+    ok(result, "%08x\n", GetLastError());
+    result = CryptDecrypt(hRSAKey, 0, TRUE, CRYPT_OAEP, abData, &dwLen);
+    ok(result && dwLen == 12 && !memcmp(abData, "Wine rocks!", 12), "%08x\n", GetLastError());
+
     dwVal = 0xdeadbeef;
     dwLen = sizeof(DWORD);
     result = CryptGetKeyParam(hRSAKey, KP_PERMISSIONS, (BYTE*)&dwVal, &dwLen, 0);
@@ -2725,7 +2772,7 @@ static void test_import_hmac(void)
     };
     DWORD i;
 
-    for (i = 0; i < sizeof(cases) / sizeof(cases[0]); i++)
+    for (i = 0; i < ARRAY_SIZE(cases); i++)
     {
         const struct rfc2202_test_case *test_case = &cases[i];
         DWORD size = sizeof(BLOBHEADER) + sizeof(DWORD) + test_case->key_len;
@@ -3822,13 +3869,13 @@ static void test_key_derivation(const char *prov)
         },
     };
     /* Due to differences between encryption from <= 2000 and >= XP some tests need to be skipped */
-    int old_broken[sizeof(tests)/sizeof(tests[0])];
+    int old_broken[ARRAY_SIZE(tests)];
     memset(old_broken, 0, sizeof(old_broken));
     old_broken[3] = old_broken[4] = old_broken[15] = old_broken[16] = 1;
     old_broken[27] = old_broken[28] = old_broken[39] = old_broken[40] = 1;
     uniquecontainer(NULL);
 
-    for (i=0; i<sizeof(tests)/sizeof(tests[0]); i++)
+    for (i=0; i < ARRAY_SIZE(tests); i++)
     {
         if (win2k && old_broken[i]) continue;
 
@@ -3886,7 +3933,7 @@ err:
 
 START_TEST(rsaenh)
 {
-    for (iProv = 0; iProv < sizeof(szProviders) / sizeof(szProviders[0]); iProv++)
+    for (iProv = 0; iProv < ARRAY_SIZE(szProviders); iProv++)
     {
         if (!init_base_environment(szProviders[iProv], 0))
             continue;