diff --git a/src/x509.c b/src/x509.c
index 399515e89..575efc82f 100644
--- a/src/x509.c
+++ b/src/x509.c
@@ -12375,7 +12375,14 @@ WOLFSSL_X509_CRL* wolfSSL_PEM_read_X509_CRL(XFILE fp,
             return WOLFSSL_FAILURE;
         }
 
-        if ((l = wolfSSL_BIO_get_len(bio)) <= pem_struct_min_sz) {
+        l = wolfSSL_BIO_get_len(bio);
+
+        if (l < 0) {
+            WOLFSSL_ERROR(BAD_FUNC_ARG);
+            return WOLFSSL_FAILURE;
+        }
+
+        if (l <= pem_struct_min_sz) {
             /* No certificate in buffer */
             WOLFSSL_ERROR(ASN_NO_PEM_HEADER);
             return WOLFSSL_FAILURE;
diff --git a/wolfcrypt/src/sp_int.c b/wolfcrypt/src/sp_int.c
index 17865c5b2..50f71f6c1 100644
--- a/wolfcrypt/src/sp_int.c
+++ b/wolfcrypt/src/sp_int.c
@@ -18272,7 +18272,7 @@ int sp_to_unsigned_bin_len_ct(const sp_int* a, byte* out, int outSz)
                 out[j--] = (byte)(d & mask);
                 d >>= 8;
             }
-            mask &= (sp_int_digit)0 - notFull;
+            mask &= (sp_int_digit)(-(int)notFull);
             i += (unsigned int)(1 & mask);
         }
     }