--- a/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
+++ b/security/pkix/test/gtest/pkixocsp_VerifyEncodedOCSPResponse.cpp
@@ -817,20 +817,21 @@ TEST_F(pkixocsp_VerifyEncodedResponse_De
 // The CA that issued the OCSP responder cert is a sub-CA of the issuer of
 // the certificate that the OCSP response is for. That sub-CA cert is included
 // in the OCSP response before the OCSP responder cert.
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
        good_indirect_subca_1_first)
 {
   static const char* subCAName = "good_indirect_subca_1_first sub-CA";
   static const char* signerName = "good_indirect_subca_1_first OCSP signer";
+  static const long zero = 0;
 
   // sub-CA of root (root is the direct issuer of endEntity)
   const ByteString subCAExtensions[] = {
-    CreateEncodedBasicConstraints(true, 0, Critical::No),
+    CreateEncodedBasicConstraints(true, &zero, Critical::No),
     ByteString()
   };
   ScopedTestKeyPair subCAKeyPair(GenerateKeyPair());
   ByteString subCADER(CreateEncodedCertificate(
                         ++rootIssuedCount, sha256WithRSAEncryption(), rootName,
                         oneDayBeforeNow, oneDayAfterNow, subCAName,
                         *subCAKeyPair, subCAExtensions, *rootKeyPair));
   ASSERT_FALSE(ENCODING_FAILED(subCADER));
@@ -870,20 +871,21 @@ TEST_F(pkixocsp_VerifyEncodedResponse_De
 // The CA that issued the OCSP responder cert is a sub-CA of the issuer of
 // the certificate that the OCSP response is for. That sub-CA cert is included
 // in the OCSP response after the OCSP responder cert.
 TEST_F(pkixocsp_VerifyEncodedResponse_DelegatedResponder,
        good_indirect_subca_1_second)
 {
   static const char* subCAName = "good_indirect_subca_1_second sub-CA";
   static const char* signerName = "good_indirect_subca_1_second OCSP signer";
+  static const long zero = 0;
 
   // sub-CA of root (root is the direct issuer of endEntity)
   const ByteString subCAExtensions[] = {
-    CreateEncodedBasicConstraints(true, 0, Critical::No),
+    CreateEncodedBasicConstraints(true, &zero, Critical::No),
     ByteString()
   };
   ScopedTestKeyPair subCAKeyPair(GenerateKeyPair());
   ByteString subCADER(CreateEncodedCertificate(++rootIssuedCount,
                                                sha256WithRSAEncryption(),
                                                rootName,
                                                oneDayBeforeNow, oneDayAfterNow,
                                                subCAName, *subCAKeyPair,