diff --git a/libwvdrmengine/oemcrypto/test/oemcrypto_test.cpp b/libwvdrmengine/oemcrypto/test/oemcrypto_test.cpp
index 93f3c07e..2945a55c 100644
--- a/libwvdrmengine/oemcrypto/test/oemcrypto_test.cpp
+++ b/libwvdrmengine/oemcrypto/test/oemcrypto_test.cpp
@@ -5,18 +5,6 @@
 #include <arpa/inet.h>  // needed for ntoh()
 #include <ctype.h>
 #include <getopt.h>
-#include <stdint.h>
-#include <sys/types.h>
-#include <sys/time.h>
-#include <time.h>
-#include <algorithm>
-#include <iostream>
-#include <map>
-#include <string>
-#include <utility>
-#include <vector>
-
-#include <gtest/gtest.h>
 #include <openssl/aes.h>
 #include <openssl/err.h>
 #include <openssl/hmac.h>
@@ -24,6 +12,18 @@
 #include <openssl/rsa.h>
 #include <openssl/sha.h>
 #include <openssl/x509.h>
+#include <stdint.h>
+#include <sys/time.h>
+#include <sys/types.h>
+#include <time.h>
+
+#include <algorithm>
+#include <gtest/gtest.h>
+#include <iostream>
+#include <map>
+#include <string>
+#include <utility>
+#include <vector>
 
 #include "log.h"
 #include "oemcrypto_key_mock.h"
@@ -45,7 +45,7 @@ namespace std {
 void PrintTo(const vector<uint8_t>& value, std::ostream* os) {
   *os << wvcdm::b2a_hex(value);
 }
-} // namespace std
+}  // namespace std
 
 namespace wvoec {
 namespace {
@@ -60,7 +60,7 @@ const int kShortSleep = 1 * kSpeedMultiplier;
 const int kLongSleep = 2 * kSpeedMultiplier;
 const uint32_t kDuration = 2 * kSpeedMultiplier;
 const uint32_t kLongDuration = 5 * kSpeedMultiplier;
-const int32_t kAlmostRange = 3 * kSpeedMultiplier;
+const int32_t kTimeTolerance = 3 * kSpeedMultiplier;
 }  // namespace
 
 typedef struct {
@@ -361,7 +361,8 @@ static const uint8_t kTestRSAPKCS8PrivateKeyInfo2_2048[] = {
 
 DeviceFeatures global_features;
 
-void DeviceFeatures::Initialize(bool is_cast_receiver, bool force_load_test_keybox) {
+void DeviceFeatures::Initialize(bool is_cast_receiver,
+                                bool force_load_test_keybox) {
   cast_receiver = is_cast_receiver;
   uses_keybox = false;
   uses_certificate = false;
@@ -380,16 +381,14 @@ void DeviceFeatures::Initialize(bool is_cast_receiver, bool force_load_test_keyb
   uses_keybox =
       (OEMCrypto_ERROR_NOT_IMPLEMENTED != OEMCrypto_GetKeyData(buffer, &size));
   printf("uses_keybox = %s.\n", uses_keybox ? "true" : "false");
-  loads_certificate = uses_keybox &&
-      (OEMCrypto_ERROR_NOT_IMPLEMENTED !=
-       OEMCrypto_RewrapDeviceRSAKey(0, buffer, 0, buffer, 0, &nonce,
-                                    buffer, 0, buffer,
-                                    buffer, &size));
+  loads_certificate = uses_keybox && (OEMCrypto_ERROR_NOT_IMPLEMENTED !=
+                                      OEMCrypto_RewrapDeviceRSAKey(
+                                          0, buffer, 0, buffer, 0, &nonce,
+                                          buffer, 0, buffer, buffer, &size));
   printf("loads_certificate = %s.\n", loads_certificate ? "true" : "false");
-  uses_certificate =
-      (OEMCrypto_ERROR_NOT_IMPLEMENTED
-       != OEMCrypto_GenerateRSASignature(0, buffer, 0, buffer, &size,
-                                         kSign_RSASSA_PSS));
+  uses_certificate = (OEMCrypto_ERROR_NOT_IMPLEMENTED !=
+                      OEMCrypto_GenerateRSASignature(0, buffer, 0, buffer,
+                                                     &size, kSign_RSASSA_PSS));
   printf("uses_certificate = %s.\n", uses_certificate ? "true" : "false");
   generic_crypto =
       (OEMCrypto_ERROR_NOT_IMPLEMENTED !=
@@ -406,7 +405,7 @@ void DeviceFeatures::Initialize(bool is_cast_receiver, bool force_load_test_keyb
     PickDerivedKey();
   }
   printf("cast_receiver = %s.\n", cast_receiver ? "true" : "false");
-  switch(derive_key_method) {
+  switch (derive_key_method) {
     case NO_METHOD:
       printf("NO_METHOD: Cannot derive known session keys.\n");
       // Note: cast_receiver left unchanged because set by user on command line.
@@ -455,12 +454,12 @@ std::string DeviceFeatures::RestrictFilter(const std::string& initial_filter) {
 void DeviceFeatures::PickDerivedKey() {
   if (uses_keybox) {
     // If device uses a keybox, try to load the test keybox.
-    if(OEMCrypto_ERROR_NOT_IMPLEMENTED != OEMCrypto_LoadTestKeybox()) {
+    if (OEMCrypto_ERROR_NOT_IMPLEMENTED != OEMCrypto_LoadTestKeybox()) {
       derive_key_method = LOAD_TEST_KEYBOX;
-    } else if(IsTestKeyboxInstalled()) {
+    } else if (IsTestKeyboxInstalled()) {
       derive_key_method = EXISTING_TEST_KEYBOX;
     }
-  } else if(OEMCrypto_ERROR_NOT_IMPLEMENTED != OEMCrypto_LoadTestRSAKey()) {
+  } else if (OEMCrypto_ERROR_NOT_IMPLEMENTED != OEMCrypto_LoadTestRSAKey()) {
     derive_key_method = LOAD_TEST_RSA_KEY;
   }
 }
@@ -478,10 +477,9 @@ bool DeviceFeatures::IsTestKeyboxInstalled() {
     return false;
   // We use strncmp instead of memcmp because we don't really care about the
   // multiple '\0' characters at the end of the device id.
-  return 0 ==
-      strncmp(reinterpret_cast<const char*>(dev_id),
-              reinterpret_cast<const char*>(kTestKeybox.device_id_),
-              sizeof(kTestKeybox.device_id_));
+  return 0 == strncmp(reinterpret_cast<const char*>(dev_id),
+                      reinterpret_cast<const char*>(kTestKeybox.device_id_),
+                      sizeof(kTestKeybox.device_id_));
 }
 
 void DeviceFeatures::FilterOut(std::string* current_filter,
@@ -501,11 +499,6 @@ static void dump_openssl_error() {
   }
 }
 
-// We don't expect exact timing.
-#define EXPECT_ALMOST(A, B)       \
-  EXPECT_GE(A + kAlmostRange, B); \
-  EXPECT_LE(A - kAlmostRange, B);
-
 class Session {
  public:
   Session()
@@ -521,28 +514,20 @@ class Session {
     if (public_rsa_) RSA_free(public_rsa_);
   }
 
-  bool isOpen() { return open_; }
-  OEMCryptoResult getStatus() { return session_status_; }
   uint32_t get_nonce() { return nonce_; }
 
   uint32_t session_id() { return (uint32_t)session_id_; }
-  void set_session_id(uint32_t newsession) {
-    session_id_ = (OEMCrypto_SESSION)newsession;
-  }
 
   void open() {
     EXPECT_FALSE(open_);
-    session_status_ = OEMCrypto_OpenSession(&session_id_);
-    if (OEMCrypto_SUCCESS == session_status_) {
-      open_ = true;
-    }
+    ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_OpenSession(&session_id_));
+    open_ = true;
   }
 
   void close() {
-    session_status_ = OEMCrypto_CloseSession(session_id_);
-    if (OEMCrypto_SUCCESS == session_status_) {
-      open_ = false;
-    }
+    EXPECT_TRUE(open_);
+    ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_CloseSession(session_id_));
+    open_ = false;
   }
 
   void GenerateNonce(uint32_t* nonce, int* error_counter = NULL) {
@@ -619,12 +604,11 @@ class Session {
     mac_key_client_ = wvcdm::a2b_hex(
         "F9AAE74690909F2207B53B13307FCA096CA8C49CC6DFE3659873CB952889A74B");
     enc_key_ = wvcdm::a2b_hex("CB477D09014D72C9B8DCE76C33EA43B3");
-
   }
 
   void GenerateTestSessionKeys() {
-    if (global_features.derive_key_method
-        == DeviceFeatures::LOAD_TEST_RSA_KEY) {
+    if (global_features.derive_key_method ==
+        DeviceFeatures::LOAD_TEST_RSA_KEY) {
       GenerateDerivedKeysFromSessionKey();
     } else {
       GenerateDerivedKeysFromKeybox();
@@ -670,9 +654,11 @@ class Session {
         // control duration and bits stored in network byte order. For printing
         // we change to host byte order.
         ASSERT_EQ(htonl(license_.keys[i].control.duration),
-                  htonl(block.duration)) << "For key " << i;
+                  htonl(block.duration))
+            << "For key " << i;
         ASSERT_EQ(htonl(license_.keys[i].control.control_bits),
-                  htonl(block.control_bits)) << "For key " << i;
+                  htonl(block.control_bits))
+            << "For key " << i;
       }
     }
   }
@@ -690,19 +676,20 @@ class Session {
         signature_.size(), key_count, key_array);
     ASSERT_EQ(expected_result, sts);
 
-    TestDecryptCTR();
+    ASSERT_NO_FATAL_FAILURE(TestDecryptCTR());
     sleep(kShortSleep);  //  Should still be valid key.
-    TestDecryptCTR(false);
+    ASSERT_NO_FATAL_FAILURE(TestDecryptCTR(false));
     sleep(kShortSleep + kLongSleep);  // Should be after first expiration.
     if (expected_result == OEMCrypto_SUCCESS) {
-      TestDecryptCTR(false, OEMCrypto_SUCCESS);
+      ASSERT_NO_FATAL_FAILURE(TestDecryptCTR(false, OEMCrypto_SUCCESS));
     } else {
-      TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE);
+      ASSERT_NO_FATAL_FAILURE(
+          TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE));
     }
   }
 
   void SetKeyId(int index, const string& key_id) {
-    MessageKeyData &key = license_.keys[index];
+    MessageKeyData& key = license_.keys[index];
     key.key_id_length = key_id.length();
     ASSERT_LE(key.key_id_length, kTestKeyIdMaxLength);
     memcpy(key.key_id, key_id.data(), key.key_id_length);
@@ -710,19 +697,26 @@ class Session {
 
   void FillSimpleMessage(uint32_t duration, uint32_t control, uint32_t nonce,
                          const std::string& pst = "") {
-    OEMCrypto_GetRandom(license_.mac_key_iv, sizeof(license_.mac_key_iv));
-    OEMCrypto_GetRandom(license_.mac_keys, sizeof(license_.mac_keys));
+    EXPECT_EQ(
+        OEMCrypto_SUCCESS,
+        OEMCrypto_GetRandom(license_.mac_key_iv, sizeof(license_.mac_key_iv)));
+    EXPECT_EQ(
+        OEMCrypto_SUCCESS,
+        OEMCrypto_GetRandom(license_.mac_keys, sizeof(license_.mac_keys)));
     for (unsigned int i = 0; i < kNumKeys; i++) {
       memset(license_.keys[i].key_id, 0, kTestKeyIdMaxLength);
       license_.keys[i].key_id_length = kDefaultKeyIdLength;
       memset(license_.keys[i].key_id, i, license_.keys[i].key_id_length);
-      OEMCrypto_GetRandom(license_.keys[i].key_data,
-                          sizeof(license_.keys[i].key_data));
+      EXPECT_EQ(OEMCrypto_SUCCESS,
+                OEMCrypto_GetRandom(license_.keys[i].key_data,
+                                    sizeof(license_.keys[i].key_data)));
       license_.keys[i].key_data_length = wvcdm::KEY_SIZE;
-      OEMCrypto_GetRandom(license_.keys[i].key_iv,
-                          sizeof(license_.keys[i].key_iv));
-      OEMCrypto_GetRandom(license_.keys[i].control_iv,
-                          sizeof(license_.keys[i].control_iv));
+      EXPECT_EQ(OEMCrypto_SUCCESS,
+                OEMCrypto_GetRandom(license_.keys[i].key_iv,
+                                    sizeof(license_.keys[i].key_iv)));
+      EXPECT_EQ(OEMCrypto_SUCCESS,
+                OEMCrypto_GetRandom(license_.keys[i].control_iv,
+                                    sizeof(license_.keys[i].control_iv)));
       if (control & wvoec_mock::kControlRequireAntiRollbackHardware) {
         memcpy(license_.keys[i].control.verification, "kc10", 4);
       } else if (control & (wvoec_mock::kControlHDCPVersionMask |
@@ -960,7 +954,8 @@ class Session {
       memcpy(message.rsa_key, rsa_key.data(), rsa_key.size());
       message.rsa_key_length = rsa_key.size();
     }
-    OEMCrypto_GetRandom(message.rsa_key_iv, wvcdm::KEY_IV_SIZE);
+    EXPECT_EQ(OEMCrypto_SUCCESS,
+              OEMCrypto_GetRandom(message.rsa_key_iv, wvcdm::KEY_IV_SIZE));
     message.nonce = nonce_;
 
     EncryptMessage(&message, encrypted);
@@ -1094,7 +1089,7 @@ class Session {
         << RSA_size(public_rsa_) << "\n";
 
     if (padding_scheme == kSign_RSASSA_PSS) {
-      EVP_PKEY *pkey = EVP_PKEY_new();
+      EVP_PKEY* pkey = EVP_PKEY_new();
       ASSERT_TRUE(EVP_PKEY_set1_RSA(pkey, public_rsa_) == 1);
 
       const bool ok = VerifyPSSSignature(pkey, &message[0], message.size(),
@@ -1107,7 +1102,7 @@ class Session {
       // RSA_public_decrypt decrypts the signature, and then verifies that
       // it was padded with RSA PKCS1 padding.
       size = RSA_public_decrypt(signature_length, signature, &padded_digest[0],
-                                  public_rsa_, RSA_PKCS1_PADDING);
+                                public_rsa_, RSA_PKCS1_PADDING);
       EXPECT_GT(size, 0);
       padded_digest.resize(size);
       EXPECT_EQ(message, padded_digest);
@@ -1213,7 +1208,7 @@ class Session {
   void ForceDeleteEntry(const std::string& pst) {
     ASSERT_EQ(OEMCrypto_SUCCESS,
               OEMCrypto_ForceDeleteUsageEntry(
-                  reinterpret_cast<const uint8_t *>(pst.c_str()), pst.length()));
+                  reinterpret_cast<const uint8_t*>(pst.c_str()), pst.length()));
   }
 
   MessageData& license() { return license_; }
@@ -1227,7 +1222,6 @@ class Session {
  private:
   bool open_;
   OEMCrypto_SESSION session_id_;
-  OEMCryptoResult session_status_;
   vector<uint8_t> mac_key_server_;
   vector<uint8_t> mac_key_client_;
   vector<uint8_t> enc_key_;
@@ -1251,8 +1245,7 @@ class OEMCryptoClientTest : public ::testing::Test {
     wvcdm::g_cutoff = wvcdm::LOG_INFO;
     const ::testing::TestInfo* const test_info =
         ::testing::UnitTest::GetInstance()->current_test_info();
-    LOGD("Running test %s.%s", test_info->name(),
-         test_info->test_case_name());
+    LOGD("Running test %s.%s", test_info->name(), test_info->test_case_name());
   }
 
   virtual void TearDown() {
@@ -1377,33 +1370,17 @@ TEST_F(OEMCryptoClientTest, NormalInitTermination) {
 //
 TEST_F(OEMCryptoClientTest, NormalSessionOpenClose) {
   Session s;
-  s.open();
-  ASSERT_EQ(OEMCrypto_SUCCESS, s.getStatus());
-  ASSERT_TRUE(s.isOpen());
-  s.close();
-  ASSERT_EQ(OEMCrypto_SUCCESS, s.getStatus());
-  ASSERT_FALSE(s.isOpen());
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.close());
 }
 
 TEST_F(OEMCryptoClientTest, TwoSessionsOpenClose) {
   Session s1;
   Session s2;
-
-  s1.open();
-  ASSERT_EQ(OEMCrypto_SUCCESS, s1.getStatus());
-  ASSERT_TRUE(s1.isOpen());
-
-  s2.open();
-  ASSERT_EQ(OEMCrypto_SUCCESS, s2.getStatus());
-  ASSERT_TRUE(s2.isOpen());
-
-  s1.close();
-  ASSERT_EQ(OEMCrypto_SUCCESS, s1.getStatus());
-  ASSERT_FALSE(s1.isOpen());
-
-  s2.close();
-  ASSERT_EQ(OEMCrypto_SUCCESS, s2.getStatus());
-  ASSERT_FALSE(s2.isOpen());
+  ASSERT_NO_FATAL_FAILURE(s1.open());
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s1.close());
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 }
 
 // This test should still pass for API v9.  A better test is below, but it only
@@ -1411,14 +1388,10 @@ TEST_F(OEMCryptoClientTest, TwoSessionsOpenClose) {
 TEST_F(OEMCryptoClientTest, EightSessionsOpenClose) {
   vector<Session> s(8);
   for (int i = 0; i < 8; i++) {
-    s[i].open();
-    ASSERT_EQ(OEMCrypto_SUCCESS, s[i].getStatus());
-    ASSERT_TRUE(s[i].isOpen());
+    ASSERT_NO_FATAL_FAILURE(s[i].open());
   }
   for (int i = 0; i < 8; i++) {
-    s[i].close();
-    ASSERT_EQ(OEMCrypto_SUCCESS, s[i].getStatus());
-    ASSERT_FALSE(s[i].isOpen());
+    ASSERT_NO_FATAL_FAILURE(s[i].close());
   }
 }
 
@@ -1434,8 +1407,8 @@ TEST_F(OEMCryptoClientTest, MaxSessionsOpenCloseAPI10) {
   ASSERT_GE(max_sessions, kMinimumSupportedMaxNumberOfSessions);
   // We allow GetMaxNumberOfSessions to return an estimate.  This tests with a
   // pad of 5%. Even if it's just an estimate, we still require 8 sessions.
-  size_t max_sessions_with_pad = max(max_sessions * 19/20,
-                                     kMinimumSupportedMaxNumberOfSessions);
+  size_t max_sessions_with_pad =
+      max(max_sessions * 19 / 20, kMinimumSupportedMaxNumberOfSessions);
   vector<OEMCrypto_SESSION> sessions;
   // Limit the number of sessions for testing.
   const size_t kMaxNumberOfSessionsForTesting = 0x100u;
@@ -1474,17 +1447,16 @@ TEST_F(OEMCryptoClientTest, MaxSessionsOpenCloseAPI10) {
 
 TEST_F(OEMCryptoClientTest, GenerateNonce) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   uint32_t nonce;
   s.GenerateNonce(&nonce);
 }
 
 TEST_F(OEMCryptoClientTest, GenerateTwoNonces) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   uint32_t nonce1;
   uint32_t nonce2;
-
   s.GenerateNonce(&nonce1);
   s.GenerateNonce(&nonce2);
   ASSERT_TRUE(nonce1 != nonce2);
@@ -1492,7 +1464,7 @@ TEST_F(OEMCryptoClientTest, GenerateTwoNonces) {
 
 TEST_F(OEMCryptoClientTest, PreventNonceFlood) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   int error_counter = 0;
   uint32_t nonce;
   time_t test_start = time(NULL);
@@ -1525,8 +1497,7 @@ TEST_F(OEMCryptoClientTest, PreventNonceFlood2) {
   const int kFloodCount = 80;
   for (int i = 0; i < kFloodCount; i++) {
     Session s;
-    s.open();
-    EXPECT_TRUE(s.isOpen());
+    ASSERT_NO_FATAL_FAILURE(s.open());
     s.GenerateNonce(&nonce, &error_counter);
   }
   time_t test_end = time(NULL);
@@ -1539,7 +1510,7 @@ TEST_F(OEMCryptoClientTest, PreventNonceFlood2) {
   error_counter = 0;
   sleep(2);  // After a pause, we should be able to regenerate nonces.
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateNonce(&nonce, &error_counter);
   EXPECT_EQ(0, error_counter);
 }
@@ -1557,8 +1528,7 @@ TEST_F(OEMCryptoClientTest, PreventNonceFlood3) {
   // To allow for some slop, we actually test for more.
   Session s[8];
   for (int i = 0; i < 8; i++) {
-    s[i].open();
-    EXPECT_TRUE(s[i].isOpen());
+    ASSERT_NO_FATAL_FAILURE(s[i].open());
     for (int j = 0; j < 10; j++) {
       request_counter++;
       s[i].GenerateNonce(&nonce, &error_counter);
@@ -1573,7 +1543,6 @@ TEST_F(OEMCryptoClientTest, PreventNonceFlood3) {
   EXPECT_LE(valid_counter, 20 * (test_end - test_start + 2));
   error_counter = 0;
   sleep(2);  // After a pause, we should be able to regenerate nonces.
-  EXPECT_TRUE(s[0].isOpen());
   s[0].GenerateNonce(&nonce, &error_counter);
   EXPECT_EQ(0, error_counter);
 }
@@ -1587,30 +1556,30 @@ TEST_F(OEMCryptoClientTest, ClearCopyTestAPI10) {
   dest_buffer.type = OEMCrypto_BufferType_Clear;
   dest_buffer.buffer.clear.address = &output_buffer[0];
   dest_buffer.buffer.clear.max_length = output_buffer.size();
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(),
-                                 &dest_buffer, OEMCrypto_FirstSubsample
-                                 | OEMCrypto_LastSubsample));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(), &dest_buffer,
+                           OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample));
   ASSERT_EQ(input_buffer, output_buffer);
-  ASSERT_EQ(OEMCrypto_ERROR_INVALID_CONTEXT,
-            OEMCrypto_CopyBuffer(NULL, input_buffer.size(),
-                                 &dest_buffer, OEMCrypto_FirstSubsample
-                                 | OEMCrypto_LastSubsample));
-  ASSERT_EQ(OEMCrypto_ERROR_INVALID_CONTEXT,
-            OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(),
-                                 NULL, OEMCrypto_FirstSubsample
-                                 | OEMCrypto_LastSubsample));
+  ASSERT_EQ(
+      OEMCrypto_ERROR_INVALID_CONTEXT,
+      OEMCrypto_CopyBuffer(NULL, input_buffer.size(), &dest_buffer,
+                           OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample));
+  ASSERT_EQ(
+      OEMCrypto_ERROR_INVALID_CONTEXT,
+      OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(), NULL,
+                           OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample));
   dest_buffer.buffer.clear.address = NULL;
-  ASSERT_EQ(OEMCrypto_ERROR_INVALID_CONTEXT,
-            OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(),
-                                 &dest_buffer, OEMCrypto_FirstSubsample
-                                 | OEMCrypto_LastSubsample));
+  ASSERT_EQ(
+      OEMCrypto_ERROR_INVALID_CONTEXT,
+      OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(), &dest_buffer,
+                           OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample));
   dest_buffer.buffer.clear.address = &output_buffer[0];
   dest_buffer.buffer.clear.max_length = output_buffer.size() - 1;
-  ASSERT_EQ(OEMCrypto_ERROR_SHORT_BUFFER,
-            OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(),
-                                 &dest_buffer, OEMCrypto_FirstSubsample
-                                 | OEMCrypto_LastSubsample));
+  ASSERT_EQ(
+      OEMCrypto_ERROR_SHORT_BUFFER,
+      OEMCrypto_CopyBuffer(&input_buffer[0], input_buffer.size(), &dest_buffer,
+                           OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample));
 }
 
 TEST_F(OEMCryptoClientTest, CanLoadTestKeys) {
@@ -1638,7 +1607,7 @@ TEST_F(OEMCryptoKeyboxTest, ProductionKeyboxValid) {
 
 TEST_F(OEMCryptoKeyboxTest, GenerateDerivedKeysFromKeybox) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
 }
 
@@ -1658,7 +1627,7 @@ class OEMCryptoSessionTests : public OEMCryptoClientTest {
   }
 
   void EnsureTestKeys() {
-    switch(global_features.derive_key_method) {
+    switch (global_features.derive_key_method) {
       case DeviceFeatures::LOAD_TEST_KEYBOX:
         ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_LoadTestKeybox());
         break;
@@ -1698,8 +1667,7 @@ class OEMCryptoSessionTests : public OEMCryptoClientTest {
   }
 };
 
-class OEMCryptoSessionTestKeyboxTest : public  OEMCryptoSessionTests {};
-
+class OEMCryptoSessionTestKeyboxTest : public OEMCryptoSessionTests {};
 
 TEST_F(OEMCryptoSessionTestKeyboxTest, TestKeyboxIsValid) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_IsKeyboxValid());
@@ -1759,9 +1727,9 @@ TEST_F(OEMCryptoSessionTestKeyboxTest, BadDataForceKeybox) {
 
 TEST_F(OEMCryptoSessionTestKeyboxTest, GenerateSignature) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
 
-  s.GenerateDerivedKeysFromKeybox();
+  ASSERT_NO_FATAL_FAILURE(s.GenerateDerivedKeysFromKeybox());
 
   // Dummy context for testing signature generation.
   vector<uint8_t> context = wvcdm::a2b_hex(
@@ -1781,7 +1749,7 @@ TEST_F(OEMCryptoSessionTestKeyboxTest, GenerateSignature) {
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
 
   static const uint32_t SignatureExpectedLength = 32;
-  ASSERT_EQ(signature_length, SignatureExpectedLength);
+  ASSERT_EQ(SignatureExpectedLength, signature_length);
   signature.resize(signature_length);
 
   std::vector<uint8_t> expected_signature;
@@ -1791,29 +1759,30 @@ TEST_F(OEMCryptoSessionTestKeyboxTest, GenerateSignature) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyNoNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, 0, 42);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(kDuration, 0, 42));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
 }
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, s.get_nonce());
-  s.EncryptAndSign();
-  s.LoadTestKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(
+      s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
 }
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithNoMAC) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys("", false);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys("", false));
 
   vector<uint8_t> context = wvcdm::a2b_hex(
       "0a4c08001248000000020000101907d9ffde13aa95c122678053362136bdf840"
@@ -1833,7 +1802,7 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithNoMAC) {
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
 
   static const uint32_t SignatureExpectedLength = 32;
-  ASSERT_EQ(signature_length, SignatureExpectedLength);
+  ASSERT_EQ(SignatureExpectedLength, signature_length);
   signature.resize(signature_length);
 
   std::vector<uint8_t> expected_signature;
@@ -1846,10 +1815,10 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithNoMAC) {
    not point into the message buffer */
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange1) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   vector<uint8_t> mac_keys(
       s.encrypted_license().mac_keys,
       s.encrypted_license().mac_keys + sizeof(s.encrypted_license().mac_keys));
@@ -1864,10 +1833,10 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange1) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange2) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   vector<uint8_t> mac_key_iv(s.encrypted_license().mac_key_iv,
                              s.encrypted_license().mac_key_iv +
                                  sizeof(s.encrypted_license().mac_key_iv));
@@ -1882,13 +1851,13 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange2) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange3) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   vector<uint8_t> bad_buffer(s.encrypted_license().keys[0].key_id,
                              s.encrypted_license().keys[0].key_id +
-                             s.encrypted_license().keys[0].key_id_length);
+                                 s.encrypted_license().keys[0].key_id_length);
   s.key_array()[0].key_id = &bad_buffer[0];
 
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
@@ -1900,10 +1869,10 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange3) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange4) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
 
   vector<uint8_t> bad_buffer(
       s.encrypted_license().keys[1].key_data,
@@ -1919,10 +1888,10 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange4) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange5) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   vector<uint8_t> bad_buffer(s.encrypted_license().keys[1].key_iv,
                              s.encrypted_license().keys[1].key_iv +
                                  sizeof(s.encrypted_license().keys[1].key_iv));
@@ -1936,11 +1905,11 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange5) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange6) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
 
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
 
   vector<uint8_t> bad_buffer(s.key_array()[2].key_control,
                              s.key_array()[2].key_control +
@@ -1956,11 +1925,11 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange6) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange7) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
 
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   vector<uint8_t> bad_buffer(
       s.key_array()[2].key_control_iv,
       s.key_array()[2].key_control_iv +
@@ -1976,10 +1945,12 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadRange7) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, 42);  // bad nonce.
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0,
+                                              wvoec_mock::kControlNonceEnabled,
+                                              42));  // bad nonce.
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
@@ -1990,19 +1961,21 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadNonce) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithRepeatNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   uint32_t nonce = s.get_nonce();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, nonce);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(
+      s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, nonce));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled,
-                      nonce);  // same old nonce.
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0,
+                                              wvoec_mock::kControlNonceEnabled,
+                                              nonce));  // same old nonce.
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
@@ -2013,12 +1986,12 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithRepeatNonce) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithBadVerification) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
 
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
   s.license().keys[1].control.verification[2] = 'Z';
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
@@ -2029,13 +2002,13 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithBadVerification) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeyWithFutureVerification) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
 
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
   // OEMCrypto should reject API12 until the spec has been defined.
   memcpy(s.license().keys[1].control.verification, "kc12", 4);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
@@ -2045,10 +2018,10 @@ TEST_F(OEMCryptoSessionTests, LoadKeyWithFutureVerification) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeysBadSignature) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   s.signature()[0] ^= 42;  // Bad signature.
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
@@ -2059,10 +2032,10 @@ TEST_F(OEMCryptoSessionTests, LoadKeysBadSignature) {
 
 TEST_F(OEMCryptoSessionTests, LoadKeysWithNoDerivedKeys) {
   Session s;
-  s.open();
-  // s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  // ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys()));
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
@@ -2072,23 +2045,24 @@ TEST_F(OEMCryptoSessionTests, LoadKeysWithNoDerivedKeys) {
 
 TEST_F(OEMCryptoSessionTests, QueryKeyControl) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, s.get_nonce());
-  s.EncryptAndSign();
-  s.LoadTestKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(
+      s.FillSimpleMessage(0, wvoec_mock::kControlNonceEnabled, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
   // Note: successful cases are tested in VerifyTestKeys.
   KeyControlBlock block;
   size_t size = sizeof(block) - 1;
-  OEMCryptoResult sts = OEMCrypto_QueryKeyControl(
-      s.session_id(), s.license().keys[0].key_id,
-      s.license().keys[0].key_id_length, reinterpret_cast<uint8_t*>(&block),
-      &size);
+  OEMCryptoResult sts =
+      OEMCrypto_QueryKeyControl(s.session_id(), s.license().keys[0].key_id,
+                                s.license().keys[0].key_id_length,
+                                reinterpret_cast<uint8_t*>(&block), &size);
   if (sts == OEMCrypto_ERROR_NOT_IMPLEMENTED) {
     return;
   }
   ASSERT_EQ(OEMCrypto_ERROR_SHORT_BUFFER, sts);
-  const char *key_id = "no_key";
+  const char* key_id = "no_key";
   size = sizeof(block);
   ASSERT_NE(OEMCrypto_SUCCESS,
             OEMCrypto_QueryKeyControl(
@@ -2098,10 +2072,11 @@ TEST_F(OEMCryptoSessionTests, QueryKeyControl) {
 
 TEST_F(OEMCryptoSessionTests, AntiRollbackHardwareRequired) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlRequireAntiRollbackHardware, 0);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      0, wvoec_mock::kControlRequireAntiRollbackHardware, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
@@ -2114,7 +2089,7 @@ TEST_F(OEMCryptoSessionTests, AntiRollbackHardwareRequired) {
 }
 
 class SessionTestDecryptWithHDCP : public OEMCryptoSessionTests,
-                                 public WithParamInterface<int> {
+                                   public WithParamInterface<int> {
  public:
   void DecryptWithHDCP(OEMCrypto_HDCP_Capability version) {
     OEMCryptoResult sts;
@@ -2122,19 +2097,21 @@ class SessionTestDecryptWithHDCP : public OEMCryptoSessionTests,
     sts = OEMCrypto_GetHDCPCapability(&current, &maximum);
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
     Session s;
-    s.open();
-    s.GenerateTestSessionKeys();
-    s.FillSimpleMessage(0, (version << wvoec_mock::kControlHDCPVersionShift) |
-                               wvoec_mock::kControlObserveHDCP |
-                               wvoec_mock::kControlHDCPRequired,
-                        0);
-    s.EncryptAndSign();
-    s.LoadTestKeys();
+    ASSERT_NO_FATAL_FAILURE(s.open());
+    ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+    ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+        0,
+        (version << wvoec_mock::kControlHDCPVersionShift) |
+            wvoec_mock::kControlObserveHDCP | wvoec_mock::kControlHDCPRequired,
+        0));
+    ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+    ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
 
     if (version > current) {
-      s.TestDecryptCTR(true, OEMCrypto_ERROR_INSUFFICIENT_HDCP);
+      ASSERT_NO_FATAL_FAILURE(
+          s.TestDecryptCTR(true, OEMCrypto_ERROR_INSUFFICIENT_HDCP));
     } else {
-      s.TestDecryptCTR(true, OEMCrypto_SUCCESS);
+      ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR(true, OEMCrypto_SUCCESS));
     }
   }
 };
@@ -2143,7 +2120,7 @@ TEST_P(SessionTestDecryptWithHDCP, Decrypt) {
   // Test parameterized by HDCP version.
   DecryptWithHDCP(static_cast<OEMCrypto_HDCP_Capability>(GetParam()));
 }
-INSTANTIATE_TEST_CASE_P(TestHDCP,  SessionTestDecryptWithHDCP, Range(1, 5));
+INSTANTIATE_TEST_CASE_P(TestHDCP, SessionTestDecryptWithHDCP, Range(1, 5));
 
 //
 // Load, Refresh Keys Test
@@ -2166,56 +2143,59 @@ class SessionTestRefreshKeyTest
 
 TEST_P(SessionTestRefreshKeyTest, RefreshWithNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, wvoec_mock::kControlNonceEnabled,
-                      s.get_nonce());
-  s.EncryptAndSign();
-  s.LoadTestKeys("", new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      kDuration, wvoec_mock::kControlNonceEnabled, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys("", new_mac_keys_));
   uint32_t nonce;
   s.GenerateNonce(&nonce);
-  s.RefreshTestKeys(num_keys_, wvoec_mock::kControlNonceEnabled, nonce,
-                    OEMCrypto_SUCCESS);
+  ASSERT_NO_FATAL_FAILURE(s.RefreshTestKeys(
+      num_keys_, wvoec_mock::kControlNonceEnabled, nonce, OEMCrypto_SUCCESS));
 }
 
 TEST_P(SessionTestRefreshKeyTest, RefreshNoNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys("", new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(kDuration, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys("", new_mac_keys_));
   uint32_t nonce;
   s.GenerateNonce(&nonce);
-  s.RefreshTestKeys(num_keys_, 0, 0, OEMCrypto_SUCCESS);
+  ASSERT_NO_FATAL_FAILURE(
+      s.RefreshTestKeys(num_keys_, 0, 0, OEMCrypto_SUCCESS));
 }
 
 TEST_P(SessionTestRefreshKeyTest, RefreshOldNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, wvoec_mock::kControlNonceEnabled,
-                      s.get_nonce());
-  s.EncryptAndSign();
-  s.LoadTestKeys("", new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      kDuration, wvoec_mock::kControlNonceEnabled, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys("", new_mac_keys_));
   uint32_t nonce = s.get_nonce();
-  s.RefreshTestKeys(num_keys_, wvoec_mock::kControlNonceEnabled, nonce,
-                    OEMCrypto_ERROR_INVALID_NONCE);
+  ASSERT_NO_FATAL_FAILURE(
+      s.RefreshTestKeys(num_keys_, wvoec_mock::kControlNonceEnabled, nonce,
+                        OEMCrypto_ERROR_INVALID_NONCE));
 }
 
 TEST_P(SessionTestRefreshKeyTest, RefreshBadNonce) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, wvoec_mock::kControlNonceEnabled,
-                      s.get_nonce());
-  s.EncryptAndSign();
-  s.LoadTestKeys("", new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      kDuration, wvoec_mock::kControlNonceEnabled, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys("", new_mac_keys_));
   uint32_t nonce;
   s.GenerateNonce(&nonce);
   nonce ^= 42;
-  s.RefreshTestKeys(num_keys_, wvoec_mock::kControlNonceEnabled, nonce,
-                    OEMCrypto_ERROR_INVALID_NONCE);
+  ASSERT_NO_FATAL_FAILURE(
+      s.RefreshTestKeys(num_keys_, wvoec_mock::kControlNonceEnabled, nonce,
+                        OEMCrypto_ERROR_INVALID_NONCE));
 }
 
 // Of only one key control block in the refesh, we update all the keys.
@@ -2233,33 +2213,32 @@ INSTANTIATE_TEST_CASE_P(TestRefreshEachKeys, SessionTestRefreshKeyTest,
 //
 TEST_F(OEMCryptoSessionTests, Decrypt) {
   Session s;
-  s.open();
-
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
-  s.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(kDuration, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
 }
 
 TEST_F(OEMCryptoSessionTests, DecryptPerformance) {
   OEMCryptoResult sts;
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   const time_t TestDuration = 5;
-  s.FillSimpleMessage(600, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(600, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
   vector<uint8_t> keyId = wvcdm::a2b_hex("000000000000000000000000");
   sts = OEMCrypto_SelectKey(s.session_id(), &keyId[0], keyId.size());
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   vector<uint8_t> encryptionIv =
       wvcdm::a2b_hex("719dbcb253b2ec702bb8c1b1bc2f3bc6");
-  const size_t max_length = 250*1000;
+  const size_t max_length = 250 * 1000;
   vector<uint8_t> input(max_length);
   printf("Size of input is %zd\n", input.size());
-  for(unsigned int i=0; i < max_length; i++) input[i] = i % 256;
+  for (unsigned int i = 0; i < max_length; i++) input[i] = i % 256;
   vector<uint8_t> output(max_length);
   OEMCrypto_DestBufferDesc destBuffer;
   destBuffer.type = OEMCrypto_BufferType_Clear;
@@ -2276,10 +2255,11 @@ TEST_F(OEMCryptoSessionTests, DecryptPerformance) {
   double ysum = 0.0;
   double xysum = 0.0;
   double xsqsum = 0.0;
-  printf("PERF:head, security, bytes, bytes/frame, time(ms)/frame, bandwidth\n");
+  printf(
+      "PERF:head, security, bytes, bytes/frame, time(ms)/frame, bandwidth\n");
 
-  for(int i=0; i < n; i++) {
-    size_t length = 1000 + i*1000;
+  for (int i = 0; i < n; i++) {
+    size_t length = 1000 + i * 1000;
     destBuffer.buffer.clear.max_length = length;
     time_t test_start = time(NULL);
     time_t test_end = time(NULL);
@@ -2288,42 +2268,39 @@ TEST_F(OEMCryptoSessionTests, DecryptPerformance) {
     do {
       ASSERT_EQ(OEMCrypto_SUCCESS,
                 OEMCrypto_DecryptCENC(
-                    s.session_id(), &input[0], length, true,
-                    &encryptionIv[0], 0, &destBuffer, &pattern,
+                    s.session_id(), &input[0], length, true, &encryptionIv[0],
+                    0, &destBuffer, &pattern,
                     OEMCrypto_FirstSubsample | OEMCrypto_LastSubsample));
       count++;
       total += length;
       test_end = time(NULL);
-    } while(test_end - test_start < TestDuration);
+    } while (test_end - test_start < TestDuration);
     x[i] = length;
-    y[i] = 1000*(test_end-test_start)/((double)count);
+    y[i] = 1000 * (test_end - test_start) / ((double)count);
     xsum += x[i];
     ysum += y[i];
-    xysum += x[i]*y[i];
-    xsqsum += x[i]*x[i];
-    printf("PERF:stat, %s, %12zd, %12g,  %12g, %12g\n", level, total,
-         x[i], y[i],
-         ((double)total)/((double)(test_end-test_start))
-         );
+    xysum += x[i] * y[i];
+    xsqsum += x[i] * x[i];
+    printf("PERF:stat, %s, %12zd, %12g,  %12g, %12g\n", level, total, x[i],
+           y[i], ((double)total) / ((double)(test_end - test_start)));
   }
-  double b = (n*xysum - xsum*ysum) / (n*xsqsum - xsum*xsum);
-  double a = (ysum - b*xsum)/n;
+  double b = (n * xysum - xsum * ysum) / (n * xsqsum - xsum * xsum);
+  double a = (ysum - b * xsum) / n;
   printf("PERF-FIT, security=%s fit time(ms)/frame = %g + %g * buffer_size\n",
-       level, a, b);
-  for(int i=0; i < n; i++) {
-    printf("PERF-FIT, %12g,  %12g, %12g\n", x[i], y[i], a + b*x[i]);
+         level, a, b);
+  for (int i = 0; i < n; i++) {
+    printf("PERF-FIT, %12g,  %12g, %12g\n", x[i], y[i], a + b * x[i]);
   }
 }
 
 TEST_F(OEMCryptoSessionTests, DecryptZeroDuration) {
   Session s;
-  s.open();
-
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
-  s.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(0, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
 }
 
 class OEMCryptoSessionTestsDecryptEdgeCases : public OEMCryptoSessionTests {
@@ -2334,13 +2311,13 @@ class OEMCryptoSessionTestsDecryptEdgeCases : public OEMCryptoSessionTests {
   // ourselves.
   void ctr128_inc64(int64_t increaseBy, uint8_t* iv) {
     uint64_t* counterBuffer = reinterpret_cast<uint64_t*>(&iv[8]);
-    (*counterBuffer) = wvcdm::htonll64(wvcdm::ntohll64(*counterBuffer) +
-                                       increaseBy);
+    (*counterBuffer) =
+        wvcdm::htonll64(wvcdm::ntohll64(*counterBuffer) + increaseBy);
   }
 
   size_t FindTotalSize(const vector<size_t>& subsample_size) {
     size_t total_size = 0;
-    for(size_t i=0; i < subsample_size.size(); i++)
+    for (size_t i = 0; i < subsample_size.size(); i++)
       total_size += subsample_size[i];
     return total_size;
   }
@@ -2362,8 +2339,7 @@ class OEMCryptoSessionTestsDecryptEdgeCases : public OEMCryptoSessionTests {
     size_t l = 0;
     while (l < cipher_data_length) {
       AES_encrypt(aes_iv, ecount_buf, &aes_key);
-      for (int n = 0; n < AES_BLOCK_SIZE && l < cipher_data_length;
-           ++n, ++l) {
+      for (int n = 0; n < AES_BLOCK_SIZE && l < cipher_data_length; ++n, ++l) {
         (*out)[l] = in[l] ^ ecount_buf[n];
       }
       ctr128_inc64(1, aes_iv);
@@ -2372,17 +2348,16 @@ class OEMCryptoSessionTestsDecryptEdgeCases : public OEMCryptoSessionTests {
 
   void TestDecrypt(const vector<uint8_t>& unencryptedData,
                    const vector<uint8_t>& encryptedData,
-                   const vector<uint8_t>& encryptionIv,
-                   size_t total_size, const vector<size_t> subsample_size) {
+                   const vector<uint8_t>& encryptionIv, size_t total_size,
+                   const vector<size_t> subsample_size) {
     OEMCryptoResult sts;
     Session s;
-    s.open();
-    s.GenerateTestSessionKeys();
-    s.FillSimpleMessage(kDuration, 0, 0);
-    s.EncryptAndSign();
-    s.LoadTestKeys();
-    sts = OEMCrypto_SelectKey(s.session_id(),
-                              s.license().keys[0].key_id,
+    ASSERT_NO_FATAL_FAILURE(s.open());
+    ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+    ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(kDuration, 0, 0));
+    ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+    ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+    sts = OEMCrypto_SelectKey(s.session_id(), s.license().keys[0].key_id,
                               s.license().keys[0].key_id_length);
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
 
@@ -2394,24 +2369,24 @@ class OEMCryptoSessionTestsDecryptEdgeCases : public OEMCryptoSessionTests {
     // We decrypt three subsamples.  each with a block offset.
     vector<uint8_t> outputBuffer(total_size, 0xaa);
     size_t buffer_offset = 0;
-    for(size_t i=0; i < subsample_size.size(); i++) {
+    for (size_t i = 0; i < subsample_size.size(); i++) {
       const size_t block_offset = buffer_offset % AES_BLOCK_SIZE;
       uint8_t subsample_flags = 0;
       if (i == 0) subsample_flags |= OEMCrypto_FirstSubsample;
-      if (i == subsample_size.size()-1) {
+      if (i == subsample_size.size() - 1) {
         subsample_flags |= OEMCrypto_LastSubsample;
       }
       OEMCrypto_DestBufferDesc destBuffer;
       destBuffer.type = OEMCrypto_BufferType_Clear;
       destBuffer.buffer.clear.address = &outputBuffer[buffer_offset];
-      destBuffer.buffer.clear.max_length = total_size-buffer_offset;
+      destBuffer.buffer.clear.max_length = total_size - buffer_offset;
       uint8_t aes_iv[AES_BLOCK_SIZE];
       memcpy(aes_iv, &encryptionIv[0], AES_BLOCK_SIZE);
       size_t iv_increment = buffer_offset / AES_BLOCK_SIZE;
       ctr128_inc64(iv_increment, aes_iv);
-      sts = OEMCrypto_DecryptCENC(
-          s.session_id(), &encryptedData[buffer_offset], subsample_size[i],
-          true, aes_iv, block_offset, &destBuffer, &pattern, subsample_flags);
+      sts = OEMCrypto_DecryptCENC(s.session_id(), &encryptedData[buffer_offset],
+                                  subsample_size[i], true, aes_iv, block_offset,
+                                  &destBuffer, &pattern, subsample_flags);
       ASSERT_EQ(OEMCrypto_SUCCESS, sts);
       buffer_offset += subsample_size[i];
     }
@@ -2419,9 +2394,9 @@ class OEMCryptoSessionTestsDecryptEdgeCases : public OEMCryptoSessionTests {
     // If there was a problem, compare the outputBuffer at the offset with the
     // correct data at 0.  A common error is to ignore the offset when
     // decrypting.
-    if (unencryptedData != outputBuffer && 2*subsample_size[0] < total_size
-        && 0 == memcmp(&unencryptedData[0], &outputBuffer[subsample_size[0]],
-                       subsample_size[0])){
+    if (unencryptedData != outputBuffer && 2 * subsample_size[0] < total_size &&
+        0 == memcmp(&unencryptedData[0], &outputBuffer[subsample_size[0]],
+                    subsample_size[0])) {
       printf("The first %zd bytes are repeating.  This is an indication \n",
              subsample_size[0]);
       printf("that DecryptCTR is ignoring the offset.\n");
@@ -2444,6 +2419,7 @@ TEST_F(OEMCryptoSessionTestsDecryptEdgeCases, EvenOffset) {
   // want.  By picking the encrypted data to be all 0, it is easier to
   // re-encrypt the data and debug problems.
   EncryptCTR(key, encryptionIv, encryptedData, &unencryptedData);
+  // XXX - assert to failure.
   TestDecrypt(unencryptedData, encryptedData, encryptionIv, total_size,
               subsample_size);
 }
@@ -2459,7 +2435,7 @@ TEST_F(OEMCryptoSessionTestsDecryptEdgeCases, NoOffset) {
   vector<uint8_t> encryptedData(total_size);
   vector<uint8_t> encryptionIv(AES_BLOCK_SIZE);
   encryptionIv = wvcdm::a2b_hex("c09454479a280829c946df3c22f25539");
-  for(size_t i=0; i < total_size; i++) unencryptedData[i] = i % 256;
+  for (size_t i = 0; i < total_size; i++) unencryptedData[i] = i % 256;
   vector<uint8_t> key = wvcdm::a2b_hex("39AD33E5719656069F9EDE9EBBA7A77D");
   EncryptCTR(key, encryptionIv, unencryptedData, &encryptedData);
   TestDecrypt(unencryptedData, encryptedData, encryptionIv, total_size,
@@ -2479,7 +2455,7 @@ TEST_F(OEMCryptoSessionTestsDecryptEdgeCases, OddOffset) {
   vector<uint8_t> encryptedData(total_size);
   vector<uint8_t> encryptionIv(AES_BLOCK_SIZE);
   encryptionIv = wvcdm::a2b_hex("c09454479a280829c946df3c22f25539");
-  for(size_t i=0; i < total_size; i++) unencryptedData[i] = i % 256;
+  for (size_t i = 0; i < total_size; i++) unencryptedData[i] = i % 256;
   vector<uint8_t> key = wvcdm::a2b_hex("39AD33E5719656069F9EDE9EBBA7A77D");
   EncryptCTR(key, encryptionIv, unencryptedData, &encryptedData);
   TestDecrypt(unencryptedData, encryptedData, encryptionIv, total_size,
@@ -2489,7 +2465,8 @@ TEST_F(OEMCryptoSessionTestsDecryptEdgeCases, OddOffset) {
 // This tests that the algorithm used to increment the counter for
 // AES-CTR mode is correct.  There are two possible implementations:
 // 1) increment the counter as if it were a 128 bit number,
-// 2) increment the low 64 bits as a 64 bit number and leave the high bits alone.
+// 2) increment the low 64 bits as a 64 bit number and leave the high bits
+// alone.
 // For CENC, the algorithm we should use is the second one.  OpenSSL defaults to
 // the first.  If this test is not passing, you should look at the way you
 // increment the counter.  Look at the example code in ctr128_inc64 above.
@@ -2503,7 +2480,7 @@ TEST_F(OEMCryptoSessionTestsDecryptEdgeCases, DecryptWithNearWrap) {
   vector<uint8_t> encryptedData(total_size);
   vector<uint8_t> encryptionIv(AES_BLOCK_SIZE);
   encryptionIv = wvcdm::a2b_hex("FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE");
-  for(size_t i=0; i < total_size; i++) unencryptedData[i] = i % 256;
+  for (size_t i = 0; i < total_size; i++) unencryptedData[i] = i % 256;
   vector<uint8_t> key = wvcdm::a2b_hex("39AD33E5719656069F9EDE9EBBA7A77D");
   EncryptCTR(key, encryptionIv, unencryptedData, &encryptedData);
   TestDecrypt(unencryptedData, encryptedData, encryptionIv, total_size,
@@ -2513,12 +2490,11 @@ TEST_F(OEMCryptoSessionTestsDecryptEdgeCases, DecryptWithNearWrap) {
 TEST_F(OEMCryptoSessionTests, DecryptUnencrypted) {
   OEMCryptoResult sts;
   Session s;
-  s.open();
-
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(kDuration, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
 
   // Select the key (from FillSimpleMessage)
   sts = OEMCrypto_SelectKey(s.session_id(), s.license().keys[0].key_id,
@@ -2536,8 +2512,8 @@ TEST_F(OEMCryptoSessionTests, DecryptUnencrypted) {
       "0b31459b90c26c907b549c1ab293725e414d4e45f5b30af7a55f95499a7dc89f"
       "7d13ba90b34aef6b49484b0701bf96ea8b660c24bb4e92a2d1c43beb434fa386"
       "1071380388799ac31d79285f5817687ed3e2eeb73a30744e77b757686c9ba5ad");
-  vector<uint8_t> encryptionIv = wvcdm::a2b_hex(
-      "49fc3efaaf614ed81d595847b928edd0");
+  vector<uint8_t> encryptionIv =
+      wvcdm::a2b_hex("49fc3efaaf614ed81d595847b928edd0");
 
   // Describe the output
   vector<uint8_t> outputBuffer(256);
@@ -2562,7 +2538,7 @@ TEST_F(OEMCryptoSessionTests, DecryptUnencrypted) {
 TEST_F(OEMCryptoSessionTests, DecryptUnencryptedNoKey) {
   OEMCryptoResult sts;
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   // Clear data should be copied even if there is no key selected.
   // Set up our expected input and output
   // This is dummy decrypted data.
@@ -2575,8 +2551,8 @@ TEST_F(OEMCryptoSessionTests, DecryptUnencryptedNoKey) {
       "0b31459b90c26c907b549c1ab293725e414d4e45f5b30af7a55f95499a7dc89f"
       "7d13ba90b34aef6b49484b0701bf96ea8b660c24bb4e92a2d1c43beb434fa386"
       "1071380388799ac31d79285f5817687ed3e2eeb73a30744e77b757686c9ba5ad");
-  vector<uint8_t> encryptionIv = wvcdm::a2b_hex(
-      "49fc3efaaf614ed81d595847b928edd0");
+  vector<uint8_t> encryptionIv =
+      wvcdm::a2b_hex("49fc3efaaf614ed81d595847b928edd0");
 
   // Describe the output
   vector<uint8_t> outputBuffer(256);
@@ -2600,28 +2576,31 @@ TEST_F(OEMCryptoSessionTests, DecryptUnencryptedNoKey) {
 
 TEST_F(OEMCryptoSessionTests, DecryptSecureToClear) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, wvoec_mock::kControlObserveDataPath |
-                      wvoec_mock::kControlDataPathSecure, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
-  s.TestDecryptCTR(true, OEMCrypto_ERROR_UNKNOWN_FAILURE);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      kDuration,
+      wvoec_mock::kControlObserveDataPath | wvoec_mock::kControlDataPathSecure,
+      0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+  ASSERT_NO_FATAL_FAILURE(
+      s.TestDecryptCTR(true, OEMCrypto_ERROR_UNKNOWN_FAILURE));
 }
 
 TEST_F(OEMCryptoSessionTests, KeyDuration) {
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(kDuration, wvoec_mock::kControlNonceEnabled,
-                      s.get_nonce());
-  s.EncryptAndSign();
-  s.LoadTestKeys();
-  s.TestDecryptCTR(true, OEMCrypto_SUCCESS);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      kDuration, wvoec_mock::kControlNonceEnabled, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR(true, OEMCrypto_SUCCESS));
   sleep(kShortSleep);  //  Should still be valid key.
-  s.TestDecryptCTR(false, OEMCrypto_SUCCESS);
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR(false, OEMCrypto_SUCCESS));
   sleep(kLongSleep);  // Should be expired key.
-  s.TestDecryptCTR(false, OEMCrypto_ERROR_KEY_EXPIRED);
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR(false, OEMCrypto_ERROR_KEY_EXPIRED));
 }
 
 //
@@ -2629,21 +2608,22 @@ TEST_F(OEMCryptoSessionTests, KeyDuration) {
 //
 class OEMCryptoLoadsCertificate : public OEMCryptoSessionTestKeyboxTest {
  protected:
-  OEMCryptoLoadsCertificate() :
-      encoded_rsa_key_(kTestRSAPKCS8PrivateKeyInfo2_2048,
-                   kTestRSAPKCS8PrivateKeyInfo2_2048 +
-                   sizeof(kTestRSAPKCS8PrivateKeyInfo2_2048)) {}
+  OEMCryptoLoadsCertificate()
+      : encoded_rsa_key_(kTestRSAPKCS8PrivateKeyInfo2_2048,
+                         kTestRSAPKCS8PrivateKeyInfo2_2048 +
+                             sizeof(kTestRSAPKCS8PrivateKeyInfo2_2048)) {}
 
   void CreateWrappedRSAKey(vector<uint8_t>* wrapped_key,
                            uint32_t allowed_schemes, bool force) {
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     s.GenerateDerivedKeysFromKeybox();
     struct RSAPrivateKeyMessage encrypted;
     std::vector<uint8_t> signature;
-    s.MakeRSACertificate(&encrypted, &signature, allowed_schemes,
-                         encoded_rsa_key_);
-    s.RewrapRSAKey(encrypted, signature, wrapped_key, force);
+    ASSERT_NO_FATAL_FAILURE(s.MakeRSACertificate(
+        &encrypted, &signature, allowed_schemes, encoded_rsa_key_));
+    ASSERT_NO_FATAL_FAILURE(
+        s.RewrapRSAKey(encrypted, signature, wrapped_key, force));
     // Verify that the clear key is not contained in the wrapped key.
     // It should be encrypted.
     ASSERT_EQ(NULL, find(*wrapped_key, encoded_rsa_key_));
@@ -2656,8 +2636,8 @@ TEST_F(OEMCryptoLoadsCertificate, LoadRSASessionKey) {
   std::vector<uint8_t> wrapped_rsa_key;
   CreateWrappedRSAKey(&wrapped_rsa_key, kSign_RSASSA_PSS, true);
   Session s;
-  s.open();
-  s.InstallRSASessionTestKey(wrapped_rsa_key);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.InstallRSASessionTestKey(wrapped_rsa_key));
 }
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvision) {
@@ -2670,12 +2650,12 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateProvision) {
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRange1) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
   struct RSAPrivateKeyMessage encrypted;
   std::vector<uint8_t> signature;
-  s.MakeRSACertificate(&encrypted, &signature, kSign_RSASSA_PSS,
-                       encoded_rsa_key_);
+  ASSERT_NO_FATAL_FAILURE(s.MakeRSACertificate(
+      &encrypted, &signature, kSign_RSASSA_PSS, encoded_rsa_key_));
   vector<uint8_t> wrapped_key;
   const uint8_t* message_ptr = reinterpret_cast<const uint8_t*>(&encrypted);
   size_t wrapped_key_length = 0;
@@ -2698,7 +2678,7 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRange1) {
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRange2) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
   struct RSAPrivateKeyMessage encrypted;
   std::vector<uint8_t> signature;
@@ -2728,7 +2708,7 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRange2) {
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRange3) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
   struct RSAPrivateKeyMessage encrypted;
   std::vector<uint8_t> signature;
@@ -2759,7 +2739,7 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRange3) {
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadSignature) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
   struct RSAPrivateKeyMessage encrypted;
   std::vector<uint8_t> signature;
@@ -2788,7 +2768,7 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadSignature) {
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadNonce) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
   struct RSAPrivateKeyMessage encrypted;
   std::vector<uint8_t> signature;
@@ -2817,7 +2797,7 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadNonce) {
 
 TEST_F(OEMCryptoLoadsCertificate, CertificateProvisionBadRSAKey) {
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   s.GenerateDerivedKeysFromKeybox();
   struct RSAPrivateKeyMessage encrypted;
   std::vector<uint8_t> signature;
@@ -2850,7 +2830,7 @@ TEST_F(OEMCryptoLoadsCertificate, LoadWrappedRSAKey) {
   CreateWrappedRSAKey(&wrapped_rsa_key, kSign_RSASSA_PSS, true);
 
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   sts = OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key[0],
                                    wrapped_rsa_key.size());
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
@@ -2862,27 +2842,27 @@ TEST_F(OEMCryptoLoadsCertificate, CertificateDecrypt) {
   std::vector<uint8_t> wrapped_rsa_key;
   CreateWrappedRSAKey(&wrapped_rsa_key, kSign_RSASSA_PSS, true);
   Session s;
-  s.open();
-  s.InstallRSASessionTestKey(wrapped_rsa_key);
-  s.FillSimpleMessage(kDuration, 0, 0);
-  s.EncryptAndSign();
-  s.LoadTestKeys();
-  s.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.InstallRSASessionTestKey(wrapped_rsa_key));
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(kDuration, 0, 0));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys());
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
 }
 
 class OEMCryptoUsesCertificate : public OEMCryptoLoadsCertificate {
  protected:
   virtual void SetUp() {
     OEMCryptoLoadsCertificate::SetUp();
-    session_.open();
-    if (global_features.derive_key_method
-        != DeviceFeatures::LOAD_TEST_RSA_KEY) {
+    ASSERT_NO_FATAL_FAILURE(session_.open());
+    if (global_features.derive_key_method !=
+        DeviceFeatures::LOAD_TEST_RSA_KEY) {
       std::vector<uint8_t> wrapped_rsa_key;
       CreateWrappedRSAKey(&wrapped_rsa_key, kSign_RSASSA_PSS, true);
-      ASSERT_EQ(OEMCrypto_SUCCESS,
-                OEMCrypto_LoadDeviceRSAKey(session_.session_id(),
-                                           &wrapped_rsa_key[0],
-                                           wrapped_rsa_key.size()));
+      ASSERT_EQ(
+          OEMCrypto_SUCCESS,
+          OEMCrypto_LoadDeviceRSAKey(session_.session_id(), &wrapped_rsa_key[0],
+                                     wrapped_rsa_key.size()));
     }
   }
 
@@ -2895,21 +2875,22 @@ class OEMCryptoUsesCertificate : public OEMCryptoLoadsCertificate {
 };
 
 // Test performance
-TEST_F( OEMCryptoLoadsCertificate, RSAPerformance) {
+TEST_F(OEMCryptoLoadsCertificate, RSAPerformance) {
   OEMCryptoResult sts;
-  sleep(2);                           // Make sure are not nonce limited.
-  const uint32_t TestDuration = 5000; // milliseconds.
+  sleep(2);  // Make sure are not nonce limited.
+
+  const uint32_t TestDuration = 5000;  // milliseconds.
   struct timeval start_time, end_time;
   gettimeofday(&start_time, NULL);
   gettimeofday(&end_time, NULL);
   double mtime = 0;
   long count = 0;
-  for(int i=0; i< 15; i++) {  // Only 20 nonce available.
+  for (int i = 0; i < 15; i++) {  // Only 20 nonce available.
     vector<uint8_t> wrapped_key;
     CreateWrappedRSAKey(&wrapped_key, kSign_RSASSA_PSS, true);
     count++;
     gettimeofday(&end_time, NULL);
-    long seconds  = end_time.tv_sec  - start_time.tv_sec;
+    long seconds = end_time.tv_sec - start_time.tv_sec;
     long useconds = end_time.tv_usec - start_time.tv_usec;
     mtime = seconds * 1e3 + useconds * 1e-3;
   }
@@ -2924,7 +2905,7 @@ TEST_F( OEMCryptoLoadsCertificate, RSAPerformance) {
   count = 0;
   do {
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     sts = OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key[0],
                                      wrapped_rsa_key.size());
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
@@ -2944,14 +2925,14 @@ TEST_F( OEMCryptoLoadsCertificate, RSAPerformance) {
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
     count++;
     gettimeofday(&end_time, NULL);
-    long seconds  = end_time.tv_sec  - start_time.tv_sec;
+    long seconds = end_time.tv_sec - start_time.tv_sec;
     long useconds = end_time.tv_usec - start_time.tv_usec;
     mtime = seconds * 1e3 + useconds * 1e-3;
-  } while(mtime < TestDuration);
+  } while (mtime < TestDuration);
   double license_request_time = mtime / count;
 
   Session s;
-  s.open();
+  ASSERT_NO_FATAL_FAILURE(s.open());
   ASSERT_EQ(OEMCrypto_SUCCESS,
             OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key[0],
                                        wrapped_rsa_key.size()));
@@ -2992,16 +2973,16 @@ TEST_F( OEMCryptoLoadsCertificate, RSAPerformance) {
                   enc_context.size()));
     count++;
     gettimeofday(&end_time, NULL);
-    long seconds  = end_time.tv_sec  - start_time.tv_sec;
+    long seconds = end_time.tv_sec - start_time.tv_sec;
     long useconds = end_time.tv_usec - start_time.tv_usec;
     mtime = seconds * 1e3 + useconds * 1e-3;
-  } while(mtime < TestDuration);
+  } while (mtime < TestDuration);
   double derive_keys_time = mtime / count;
 
   const char* level = OEMCrypto_SecurityLevel();
   printf("PERF:head, security, provision (ms), lic req(ms), derive keys(ms)\n");
   printf("PERF:stat, %s, %8.3f, %8.3f, %8.3f\n", level, provision_time,
-       license_request_time, derive_keys_time);
+         license_request_time, derive_keys_time);
 }
 
 TEST_F(OEMCryptoUsesCertificate, RSASignature) {
@@ -3012,25 +2993,24 @@ TEST_F(OEMCryptoUsesCertificate, RSASignature) {
   size_t signature_length = 0;
   uint8_t signature[500];
 
-  sts = OEMCrypto_GenerateRSASignature(session_.session_id(),
-                                       &licenseRequest[0],
-                                       licenseRequest.size(), signature,
-                                       &signature_length, kSign_RSASSA_PSS);
+  sts = OEMCrypto_GenerateRSASignature(
+      session_.session_id(), &licenseRequest[0], licenseRequest.size(),
+      signature, &signature_length, kSign_RSASSA_PSS);
 
   ASSERT_EQ(OEMCrypto_ERROR_SHORT_BUFFER, sts);
   ASSERT_NE(static_cast<size_t>(0), signature_length);
   ASSERT_GE(sizeof(signature), signature_length);
 
-  sts = OEMCrypto_GenerateRSASignature(session_.session_id(), &licenseRequest[0],
-                                       licenseRequest.size(), signature,
-                                       &signature_length, kSign_RSASSA_PSS);
+  sts = OEMCrypto_GenerateRSASignature(
+      session_.session_id(), &licenseRequest[0], licenseRequest.size(),
+      signature, &signature_length, kSign_RSASSA_PSS);
 
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   // In the real world, the signature above would just have been used to contact
   // the license server to get this response.
   session_.PreparePublicKey();
-  session_.VerifyRSASignature(licenseRequest, signature, signature_length,
-                              kSign_RSASSA_PSS);
+  ASSERT_NO_FATAL_FAILURE(session_.VerifyRSASignature(
+      licenseRequest, signature, signature_length, kSign_RSASSA_PSS));
 }
 
 // This test attempts to use alternate algorithms for loaded device certs.
@@ -3039,7 +3019,7 @@ class OEMCryptoLoadsCertificateAlternates : public OEMCryptoLoadsCertificate {
   void DisallowForbiddenPadding(RSA_Padding_Scheme scheme, size_t size) {
     OEMCryptoResult sts;
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     sts = OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key_[0],
                                      wrapped_rsa_key_.size());
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
@@ -3071,7 +3051,7 @@ class OEMCryptoLoadsCertificateAlternates : public OEMCryptoLoadsCertificate {
   void TestSignature(RSA_Padding_Scheme scheme, size_t size) {
     OEMCryptoResult sts;
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     sts = OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key_[0],
                                      wrapped_rsa_key_.size());
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
@@ -3094,14 +3074,15 @@ class OEMCryptoLoadsCertificateAlternates : public OEMCryptoLoadsCertificate {
         << "Failed to sign with padding scheme=" << (int)scheme
         << ", size=" << (int)size;
     s.PreparePublicKey();
-    s.VerifyRSASignature(licenseRequest, signature, signature_length, scheme);
+    ASSERT_NO_FATAL_FAILURE(s.VerifyRSASignature(licenseRequest, signature,
+                                                 signature_length, scheme));
     delete[] signature;
   }
 
   void DisallowDeriveKeys() {
     OEMCryptoResult sts;
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     sts = OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key_[0],
                                      wrapped_rsa_key_.size());
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
@@ -3203,96 +3184,89 @@ class OEMCryptoCastReceiverTest : public OEMCryptoLoadsCertificateAlternates {
   // This encodes the RSA key used in the PKCS#1 signing tests below.
   void BuildRSAKey() {
     vector<uint8_t> field_n =
-        encode(0x02, wvcdm::a2b_hex(
-                         "00"
-                         "df271fd25f8644496b0c81be4bd50297"
-                         "ef099b002a6fd67727eb449cea566ed6"
-                         "a3981a71312a141cabc9815c1209e320"
-                         "a25b32464e9999f18ca13a9fd3892558"
-                         "f9e0adefdd3650dd23a3f036d60fe398"
-                         "843706a40b0b8462c8bee3bce12f1f28"
-                         "60c2444cdc6a44476a75ff4aa24273cc"
-                         "be3bf80248465f8ff8c3a7f3367dfc0d"
-                         "f5b6509a4f82811cedd81cdaaa73c491"
-                         "da412170d544d4ba96b97f0afc806549"
-                         "8d3a49fd910992a1f0725be24f465cfe"
-                         "7e0eabf678996c50bc5e7524abf73f15"
-                         "e5bef7d518394e3138ce4944506aaaaf"
-                         "3f9b236dcab8fc00f87af596fdc3d9d6"
-                         "c75cd508362fae2cbeddcc4c7450b17b"
-                         "776c079ecca1f256351a43b97dbe2153"));
+        encode(0x02, wvcdm::a2b_hex("00"
+                                    "df271fd25f8644496b0c81be4bd50297"
+                                    "ef099b002a6fd67727eb449cea566ed6"
+                                    "a3981a71312a141cabc9815c1209e320"
+                                    "a25b32464e9999f18ca13a9fd3892558"
+                                    "f9e0adefdd3650dd23a3f036d60fe398"
+                                    "843706a40b0b8462c8bee3bce12f1f28"
+                                    "60c2444cdc6a44476a75ff4aa24273cc"
+                                    "be3bf80248465f8ff8c3a7f3367dfc0d"
+                                    "f5b6509a4f82811cedd81cdaaa73c491"
+                                    "da412170d544d4ba96b97f0afc806549"
+                                    "8d3a49fd910992a1f0725be24f465cfe"
+                                    "7e0eabf678996c50bc5e7524abf73f15"
+                                    "e5bef7d518394e3138ce4944506aaaaf"
+                                    "3f9b236dcab8fc00f87af596fdc3d9d6"
+                                    "c75cd508362fae2cbeddcc4c7450b17b"
+                                    "776c079ecca1f256351a43b97dbe2153"));
     vector<uint8_t> field_e = encode(0x02, wvcdm::a2b_hex("010001"));
     vector<uint8_t> field_d =
-        encode(0x02, wvcdm::a2b_hex(
-                         "5bd910257830dce17520b03441a51a8c"
-                         "ab94020ac6ecc252c808f3743c95b7c8"
-                         "3b8c8af1a5014346ebc4242cdfb5d718"
-                         "e30a733e71f291e4d473b61bfba6daca"
-                         "ed0a77bd1f0950ae3c91a8f901118825"
-                         "89e1d62765ee671e7baeea309f64d447"
-                         "bbcfa9ea12dce05e9ea8939bc5fe6108"
-                         "581279c982b308794b3448e7f7b95229"
-                         "2df88c80cb40142c4b5cf5f8ddaa0891"
-                         "678d610e582fcb880f0d707caf47d09a"
-                         "84e14ca65841e5a3abc5e9dba94075a9"
-                         "084341f0edad9b68e3b8e082b80b6e6e"
-                         "8a0547b44fb5061b6a9131603a5537dd"
-                         "abd01d8e863d8922e9aa3e4bfaea0b39"
-                         "d79283ad2cbc8a59cce7a6ecf4e4c81e"
-                         "d4c6591c807defd71ab06866bb5e7745"));
+        encode(0x02, wvcdm::a2b_hex("5bd910257830dce17520b03441a51a8c"
+                                    "ab94020ac6ecc252c808f3743c95b7c8"
+                                    "3b8c8af1a5014346ebc4242cdfb5d718"
+                                    "e30a733e71f291e4d473b61bfba6daca"
+                                    "ed0a77bd1f0950ae3c91a8f901118825"
+                                    "89e1d62765ee671e7baeea309f64d447"
+                                    "bbcfa9ea12dce05e9ea8939bc5fe6108"
+                                    "581279c982b308794b3448e7f7b95229"
+                                    "2df88c80cb40142c4b5cf5f8ddaa0891"
+                                    "678d610e582fcb880f0d707caf47d09a"
+                                    "84e14ca65841e5a3abc5e9dba94075a9"
+                                    "084341f0edad9b68e3b8e082b80b6e6e"
+                                    "8a0547b44fb5061b6a9131603a5537dd"
+                                    "abd01d8e863d8922e9aa3e4bfaea0b39"
+                                    "d79283ad2cbc8a59cce7a6ecf4e4c81e"
+                                    "d4c6591c807defd71ab06866bb5e7745"));
     vector<uint8_t> field_p =
-        encode(0x02, wvcdm::a2b_hex(
-                         "00"
-                         "f44f5e4246391f482b2f5296e3602eb3"
-                         "4aa136427710f7c0416d403fd69d4b29"
-                         "130cfebef34e885abdb1a8a0a5f0e9b5"
-                         "c33e1fc3bfc285b1ae17e40cc67a1913"
-                         "dd563719815ebaf8514c2a7aa0018e63"
-                         "b6c631dc315a46235716423d11ff5803"
-                         "4e610645703606919f5c7ce2660cd148"
-                         "bd9efc123d9c54b6705590d006cfcf3f"));
+        encode(0x02, wvcdm::a2b_hex("00"
+                                    "f44f5e4246391f482b2f5296e3602eb3"
+                                    "4aa136427710f7c0416d403fd69d4b29"
+                                    "130cfebef34e885abdb1a8a0a5f0e9b5"
+                                    "c33e1fc3bfc285b1ae17e40cc67a1913"
+                                    "dd563719815ebaf8514c2a7aa0018e63"
+                                    "b6c631dc315a46235716423d11ff5803"
+                                    "4e610645703606919f5c7ce2660cd148"
+                                    "bd9efc123d9c54b6705590d006cfcf3f"));
     vector<uint8_t> field_q =
-        encode(0x02, wvcdm::a2b_hex(
-                         "00"
-                         "e9d49841e0e0a6ad0d517857133e36dc"
-                         "72c1bdd90f9174b52e26570f373640f1"
-                         "c185e7ea8e2ed7f1e4ebb951f70a5802"
-                         "3633b0097aec67c6dcb800fc1a67f9bb"
-                         "0563610f08ebc8746ad129772136eb1d"
-                         "daf46436450d318332a84982fe5d28db"
-                         "e5b3e912407c3e0e03100d87d436ee40"
-                         "9eec1cf85e80aba079b2e6106b97bced"));
+        encode(0x02, wvcdm::a2b_hex("00"
+                                    "e9d49841e0e0a6ad0d517857133e36dc"
+                                    "72c1bdd90f9174b52e26570f373640f1"
+                                    "c185e7ea8e2ed7f1e4ebb951f70a5802"
+                                    "3633b0097aec67c6dcb800fc1a67f9bb"
+                                    "0563610f08ebc8746ad129772136eb1d"
+                                    "daf46436450d318332a84982fe5d28db"
+                                    "e5b3e912407c3e0e03100d87d436ee40"
+                                    "9eec1cf85e80aba079b2e6106b97bced"));
     vector<uint8_t> field_exp1 =
-        encode(0x02, wvcdm::a2b_hex(
-                         "00"
-                         "ed102acdb26871534d1c414ecad9a4d7"
-                         "32fe95b10eea370da62f05de2c393b1a"
-                         "633303ea741b6b3269c97f704b352702"
-                         "c9ae79922f7be8d10db67f026a8145de"
-                         "41b30c0a42bf923bac5f7504c248604b"
-                         "9faa57ed6b3246c6ba158e36c644f8b9"
-                         "548fcf4f07e054a56f768674054440bc"
-                         "0dcbbc9b528f64a01706e05b0b91106f"));
+        encode(0x02, wvcdm::a2b_hex("00"
+                                    "ed102acdb26871534d1c414ecad9a4d7"
+                                    "32fe95b10eea370da62f05de2c393b1a"
+                                    "633303ea741b6b3269c97f704b352702"
+                                    "c9ae79922f7be8d10db67f026a8145de"
+                                    "41b30c0a42bf923bac5f7504c248604b"
+                                    "9faa57ed6b3246c6ba158e36c644f8b9"
+                                    "548fcf4f07e054a56f768674054440bc"
+                                    "0dcbbc9b528f64a01706e05b0b91106f"));
     vector<uint8_t> field_exp2 =
-        encode(0x02, wvcdm::a2b_hex(
-                         "6827924a85e88b55ba00f8219128bd37"
-                         "24c6b7d1dfe5629ef197925fecaff5ed"
-                         "b9cdf3a7befd8ea2e8dd3707138b3ff8"
-                         "7c3c39c57f439e562e2aa805a39d7cd7"
-                         "9966d2ece7845f1dbc16bee99999e4d0"
-                         "bf9eeca45fcda8a8500035fe6b5f03bc"
-                         "2f6d1bfc4d4d0a3723961af0cdce4a01"
-                         "eec82d7f5458ec19e71b90eeef7dff61"));
+        encode(0x02, wvcdm::a2b_hex("6827924a85e88b55ba00f8219128bd37"
+                                    "24c6b7d1dfe5629ef197925fecaff5ed"
+                                    "b9cdf3a7befd8ea2e8dd3707138b3ff8"
+                                    "7c3c39c57f439e562e2aa805a39d7cd7"
+                                    "9966d2ece7845f1dbc16bee99999e4d0"
+                                    "bf9eeca45fcda8a8500035fe6b5f03bc"
+                                    "2f6d1bfc4d4d0a3723961af0cdce4a01"
+                                    "eec82d7f5458ec19e71b90eeef7dff61"));
     vector<uint8_t> field_invq =
-        encode(0x02, wvcdm::a2b_hex(
-                         "57b73888d183a99a6307422277551a3d"
-                         "9e18adf06a91e8b55ceffef9077c8496"
-                         "948ecb3b16b78155cb2a3a57c119d379"
-                         "951c010aa635edcf62d84c5a122a8d67"
-                         "ab5fa9e5a4a8772a1e943bafc70ae3a4"
-                         "c1f0f3a4ddffaefd1892c8cb33bb0d0b"
-                         "9590e963a69110fb34db7b906fc4ba28"
-                         "36995aac7e527490ac952a02268a4f18"));
+        encode(0x02, wvcdm::a2b_hex("57b73888d183a99a6307422277551a3d"
+                                    "9e18adf06a91e8b55ceffef9077c8496"
+                                    "948ecb3b16b78155cb2a3a57c119d379"
+                                    "951c010aa635edcf62d84c5a122a8d67"
+                                    "ab5fa9e5a4a8772a1e943bafc70ae3a4"
+                                    "c1f0f3a4ddffaefd1892c8cb33bb0d0b"
+                                    "9590e963a69110fb34db7b906fc4ba28"
+                                    "36995aac7e527490ac952a02268a4f18"));
 
     // Header of rsa key is constant.
     encoded_rsa_key_ = wvcdm::a2b_hex(
@@ -3336,7 +3310,7 @@ class OEMCryptoCastReceiverTest : public OEMCryptoLoadsCertificateAlternates {
                      const vector<uint8_t>& correct_signature) {
     OEMCryptoResult sts;
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     sts = OEMCrypto_LoadDeviceRSAKey(s.session_id(), &wrapped_rsa_key_[0],
                                      wrapped_rsa_key_.size());
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
@@ -3379,9 +3353,10 @@ class OEMCryptoCastReceiverTest : public OEMCryptoLoadsCertificateAlternates {
 
     // Also verify that our verification algorithm agrees.  This is not needed
     // to test OEMCrypto, but it does verify that this test is valid.
-    s.VerifyRSASignature(digest, &signature[0], signature_length, scheme);
-    s.VerifyRSASignature(digest, &correct_signature[0],
-                         correct_signature.size(), scheme);
+    ASSERT_NO_FATAL_FAILURE(
+        s.VerifyRSASignature(digest, &signature[0], signature_length, scheme));
+    ASSERT_NO_FATAL_FAILURE(s.VerifyRSASignature(
+        digest, &correct_signature[0], correct_signature.size(), scheme));
   }
 };
 
@@ -4082,9 +4057,9 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
  protected:
   virtual void SetUp() {
     OEMCryptoSessionTests::SetUp();
-    session_.open();
-    session_.GenerateTestSessionKeys();
-    MakeFourKeys();
+    ASSERT_NO_FATAL_FAILURE(session_.open());
+    ASSERT_NO_FATAL_FAILURE(session_.GenerateTestSessionKeys());
+    ASSERT_NO_FATAL_FAILURE(MakeFourKeys());
   }
 
   virtual void TearDown() {
@@ -4094,7 +4069,8 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
 
   void MakeFourKeys(uint32_t duration = kDuration, uint32_t control = 0,
                     uint32_t nonce = 0, const std::string& pst = "") {
-    session_.FillSimpleMessage(duration, control, nonce, pst);
+    ASSERT_NO_FATAL_FAILURE(
+        session_.FillSimpleMessage(duration, control, nonce, pst));
     session_.license().keys[0].control.control_bits |=
         htonl(wvoec_mock::kControlAllowEncrypt);
     session_.license().keys[1].control.control_bits |=
@@ -4117,15 +4093,16 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
   }
 
   void EncryptAndLoadKeys() {
-    session_.EncryptAndSign();
+    ASSERT_NO_FATAL_FAILURE(session_.EncryptAndSign());
     session_.LoadTestKeys();
   }
 
   void EncryptBuffer(unsigned int key_index, const vector<uint8_t>& in_buffer,
                      vector<uint8_t>* out_buffer) {
     AES_KEY aes_key;
-    ASSERT_EQ(0, AES_set_encrypt_key(session_.license().keys[key_index].key_data,
-                                     AES_BLOCK_SIZE * 8, &aes_key));
+    ASSERT_EQ(0,
+              AES_set_encrypt_key(session_.license().keys[key_index].key_data,
+                                  AES_BLOCK_SIZE * 8, &aes_key));
     uint8_t iv_buffer[wvcdm::KEY_IV_SIZE];
     memcpy(iv_buffer, iv_, wvcdm::KEY_IV_SIZE);
     out_buffer->resize(in_buffer.size());
@@ -4136,8 +4113,7 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
   }
 
   // Sign the buffer with the specified key.
-  void SignBuffer(unsigned int key_index,
-                  const vector<uint8_t>& in_buffer,
+  void SignBuffer(unsigned int key_index, const vector<uint8_t>& in_buffer,
                   vector<uint8_t>* signature) {
     unsigned int md_len = SHA256_DIGEST_LENGTH;
     signature->resize(SHA256_DIGEST_LENGTH);
@@ -4151,16 +4127,17 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
     OEMCryptoResult sts;
     vector<uint8_t> expected_encrypted;
     EncryptBuffer(key_index, clear_buffer_, &expected_encrypted);
-    sts = OEMCrypto_SelectKey(
-        session_.session_id(), session_.license().keys[key_index].key_id,
-        session_.license().keys[key_index].key_id_length);
+    sts = OEMCrypto_SelectKey(session_.session_id(),
+                              session_.license().keys[key_index].key_id,
+                              session_.license().keys[key_index].key_id_length);
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
     vector<uint8_t> encrypted(buffer_length);
-    sts = OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
-                                    buffer_length, iv_, algorithm, &encrypted[0]);
-    ASSERT_NE(OEMCrypto_SUCCESS, sts);
+    sts =
+        OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
+                                  buffer_length, iv_, algorithm, &encrypted[0]);
+    EXPECT_NE(OEMCrypto_SUCCESS, sts);
     expected_encrypted.resize(buffer_length);
-    ASSERT_NE(encrypted, expected_encrypted);
+    EXPECT_NE(encrypted, expected_encrypted);
   }
 
   void BadDecrypt(unsigned int key_index, OEMCrypto_Algorithm algorithm,
@@ -4168,16 +4145,16 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
     OEMCryptoResult sts;
     vector<uint8_t> encrypted;
     EncryptBuffer(key_index, clear_buffer_, &encrypted);
-    sts = OEMCrypto_SelectKey(
-        session_.session_id(), session_.license().keys[key_index].key_id,
-        session_.license().keys[key_index].key_id_length);
+    sts = OEMCrypto_SelectKey(session_.session_id(),
+                              session_.license().keys[key_index].key_id,
+                              session_.license().keys[key_index].key_id_length);
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
     vector<uint8_t> resultant(encrypted.size());
-    sts = OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                    buffer_length, iv_, algorithm,
-                                    &resultant[0]);
-    ASSERT_NE(OEMCrypto_SUCCESS, sts);
-    ASSERT_NE(clear_buffer_, resultant);
+    sts =
+        OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
+                                  buffer_length, iv_, algorithm, &resultant[0]);
+    EXPECT_NE(OEMCrypto_SUCCESS, sts);
+    EXPECT_NE(clear_buffer_, resultant);
   }
 
   void BadSign(unsigned int key_index, OEMCrypto_Algorithm algorithm) {
@@ -4185,17 +4162,17 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
     vector<uint8_t> expected_signature;
     SignBuffer(key_index, clear_buffer_, &expected_signature);
 
-    sts = OEMCrypto_SelectKey(
-        session_.session_id(), session_.license().keys[key_index].key_id,
-        session_.license().keys[key_index].key_id_length);
+    sts = OEMCrypto_SelectKey(session_.session_id(),
+                              session_.license().keys[key_index].key_id,
+                              session_.license().keys[key_index].key_id_length);
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
     size_t signature_length = (size_t)SHA256_DIGEST_LENGTH;
     vector<uint8_t> signature(SHA256_DIGEST_LENGTH);
     sts = OEMCrypto_Generic_Sign(session_.session_id(), &clear_buffer_[0],
-                                 clear_buffer_.size(), algorithm,
-                                 &signature[0], &signature_length);
-    ASSERT_NE(OEMCrypto_SUCCESS, sts);
-    ASSERT_NE(signature, expected_signature);
+                                 clear_buffer_.size(), algorithm, &signature[0],
+                                 &signature_length);
+    EXPECT_NE(OEMCrypto_SUCCESS, sts);
+    EXPECT_NE(signature, expected_signature);
   }
 
   void BadVerify(unsigned int key_index, OEMCrypto_Algorithm algorithm,
@@ -4207,14 +4184,14 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
       signature[0] ^= 42;
     }
 
-    sts = OEMCrypto_SelectKey(
-        session_.session_id(), session_.license().keys[key_index].key_id,
-        session_.license().keys[key_index].key_id_length);
+    sts = OEMCrypto_SelectKey(session_.session_id(),
+                              session_.license().keys[key_index].key_id,
+                              session_.license().keys[key_index].key_id_length);
     ASSERT_EQ(OEMCrypto_SUCCESS, sts);
     sts = OEMCrypto_Generic_Verify(session_.session_id(), &clear_buffer_[0],
                                    clear_buffer_.size(), algorithm,
                                    &signature[0], signature_size);
-    ASSERT_NE(OEMCrypto_SUCCESS, sts);
+    EXPECT_NE(OEMCrypto_SUCCESS, sts);
   }
 
   static const size_t kBufferSize = 160;  // multiple of encryption block size.
@@ -4224,26 +4201,24 @@ class GenericCryptoTest : public OEMCryptoSessionTests {
   Session session_;
 };
 
-TEST_F(GenericCryptoTest, GenericKeyLoad) {
-  EncryptAndLoadKeys();
-}
+TEST_F(GenericCryptoTest, GenericKeyLoad) { EncryptAndLoadKeys(); }
 
 TEST_F(GenericCryptoTest, GenericKeyEncrypt) {
   EncryptAndLoadKeys();
   unsigned int key_index = 0;
   vector<uint8_t> expected_encrypted;
   EncryptBuffer(key_index, clear_buffer_, &expected_encrypted);
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
   vector<uint8_t> encrypted(clear_buffer_.size());
   ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
-                                      clear_buffer_.size(), iv_,
-                                      OEMCrypto_AES_CBC_128_NO_PADDING,
-                                      &encrypted[0]));
-  ASSERT_EQ(encrypted, expected_encrypted);
+            OEMCrypto_Generic_Encrypt(
+                session_.session_id(), &clear_buffer_[0], clear_buffer_.size(),
+                iv_, OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]));
+  ASSERT_EQ(expected_encrypted, encrypted);
 }
 
 TEST_F(GenericCryptoTest, GenericKeyBadEncrypt) {
@@ -4260,16 +4235,16 @@ TEST_F(GenericCryptoTest, GenericKeyDecrypt) {
   unsigned int key_index = 1;
   vector<uint8_t> encrypted;
   EncryptBuffer(key_index, clear_buffer_, &encrypted);
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
   vector<uint8_t> resultant(encrypted.size());
   ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                      encrypted.size(),
-                                      iv_, OEMCrypto_AES_CBC_128_NO_PADDING,
-                                      &resultant[0]));
+            OEMCrypto_Generic_Decrypt(
+                session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+                OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]));
   ASSERT_EQ(clear_buffer_, resultant);
 }
 
@@ -4280,16 +4255,16 @@ TEST_F(GenericCryptoTest, GenericSecureToClear) {
   unsigned int key_index = 1;
   vector<uint8_t> encrypted;
   EncryptBuffer(key_index, clear_buffer_, &encrypted);
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
   vector<uint8_t> resultant(encrypted.size());
   ASSERT_NE(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                      encrypted.size(), iv_,
-                                      OEMCrypto_AES_CBC_128_NO_PADDING,
-                                      &resultant[0]));
+            OEMCrypto_Generic_Decrypt(
+                session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+                OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]));
   ASSERT_NE(clear_buffer_, resultant);
 }
 
@@ -4308,10 +4283,11 @@ TEST_F(GenericCryptoTest, GenericKeySign) {
   vector<uint8_t> expected_signature;
   SignBuffer(key_index, clear_buffer_, &expected_signature);
 
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
   size_t gen_signature_length = 0;
   ASSERT_EQ(OEMCrypto_ERROR_SHORT_BUFFER,
             OEMCrypto_Generic_Sign(session_.session_id(), &clear_buffer_[0],
@@ -4323,7 +4299,7 @@ TEST_F(GenericCryptoTest, GenericKeySign) {
             OEMCrypto_Generic_Sign(session_.session_id(), &clear_buffer_[0],
                                    clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
                                    &signature[0], &gen_signature_length));
-  ASSERT_EQ(signature, expected_signature);
+  ASSERT_EQ(expected_signature, signature);
 }
 
 TEST_F(GenericCryptoTest, GenericKeyBadSign) {
@@ -4340,14 +4316,15 @@ TEST_F(GenericCryptoTest, GenericKeyVerify) {
   vector<uint8_t> signature;
   SignBuffer(key_index, clear_buffer_, &signature);
 
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
   ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Verify(session_.session_id(), &clear_buffer_[0],
-                                     clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
-                                     &signature[0], signature.size()));
+            OEMCrypto_Generic_Verify(
+                session_.session_id(), &clear_buffer_[0], clear_buffer_.size(),
+                OEMCrypto_HMAC_SHA256, &signature[0], signature.size()));
 }
 
 TEST_F(GenericCryptoTest, GenericKeyBadVerify) {
@@ -4370,23 +4347,24 @@ TEST_F(GenericCryptoTest, KeyDurationEncrypt) {
 
   sleep(kShortSleep);  //  Should still be valid key.
 
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
   ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
-                                      clear_buffer_.size(), iv_,
-                                      OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]));
-  ASSERT_EQ(encrypted, expected_encrypted);
+            OEMCrypto_Generic_Encrypt(
+                session_.session_id(), &clear_buffer_[0], clear_buffer_.size(),
+                iv_, OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]));
+  ASSERT_EQ(expected_encrypted, encrypted);
 
   sleep(kLongSleep);  // Should be expired key.
 
   encrypted.assign(clear_buffer_.size(), 0);
   ASSERT_EQ(OEMCrypto_ERROR_KEY_EXPIRED,
-            OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
-                                      clear_buffer_.size(), iv_,
-                                      OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]));
+            OEMCrypto_Generic_Encrypt(
+                session_.session_id(), &clear_buffer_[0], clear_buffer_.size(),
+                iv_, OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]));
   ASSERT_NE(encrypted, expected_encrypted);
 }
 
@@ -4396,29 +4374,28 @@ TEST_F(GenericCryptoTest, KeyDurationDecrypt) {
   unsigned int key_index = 1;
   vector<uint8_t> encrypted;
   EncryptBuffer(key_index, clear_buffer_, &encrypted);
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
 
   sleep(kShortSleep);  //  Should still be valid key.
 
   vector<uint8_t> resultant(encrypted.size());
   ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                      encrypted.size(), iv_,
-                                      OEMCrypto_AES_CBC_128_NO_PADDING,
-                                      &resultant[0]));
+            OEMCrypto_Generic_Decrypt(
+                session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+                OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]));
   ASSERT_EQ(clear_buffer_, resultant);
 
   sleep(kLongSleep);  // Should be expired key.
 
   resultant.assign(encrypted.size(), 0);
   ASSERT_EQ(OEMCrypto_ERROR_KEY_EXPIRED,
-            OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                      encrypted.size(), iv_,
-                                      OEMCrypto_AES_CBC_128_NO_PADDING,
-                                      &resultant[0]));
+            OEMCrypto_Generic_Decrypt(
+                session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+                OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]));
   ASSERT_NE(clear_buffer_, resultant);
 }
 
@@ -4431,10 +4408,11 @@ TEST_F(GenericCryptoTest, KeyDurationSign) {
   size_t signature_length = signature.size();
   SignBuffer(key_index, clear_buffer_, &expected_signature);
 
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
 
   sleep(kShortSleep);  //  Should still be valid key.
 
@@ -4442,7 +4420,7 @@ TEST_F(GenericCryptoTest, KeyDurationSign) {
             OEMCrypto_Generic_Sign(session_.session_id(), &clear_buffer_[0],
                                    clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
                                    &signature[0], &signature_length));
-  ASSERT_EQ(signature, expected_signature);
+  ASSERT_EQ(expected_signature, signature);
 
   sleep(kLongSleep);  // Should be expired key.
 
@@ -4451,7 +4429,7 @@ TEST_F(GenericCryptoTest, KeyDurationSign) {
             OEMCrypto_Generic_Sign(session_.session_id(), &clear_buffer_[0],
                                    clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
                                    &signature[0], &signature_length));
-  ASSERT_NE(signature, expected_signature);
+  ASSERT_NE(expected_signature, signature);
 }
 
 TEST_F(GenericCryptoTest, KeyDurationVerify) {
@@ -4461,24 +4439,25 @@ TEST_F(GenericCryptoTest, KeyDurationVerify) {
   vector<uint8_t> signature;
   SignBuffer(key_index, clear_buffer_, &signature);
 
-  ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_SelectKey(session_.session_id(),
-                                session_.license().keys[key_index].key_id,
-                                session_.license().keys[key_index].key_id_length));
+  ASSERT_EQ(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_SelectKey(session_.session_id(),
+                          session_.license().keys[key_index].key_id,
+                          session_.license().keys[key_index].key_id_length));
 
   sleep(kShortSleep);  //  Should still be valid key.
 
   ASSERT_EQ(OEMCrypto_SUCCESS,
-            OEMCrypto_Generic_Verify(session_.session_id(), &clear_buffer_[0],
-                                     clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
-                                     &signature[0], signature.size()));
+            OEMCrypto_Generic_Verify(
+                session_.session_id(), &clear_buffer_[0], clear_buffer_.size(),
+                OEMCrypto_HMAC_SHA256, &signature[0], signature.size()));
 
   sleep(kLongSleep);  // Should be expired key.
 
   ASSERT_EQ(OEMCrypto_ERROR_KEY_EXPIRED,
-            OEMCrypto_Generic_Verify(session_.session_id(), &clear_buffer_[0],
-                                     clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
-                                     &signature[0], signature.size()));
+            OEMCrypto_Generic_Verify(
+                session_.session_id(), &clear_buffer_[0], clear_buffer_.size(),
+                OEMCrypto_HMAC_SHA256, &signature[0], signature.size()));
 }
 
 const unsigned int kLongKeyId = 2;
@@ -4488,11 +4467,11 @@ class GenericCryptoKeyIdLengthTest : public GenericCryptoTest {
   virtual void SetUp() {
     GenericCryptoTest::SetUp();
     const uint32_t kNoNonce = 0;
-    session_.FillSimpleMessage(kDuration, wvoec_mock::kControlAllowDecrypt,
-                               kNoNonce);
+    ASSERT_NO_FATAL_FAILURE(session_.FillSimpleMessage(
+        kDuration, wvoec_mock::kControlAllowDecrypt, kNoNonce));
     // We are testing that the key ids do not have to have the same length.
-    session_.SetKeyId(0, "123456789012"); // 12 bytes (common key id length).
-    session_.SetKeyId(1, "12345");        // short key id.
+    session_.SetKeyId(0, "123456789012");  // 12 bytes (common key id length).
+    session_.SetKeyId(1, "12345");         // short key id.
     session_.SetKeyId(2, "1234567890123456");  // 16 byte key id. (default)
     session_.SetKeyId(3, "12345678901234");    // 14 byte. (uncommon)
     ASSERT_EQ(2u, kLongKeyId);
@@ -4500,9 +4479,9 @@ class GenericCryptoKeyIdLengthTest : public GenericCryptoTest {
 
   // Make all four keys have the same length.
   void SetUniformKeyIdLength(size_t key_id_length) {
-    for(unsigned int i = 0; i < 4; i++) {
+    for (unsigned int i = 0; i < 4; i++) {
       string key_id;
-      key_id.resize(key_id_length,  i + 'a');
+      key_id.resize(key_id_length, i + 'a');
       session_.SetKeyId(i, key_id);
     }
   }
@@ -4522,15 +4501,15 @@ class GenericCryptoKeyIdLengthTest : public GenericCryptoTest {
     memcpy(key_id_buffer.data(), session_.license().keys[kLongKeyId].key_id,
            session_.license().keys[kLongKeyId].key_id_length);
     EncryptBuffer(key_index, clear_buffer_, &encrypted);
-    ASSERT_EQ(OEMCrypto_SUCCESS,
-              OEMCrypto_SelectKey(session_.session_id(), key_id_buffer.data(),
-                                  session_.license().keys[key_index].key_id_length));
+    ASSERT_EQ(
+        OEMCrypto_SUCCESS,
+        OEMCrypto_SelectKey(session_.session_id(), key_id_buffer.data(),
+                            session_.license().keys[key_index].key_id_length));
     vector<uint8_t> resultant(encrypted.size());
     ASSERT_EQ(OEMCrypto_SUCCESS,
-              OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                        encrypted.size(), iv_,
-                                        OEMCrypto_AES_CBC_128_NO_PADDING,
-                                        &resultant[0]));
+              OEMCrypto_Generic_Decrypt(
+                  session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+                  OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]));
     ASSERT_EQ(clear_buffer_, resultant);
   }
 };
@@ -4575,18 +4554,20 @@ class UsageTableTest : public GenericCryptoTest {
   }
 
   void LoadOfflineLicense(Session& s, const std::string& pst) {
-    s.open();
-    s.GenerateTestSessionKeys();
-    s.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry, s.get_nonce(), pst);
-    s.EncryptAndSign();
-    s.LoadTestKeys(pst, new_mac_keys_);
+    ASSERT_NO_FATAL_FAILURE(s.open());
+    ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+    ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+        0, wvoec_mock::kControlNonceOrEntry, s.get_nonce(), pst));
+    ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+    ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
     ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
     s.GenerateReport(pst);
     s.GenerateReport(pst);
     EXPECT_EQ(kUnused, s.pst_report()->status);
-    EXPECT_ALMOST(
-        0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-    s.close();
+    EXPECT_NEAR(0,
+                wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+                kTimeTolerance);
+    ASSERT_NO_FATAL_FAILURE(s.close());
   }
 
   void PrintDotsWhileSleep(time_t total_seconds, time_t interval_seconds) {
@@ -4625,20 +4606,20 @@ TEST_F(UsageTableTest, PSTReportSizes) {
   OEMCrypto_PST_Report report;
   uint8_t* location = reinterpret_cast<uint8_t*>(&report);
   EXPECT_EQ(48u, sizeof(report));
-  uint8_t *field;
-  field = reinterpret_cast<uint8_t *>(&report.status);
+  uint8_t* field;
+  field = reinterpret_cast<uint8_t*>(&report.status);
   EXPECT_EQ(20, field - location);
-  field = reinterpret_cast<uint8_t *>(&report.clock_security_level);
+  field = reinterpret_cast<uint8_t*>(&report.clock_security_level);
   EXPECT_EQ(21, field - location);
-  field = reinterpret_cast<uint8_t *>(&report.pst_length);
+  field = reinterpret_cast<uint8_t*>(&report.pst_length);
   EXPECT_EQ(22, field - location);
-  field = reinterpret_cast<uint8_t *>(&report.seconds_since_license_received);
+  field = reinterpret_cast<uint8_t*>(&report.seconds_since_license_received);
   EXPECT_EQ(24, field - location);
-  field = reinterpret_cast<uint8_t *>(&report.seconds_since_first_decrypt);
+  field = reinterpret_cast<uint8_t*>(&report.seconds_since_first_decrypt);
   EXPECT_EQ(32, field - location);
-  field = reinterpret_cast<uint8_t *>(&report.seconds_since_last_decrypt);
+  field = reinterpret_cast<uint8_t*>(&report.seconds_since_last_decrypt);
   EXPECT_EQ(40, field - location);
-  field = reinterpret_cast<uint8_t *>(&report.pst);
+  field = reinterpret_cast<uint8_t*>(&report.pst);
   EXPECT_EQ(48, field - location);
 }
 
@@ -4646,13 +4627,13 @@ TEST_P(UsageTableTestWithMAC, OnlineLicense) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
 
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   s.GenerateReport(pst);
@@ -4660,297 +4641,301 @@ TEST_P(UsageTableTestWithMAC, OnlineLicense) {
   s.GenerateReport(pst);
   s.GenerateReport(pst);
   EXPECT_EQ(kUnused, s.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-  s.TestDecryptCTR();
+  EXPECT_NEAR(0,
+              wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
   s.GenerateReport(pst);
   EXPECT_EQ(kActive, s.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(0,
+              wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  EXPECT_NEAR(0, wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt),
+              kTimeTolerance);
+  EXPECT_NEAR(0, wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt),
+              kTimeTolerance);
   DeactivatePST(pst);
   s.GenerateReport(pst);
   EXPECT_EQ(kInactive, s.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-  s.TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE);
+  EXPECT_NEAR(0,
+              wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  ASSERT_NO_FATAL_FAILURE(
+      s.TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE));
 }
 
 TEST_F(UsageTableTest, RepeatOnlineLicense) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
 
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
   Session s2;
-  s2.open();
-  s2.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s2.GenerateTestSessionKeys());
   uint8_t* pst_ptr = s.encrypted_license().pst;
   // Trying to reuse a PST is bad. We use session ID for s2, everything else
   // reused from s.
-  ASSERT_NE(OEMCrypto_SUCCESS,
-            OEMCrypto_LoadKeys(s2.session_id(), s.message_ptr(),
-                               sizeof(MessageData), &s.signature()[0],
-                               s.signature().size(),
-                               s.encrypted_license().mac_key_iv,
-                               s.encrypted_license().mac_keys, kNumKeys,
-                               s.key_array(), pst_ptr, pst.length()));
-  s2.close();
+  ASSERT_NE(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_LoadKeys(s2.session_id(), s.message_ptr(), sizeof(MessageData),
+                         &s.signature()[0], s.signature().size(),
+                         s.encrypted_license().mac_key_iv,
+                         s.encrypted_license().mac_keys, kNumKeys,
+                         s.key_array(), pst_ptr, pst.length()));
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 }
 
 // A license with non-zero replay control bits needs a valid pst..
 TEST_F(UsageTableTest, OnlineEmptyPST) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce());
-  s.EncryptAndSign();
+      s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
-      s.encrypted_license().mac_keys, kNumKeys, s.key_array(),
-      NULL, 0);
+      s.encrypted_license().mac_keys, kNumKeys, s.key_array(), NULL, 0);
   ASSERT_NE(OEMCrypto_SUCCESS, sts);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 }
 
 TEST_F(UsageTableTest, EmptyTable) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "no_pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
   OEMCrypto_DeleteUsageTable();
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   s2.GenerateReport(pst, false);
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 }
 
 TEST_F(UsageTableTest, FiftyEntries) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s1;
-  s1.open();
-  s1.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s1.open());
+  ASSERT_NO_FATAL_FAILURE(s1.GenerateTestSessionKeys());
   std::string pst1 = "pst saved";
-  s1.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s1.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s1.get_nonce(), pst1);
-  s1.EncryptAndSign();
-  s1.LoadTestKeys(pst1, new_mac_keys_);
+      s1.get_nonce(), pst1));
+  ASSERT_NO_FATAL_FAILURE(s1.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s1.LoadTestKeys(pst1, new_mac_keys_));
   sleep(kShortSleep);
 
-  const size_t ENTRY_COUNT = 49;// API says should hold at least 50 entries.
+  const size_t ENTRY_COUNT = 49;  // API says should hold at least 50 entries.
   vector<Session> sessions(ENTRY_COUNT);
-  for (size_t i=0; i < ENTRY_COUNT; i++) {
-    sessions[i].open();
-    sessions[i].GenerateTestSessionKeys();
+  for (size_t i = 0; i < ENTRY_COUNT; i++) {
+    ASSERT_NO_FATAL_FAILURE(sessions[i].open());
+    ASSERT_NO_FATAL_FAILURE(sessions[i].GenerateTestSessionKeys());
     std::string pst = "pst ";
     char c = 'A' + i;
     pst = pst + c;
-    sessions[i].FillSimpleMessage(
+    ASSERT_NO_FATAL_FAILURE(sessions[i].FillSimpleMessage(
         0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-        sessions[i].get_nonce(), pst);
-    sessions[i].EncryptAndSign();
-    sessions[i].LoadTestKeys(pst, new_mac_keys_);
+        sessions[i].get_nonce(), pst));
+    ASSERT_NO_FATAL_FAILURE(sessions[i].EncryptAndSign());
+    ASSERT_NO_FATAL_FAILURE(sessions[i].LoadTestKeys(pst, new_mac_keys_));
     sessions[i].GenerateReport(pst);
-    sessions[i].close();
+    ASSERT_NO_FATAL_FAILURE(sessions[i].close());
   }
-  for (size_t i=0; i<ENTRY_COUNT; i++) {
+  for (size_t i = 0; i < ENTRY_COUNT; i++) {
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     std::string pst = "pst ";
     char c = 'A' + i;
     pst = pst + c;
     s.GenerateReport(pst, true, &sessions[i]);
     EXPECT_EQ(kUnused, s.pst_report()->status);
-    s.close();
+    ASSERT_NO_FATAL_FAILURE(s.close());
   }
   sleep(kShortSleep);
   // If I add too many entries, it can delete the older ones first, except
   // it shouldn't delete the one attached to an open session. (s1)
-  for (size_t i=0; i < ENTRY_COUNT; i++) {
-    sessions[i].open();
-    sessions[i].GenerateTestSessionKeys();
+  for (size_t i = 0; i < ENTRY_COUNT; i++) {
+    ASSERT_NO_FATAL_FAILURE(sessions[i].open());
+    ASSERT_NO_FATAL_FAILURE(sessions[i].GenerateTestSessionKeys());
     std::string pst = "newer pst ";
     char c = 'A' + i;
     pst = pst + c;
-    sessions[i].FillSimpleMessage(
+    ASSERT_NO_FATAL_FAILURE(sessions[i].FillSimpleMessage(
         0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-        sessions[i].get_nonce(), pst);
-    sessions[i].EncryptAndSign();
-    sessions[i].LoadTestKeys(pst, new_mac_keys_);
+        sessions[i].get_nonce(), pst));
+    ASSERT_NO_FATAL_FAILURE(sessions[i].EncryptAndSign());
+    ASSERT_NO_FATAL_FAILURE(sessions[i].LoadTestKeys(pst, new_mac_keys_));
     sessions[i].GenerateReport(pst);
-    sessions[i].close();
+    ASSERT_NO_FATAL_FAILURE(sessions[i].close());
   }
-  for (int i=0; i<49; i++) {
+  for (int i = 0; i < 49; i++) {
     Session s;
-    s.open();
+    ASSERT_NO_FATAL_FAILURE(s.open());
     std::string pst = "newer pst ";
     char c = 'A' + i;
     pst = pst + c;
     s.GenerateReport(pst, true, &sessions[i]);
     EXPECT_EQ(kUnused, s.pst_report()->status);
-    s.close();
+    ASSERT_NO_FATAL_FAILURE(s.close());
   }
-  s1.close();
-  s1.open();  // Make sure s1's entry is still in the table.
+  ASSERT_NO_FATAL_FAILURE(s1.close());
+  ASSERT_NO_FATAL_FAILURE(
+      s1.open());  // Make sure s1's entry is still in the table.
   s1.GenerateReport(pst1);
   EXPECT_EQ(kUnused, s1.pst_report()->status);
-  s1.close();
+  ASSERT_NO_FATAL_FAILURE(s1.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeleteUnusedEntry) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   // New session should be able to generate report and copy mac keys.
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   s2.GenerateReport(pst, true, &s);
   EXPECT_EQ(kUnused, s2.pst_report()->status);
   s2.DeleteEntry(pst);
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // Now that session is deleted, we can't generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, false);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeleteActiveEntry) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
-  s.TestDecryptCTR();
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   // New session should be able to generate report and copy mac keys.
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   s2.GenerateReport(pst, true, &s);
   EXPECT_EQ(kActive, s2.pst_report()->status);
   s2.DeleteEntry(pst);
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // Now that session is deleted, we can't generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, false);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, ForceDeleteActiveEntry) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
-  s.TestDecryptCTR();
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   s.ForceDeleteEntry(pst);
 
   // Now that session is deleted, we can't generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, false);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeleteInactiveEntry) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
-  s.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
   DeactivatePST(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   // New session should be able to generate report and copy mac keys.
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   s2.GenerateReport(pst, true, &s);
   EXPECT_EQ(kInactive, s2.pst_report()->status);
   s2.DeleteEntry(pst);
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // Now that session is deleted, we can't generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, false);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeleteEntryBadSignature) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   // New session should be able to generate report and copy mac keys.
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   s2.GenerateReport(pst, true, &s);
   uint8_t* pst_ptr = s2.encrypted_license().pst;
   memcpy(pst_ptr, pst.c_str(), min(sizeof(s2.license().pst), pst.length()));
@@ -4961,34 +4946,34 @@ TEST_P(UsageTableTestWithMAC, DeleteEntryBadSignature) {
             OEMCrypto_DeleteUsageEntry(s2.session_id(), pst_ptr, pst.length(),
                                        s2.message_ptr(), sizeof(MessageData),
                                        &signature[0], signature.size()));
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // The session is not deleted, we can still generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, true, &s);
   EXPECT_EQ(kUnused, s3.pst_report()->status);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeleteEntryWrongSession) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   // New session should not be able to delete without using GenerateReport
   // to load mac keys.
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   // s2.GenerateReport(pst, true, &s);
   uint8_t* pst_ptr = s2.encrypted_license().pst;
   memcpy(pst_ptr, pst.c_str(), min(sizeof(s2.license().pst), pst.length()));
@@ -4998,34 +4983,34 @@ TEST_P(UsageTableTestWithMAC, DeleteEntryWrongSession) {
             OEMCrypto_DeleteUsageEntry(s2.session_id(), pst_ptr, pst.length(),
                                        s2.message_ptr(), sizeof(MessageData),
                                        &signature[0], signature.size()));
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // The session is not deleted, we can still generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, true, &s);
   EXPECT_EQ(kUnused, s3.pst_report()->status);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeleteEntryBadRange) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   std::string pst = "my pst";
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   // New session should not be able to delete if pst doesn't point into
   // message.
   Session s2;
-  s2.open();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
   s2.GenerateReport(pst, true, &s);
   uint8_t* pst_ptr = s2.license().pst;
   memcpy(pst_ptr, pst.c_str(), min(sizeof(s2.license().pst), pst.length()));
@@ -5035,14 +5020,14 @@ TEST_P(UsageTableTestWithMAC, DeleteEntryBadRange) {
             OEMCrypto_DeleteUsageEntry(s2.session_id(), pst_ptr, pst.length(),
                                        s2.message_ptr(), sizeof(MessageData),
                                        &signature[0], signature.size()));
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // The session is not deleted, we can still generate a report for it.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, true, &s);
   EXPECT_EQ(kUnused, s3.pst_report()->status);
-  s3.close();
+  ASSERT_NO_FATAL_FAILURE(s3.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeactivateBadPST) {
@@ -5061,41 +5046,46 @@ TEST_P(UsageTableTestWithMAC, GenericCryptoEncrypt) {
   std::string pst = "A PST";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   uint32_t nonce = session_.get_nonce();
-  MakeFourKeys(0, wvoec_mock::kControlNonceEnabled |
-               wvoec_mock::kControlNonceRequired,
-               nonce, pst);
-  session_.EncryptAndSign();
-  session_.LoadTestKeys(pst, new_mac_keys_);
+  MakeFourKeys(
+      0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
+      nonce, pst);
+  ASSERT_NO_FATAL_FAILURE(session_.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(session_.LoadTestKeys(pst, new_mac_keys_));
   OEMCryptoResult sts;
   unsigned int key_index = 0;
   vector<uint8_t> expected_encrypted;
   EncryptBuffer(key_index, clear_buffer_, &expected_encrypted);
-  sts = OEMCrypto_SelectKey(session_.session_id(), session_.license().keys[key_index].key_id,
+  sts = OEMCrypto_SelectKey(session_.session_id(),
+                            session_.license().keys[key_index].key_id,
                             session_.license().keys[key_index].key_id_length);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   vector<uint8_t> encrypted(clear_buffer_.size());
-  sts = OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
-                                  clear_buffer_.size(), iv_,
-                                  OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]);
+  sts = OEMCrypto_Generic_Encrypt(
+      session_.session_id(), &clear_buffer_[0], clear_buffer_.size(), iv_,
+      OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
-  EXPECT_EQ(encrypted, expected_encrypted);
+  EXPECT_EQ(expected_encrypted, encrypted);
   session_.GenerateReport(pst);
   EXPECT_EQ(kActive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt),
+      kTimeTolerance);
   DeactivatePST(pst);
   session_.GenerateReport(pst);
   EXPECT_EQ(kInactive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
   encrypted.assign(clear_buffer_.size(), 0);
-  sts = OEMCrypto_Generic_Encrypt(session_.session_id(), &clear_buffer_[0],
-                                  clear_buffer_.size(), iv_,
-                                  OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]);
+  sts = OEMCrypto_Generic_Encrypt(
+      session_.session_id(), &clear_buffer_[0], clear_buffer_.size(), iv_,
+      OEMCrypto_AES_CBC_128_NO_PADDING, &encrypted[0]);
   ASSERT_NE(OEMCrypto_SUCCESS, sts);
   EXPECT_NE(encrypted, expected_encrypted);
 }
@@ -5104,41 +5094,46 @@ TEST_P(UsageTableTestWithMAC, GenericCryptoDecrypt) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   uint32_t nonce = session_.get_nonce();
-  MakeFourKeys(0, wvoec_mock::kControlNonceEnabled |
-               wvoec_mock::kControlNonceRequired,
-               nonce, pst);
-  session_.EncryptAndSign();
-  session_.LoadTestKeys(pst, new_mac_keys_);
+  MakeFourKeys(
+      0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
+      nonce, pst);
+  ASSERT_NO_FATAL_FAILURE(session_.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(session_.LoadTestKeys(pst, new_mac_keys_));
   OEMCryptoResult sts;
   unsigned int key_index = 1;
   vector<uint8_t> encrypted;
   EncryptBuffer(key_index, clear_buffer_, &encrypted);
-  sts = OEMCrypto_SelectKey(session_.session_id(), session_.license().keys[key_index].key_id,
+  sts = OEMCrypto_SelectKey(session_.session_id(),
+                            session_.license().keys[key_index].key_id,
                             session_.license().keys[key_index].key_id_length);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   vector<uint8_t> resultant(encrypted.size());
-  sts = OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                  encrypted.size(), iv_,
-                                  OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]);
+  sts = OEMCrypto_Generic_Decrypt(
+      session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+      OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   EXPECT_EQ(clear_buffer_, resultant);
   session_.GenerateReport(pst);
   EXPECT_EQ(kActive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt),
+      kTimeTolerance);
   DeactivatePST(pst);
   session_.GenerateReport(pst);
   EXPECT_EQ(kInactive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
   resultant.assign(encrypted.size(), 0);
-  sts = OEMCrypto_Generic_Decrypt(session_.session_id(), &encrypted[0],
-                                  encrypted.size(), iv_,
-                                  OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]);
+  sts = OEMCrypto_Generic_Decrypt(
+      session_.session_id(), &encrypted[0], encrypted.size(), iv_,
+      OEMCrypto_AES_CBC_128_NO_PADDING, &resultant[0]);
   ASSERT_NE(OEMCrypto_SUCCESS, sts);
   EXPECT_NE(clear_buffer_, resultant);
 }
@@ -5147,18 +5142,19 @@ TEST_P(UsageTableTestWithMAC, GenericCryptoSign) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   uint32_t nonce = session_.get_nonce();
-  MakeFourKeys(0, wvoec_mock::kControlNonceEnabled |
-               wvoec_mock::kControlNonceRequired,
-               nonce, pst);
-  session_.EncryptAndSign();
-  session_.LoadTestKeys(pst, new_mac_keys_);
+  MakeFourKeys(
+      0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
+      nonce, pst);
+  ASSERT_NO_FATAL_FAILURE(session_.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(session_.LoadTestKeys(pst, new_mac_keys_));
 
   OEMCryptoResult sts;
   unsigned int key_index = 2;
   vector<uint8_t> expected_signature;
   SignBuffer(key_index, clear_buffer_, &expected_signature);
 
-  sts = OEMCrypto_SelectKey(session_.session_id(), session_.license().keys[key_index].key_id,
+  sts = OEMCrypto_SelectKey(session_.session_id(),
+                            session_.license().keys[key_index].key_id,
                             session_.license().keys[key_index].key_id_length);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   size_t gen_signature_length = 0;
@@ -5172,21 +5168,25 @@ TEST_P(UsageTableTestWithMAC, GenericCryptoSign) {
                                clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
                                &signature[0], &gen_signature_length);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
-  ASSERT_EQ(signature, expected_signature);
+  ASSERT_EQ(expected_signature, signature);
 
   session_.GenerateReport(pst);
   EXPECT_EQ(kActive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt),
+      kTimeTolerance);
   DeactivatePST(pst);
   session_.GenerateReport(pst);
   EXPECT_EQ(kInactive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
 
   signature.assign(SHA256_DIGEST_LENGTH, 0);
   gen_signature_length = SHA256_DIGEST_LENGTH;
@@ -5201,18 +5201,19 @@ TEST_P(UsageTableTestWithMAC, GenericCryptoVerify) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   uint32_t nonce = session_.get_nonce();
-  MakeFourKeys(0, wvoec_mock::kControlNonceEnabled |
-               wvoec_mock::kControlNonceRequired,
-               nonce, pst);
-  session_.EncryptAndSign();
-  session_.LoadTestKeys(pst, new_mac_keys_);
+  MakeFourKeys(
+      0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
+      nonce, pst);
+  ASSERT_NO_FATAL_FAILURE(session_.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(session_.LoadTestKeys(pst, new_mac_keys_));
 
   OEMCryptoResult sts;
   unsigned int key_index = 3;
   vector<uint8_t> signature;
   SignBuffer(key_index, clear_buffer_, &signature);
 
-  sts = OEMCrypto_SelectKey(session_.session_id(), session_.license().keys[key_index].key_id,
+  sts = OEMCrypto_SelectKey(session_.session_id(),
+                            session_.license().keys[key_index].key_id,
                             session_.license().keys[key_index].key_id_length);
   ASSERT_EQ(OEMCrypto_SUCCESS, sts);
   sts = OEMCrypto_Generic_Verify(session_.session_id(), &clear_buffer_[0],
@@ -5222,17 +5223,21 @@ TEST_P(UsageTableTestWithMAC, GenericCryptoVerify) {
 
   session_.GenerateReport(pst);
   EXPECT_EQ(kActive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_first_decrypt),
+      kTimeTolerance);
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_last_decrypt),
+      kTimeTolerance);
   DeactivatePST(pst);
   session_.GenerateReport(pst);
   EXPECT_EQ(kInactive, session_.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received));
+  EXPECT_NEAR(
+      0, wvcdm::htonll64(session_.pst_report()->seconds_since_license_received),
+      kTimeTolerance);
 
   sts = OEMCrypto_Generic_Verify(session_.session_id(), &clear_buffer_[0],
                                  clear_buffer_.size(), OEMCrypto_HMAC_SHA256,
@@ -5244,74 +5249,66 @@ TEST_P(UsageTableTestWithMAC, OfflineLicense) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  LoadOfflineLicense(s, pst);
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s, pst));
 }
 
 TEST_P(UsageTableTestWithMAC, ReloadOfflineLicense) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  LoadOfflineLicense(s, pst);
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s, pst));
 
-  // If there are errors in LoadOfflineLicense, that function will exit but this
-  // test will continue. The session will be left open and in an unknown state.
-  // Best just to abort in that case.
-  ASSERT_FALSE(s.isOpen()) << "LoadOfflineLicense() failed. Aborting.";
-
-  s.open();  // Offline license can be reused.
-  s.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s.open());  // Offline license can be reused.
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
   // We will reuse the encrypted and signed message, so we don't call
   // FillSimpleMessage again.
-  s.LoadTestKeys(pst, new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
   s.GenerateReport(pst);
   EXPECT_EQ(kUnused, s.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-  s.TestDecryptCTR();
+  EXPECT_NEAR(0,
+              wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
   s.GenerateReport(pst);
   EXPECT_EQ(kActive, s.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(0,
-                wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt));
-  s.close();
+  EXPECT_NEAR(0,
+              wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  EXPECT_NEAR(0, wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt),
+              kTimeTolerance);
+  EXPECT_NEAR(0, wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt),
+              kTimeTolerance);
+  ASSERT_NO_FATAL_FAILURE(s.close());
 }
 
 TEST_P(UsageTableTestWithMAC, BadReloadOfflineLicense) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  LoadOfflineLicense(s, pst);
-
-  // If there are errors in LoadOfflineLicense, that function will exit but this
-  // test will continue. The session will be left open and in an unknown state.
-  // Best just to abort in that case.
-  ASSERT_FALSE(s.isOpen()) << "LoadOfflineLicense() failed. Aborting.";
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s, pst));
 
   // Offline license with new mac keys should fail.
   Session s2;
-  s2.open();
-  s2.GenerateTestSessionKeys();
-  s2.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry,
-                       s2.get_nonce(), pst);
-  s2.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s2.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s2.FillSimpleMessage(
+      0, wvoec_mock::kControlNonceOrEntry, s2.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s2.EncryptAndSign());
   uint8_t* pst_ptr = s2.encrypted_license().pst;
-  ASSERT_NE(OEMCrypto_SUCCESS,
-            OEMCrypto_LoadKeys(s2.session_id(), s2.message_ptr(),
-                               sizeof(MessageData), &s2.signature()[0],
-                               s2.signature().size(),
-                               s2.encrypted_license().mac_key_iv,
-                               s2.encrypted_license().mac_keys, kNumKeys,
-                               s2.key_array(), pst_ptr, pst.length()));
-  s2.close();
+  ASSERT_NE(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_LoadKeys(s2.session_id(), s2.message_ptr(), sizeof(MessageData),
+                         &s2.signature()[0], s2.signature().size(),
+                         s2.encrypted_license().mac_key_iv,
+                         s2.encrypted_license().mac_keys, kNumKeys,
+                         s2.key_array(), pst_ptr, pst.length()));
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   // Offline license with same mac keys should still be OK.
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.LoadTestKeys(pst, new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
   s.GenerateReport(pst);
   EXPECT_EQ(kUnused, s.pst_report()->status);
 }
@@ -5321,76 +5318,75 @@ TEST_P(UsageTableTestWithMAC, OfflineBadNonce) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry, 42, pst);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(
+      s.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry, 42, pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   uint8_t* pst_ptr = s.encrypted_license().pst;
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
-      s.encrypted_license().mac_keys, kNumKeys, s.key_array(),
-      pst_ptr, pst.length());
+      s.encrypted_license().mac_keys, kNumKeys, s.key_array(), pst_ptr,
+      pst.length());
   ASSERT_NE(OEMCrypto_SUCCESS, sts);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 }
 
 // An offline license needs a valid pst.
 TEST_P(UsageTableTestWithMAC, OfflineEmptyPST) {
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry, s.get_nonce());
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(
+      s.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry, s.get_nonce()));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   OEMCryptoResult sts = OEMCrypto_LoadKeys(
       s.session_id(), s.message_ptr(), sizeof(MessageData), &s.signature()[0],
       s.signature().size(), s.encrypted_license().mac_key_iv,
-      s.encrypted_license().mac_keys, kNumKeys, s.key_array(),
-      NULL, 0);
+      s.encrypted_license().mac_keys, kNumKeys, s.key_array(), NULL, 0);
   ASSERT_NE(OEMCrypto_SUCCESS, sts);
-  s.close();
+  ASSERT_NO_FATAL_FAILURE(s.close());
 }
 
 TEST_P(UsageTableTestWithMAC, DeactivateOfflineLicense) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  LoadOfflineLicense(s, pst);
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s, pst));
 
-  // If there are errors in LoadOfflineLicense, that function will exit but this
-  // test will continue. The session will be left open and in an unknown state.
-  // Best just to abort in that case.
-  ASSERT_FALSE(s.isOpen()) << "LoadOfflineLicense() failed. Aborting.";
-
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.LoadTestKeys(pst, new_mac_keys_);  // Reload the license
-  s.TestDecryptCTR();                  // Should be able to decrypt.
-  DeactivatePST(pst);                  // Then deactivate.
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(
+      s.LoadTestKeys(pst, new_mac_keys_));      // Reload the license
+  ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());  // Should be able to decrypt.
+  DeactivatePST(pst);                           // Then deactivate.
   // After deactivate, should not be able to decrypt.
-  s.TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE);
+  ASSERT_NO_FATAL_FAILURE(
+      s.TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE));
   s.GenerateReport(pst);
   EXPECT_EQ(kInactive, s.pst_report()->status);
-  EXPECT_ALMOST(
-      0, wvcdm::htonll64(s.pst_report()->seconds_since_license_received));
-  s.close();
+  EXPECT_NEAR(0,
+              wvcdm::htonll64(s.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  ASSERT_NO_FATAL_FAILURE(s.close());
 
   Session s2;
-  s2.open();
-  s2.GenerateTestSessionKeys();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s2.GenerateTestSessionKeys());
   // Offile license can not be reused if it has been deactivated.
   uint8_t* pst_ptr = s.encrypted_license().pst;
-  EXPECT_NE(OEMCrypto_SUCCESS,
-            OEMCrypto_LoadKeys(s2.session_id(), s.message_ptr(),
-                               sizeof(MessageData), &s.signature()[0],
-                               s.signature().size(),
-                               s.encrypted_license().mac_key_iv,
-                               s.encrypted_license().mac_keys, kNumKeys,
-                               s.key_array(), pst_ptr, pst.length()));
+  EXPECT_NE(
+      OEMCrypto_SUCCESS,
+      OEMCrypto_LoadKeys(s2.session_id(), s.message_ptr(), sizeof(MessageData),
+                         &s.signature()[0], s.signature().size(),
+                         s.encrypted_license().mac_key_iv,
+                         s.encrypted_license().mac_keys, kNumKeys,
+                         s.key_array(), pst_ptr, pst.length()));
   // But we can still generate a report.
   Session s3;
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   s3.GenerateReport(pst, true, &s);
   EXPECT_EQ(kInactive, s3.pst_report()->status);
 }
@@ -5399,10 +5395,11 @@ TEST_P(UsageTableTestWithMAC, BadRange) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(0, wvoec_mock::kControlNonceOrEntry,s.get_nonce(), pst);
-  s.EncryptAndSign();
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
+      0, wvoec_mock::kControlNonceOrEntry, s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
   uint8_t* pst_ptr = s.license().pst;  // Bad: not in encrypted_license.
   ASSERT_NE(
       OEMCrypto_SUCCESS,
@@ -5421,42 +5418,35 @@ TEST_F(UsageTableTest, TimingTest) {
   Session s1;
   Session s2;
   Session s3;
-  LoadOfflineLicense(s1, pst1);
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s1, pst1));
   time_t loaded1 = time(NULL);
-  LoadOfflineLicense(s2, pst2);
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s2, pst2));
   time_t loaded2 = time(NULL);
-  LoadOfflineLicense(s3, pst3);
+  ASSERT_NO_FATAL_FAILURE(LoadOfflineLicense(s3, pst3));
   time_t loaded3 = time(NULL);
 
-  // If there are errors in LoadOfflineLicense, that function will exit but this
-  // test will continue. The sessions will be left open and in an unknown state.
-  // Best just to abort in that case.
-  ASSERT_FALSE(s1.isOpen()) << "LoadOfflineLicense() failed. Aborting.";
-  ASSERT_FALSE(s2.isOpen()) << "LoadOfflineLicense() failed. Aborting.";
-  ASSERT_FALSE(s3.isOpen()) << "LoadOfflineLicense() failed. Aborting.";
-
   sleep(kLongSleep);
-  s1.open();
-  s1.GenerateTestSessionKeys();
-  s1.LoadTestKeys(pst1, new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s1.open());
+  ASSERT_NO_FATAL_FAILURE(s1.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s1.LoadTestKeys(pst1, new_mac_keys_));
   time_t first_decrypt1 = time(NULL);
-  s1.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s1.TestDecryptCTR());
 
-  s2.open();
-  s2.GenerateTestSessionKeys();
-  s2.LoadTestKeys(pst2, new_mac_keys_);
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s2.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s2.LoadTestKeys(pst2, new_mac_keys_));
   time_t first_decrypt2 = time(NULL);
-  s2.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s2.TestDecryptCTR());
 
   sleep(kLongSleep);
   time_t second_decrypt = time(NULL);
-  s1.TestDecryptCTR();
-  s2.TestDecryptCTR();
+  ASSERT_NO_FATAL_FAILURE(s1.TestDecryptCTR());
+  ASSERT_NO_FATAL_FAILURE(s2.TestDecryptCTR());
 
   sleep(kLongSleep);
   DeactivatePST(pst1);
-  s1.close();
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s1.close());
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
   sleep(kLongSleep);
   // This is as close to reboot as we can simulate in code.
@@ -5468,15 +5458,15 @@ TEST_F(UsageTableTest, TimingTest) {
   // After a reboot, we should be able to reload keys, and generate reports.
   sleep(kLongSleep);
   time_t third_decrypt = time(NULL);
-  s2.open();
-  s2.GenerateTestSessionKeys();
-  s2.LoadTestKeys(pst2, new_mac_keys_);
-  s2.TestDecryptCTR();
-  s2.close();
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s2.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s2.LoadTestKeys(pst2, new_mac_keys_));
+  ASSERT_NO_FATAL_FAILURE(s2.TestDecryptCTR());
+  ASSERT_NO_FATAL_FAILURE(s2.close());
 
-  s1.open();
-  s2.open();
-  s3.open();
+  ASSERT_NO_FATAL_FAILURE(s1.open());
+  ASSERT_NO_FATAL_FAILURE(s2.open());
+  ASSERT_NO_FATAL_FAILURE(s3.open());
   sleep(kLongSleep);
   time_t report_generated1 = time(NULL);
   s1.GenerateReport(pst1);
@@ -5486,29 +5476,31 @@ TEST_F(UsageTableTest, TimingTest) {
   s3.GenerateReport(pst3);
 
   EXPECT_EQ(kInactive, s1.pst_report()->status);
-  EXPECT_ALMOST(
-      report_generated1 - loaded1,
-      wvcdm::htonll64(s1.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(
-      report_generated1 - first_decrypt1,
-      wvcdm::htonll64(s1.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(report_generated1 - second_decrypt,
-                wvcdm::htonll64(s1.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(report_generated1 - loaded1,
+              wvcdm::htonll64(s1.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  EXPECT_NEAR(report_generated1 - first_decrypt1,
+              wvcdm::htonll64(s1.pst_report()->seconds_since_first_decrypt),
+              kTimeTolerance);
+  EXPECT_NEAR(report_generated1 - second_decrypt,
+              wvcdm::htonll64(s1.pst_report()->seconds_since_last_decrypt),
+              kTimeTolerance);
 
   EXPECT_EQ(kActive, s2.pst_report()->status);
-  EXPECT_ALMOST(
-      report_generated2 - loaded2,
-      wvcdm::htonll64(s2.pst_report()->seconds_since_license_received));
-  EXPECT_ALMOST(
-      report_generated2 - first_decrypt2,
-      wvcdm::htonll64(s2.pst_report()->seconds_since_first_decrypt));
-  EXPECT_ALMOST(report_generated2 - third_decrypt,
-                wvcdm::htonll64(s2.pst_report()->seconds_since_last_decrypt));
+  EXPECT_NEAR(report_generated2 - loaded2,
+              wvcdm::htonll64(s2.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
+  EXPECT_NEAR(report_generated2 - first_decrypt2,
+              wvcdm::htonll64(s2.pst_report()->seconds_since_first_decrypt),
+              kTimeTolerance);
+  EXPECT_NEAR(report_generated2 - third_decrypt,
+              wvcdm::htonll64(s2.pst_report()->seconds_since_last_decrypt),
+              kTimeTolerance);
 
   EXPECT_EQ(kUnused, s3.pst_report()->status);
-  EXPECT_ALMOST(
-      report_generated3 - loaded3,
-      wvcdm::htonll64(s3.pst_report()->seconds_since_license_received));
+  EXPECT_NEAR(report_generated3 - loaded3,
+              wvcdm::htonll64(s3.pst_report()->seconds_since_license_received),
+              kTimeTolerance);
   // We don't expect first or last decrypt for unused report.
 }
 
@@ -5516,13 +5508,13 @@ TEST_F(UsageTableTest, VerifyUsageTimes) {
   std::string pst = "my_pst";
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
   Session s;
-  s.open();
-  s.GenerateTestSessionKeys();
-  s.FillSimpleMessage(
+  ASSERT_NO_FATAL_FAILURE(s.open());
+  ASSERT_NO_FATAL_FAILURE(s.GenerateTestSessionKeys());
+  ASSERT_NO_FATAL_FAILURE(s.FillSimpleMessage(
       0, wvoec_mock::kControlNonceEnabled | wvoec_mock::kControlNonceRequired,
-      s.get_nonce(), pst);
-  s.EncryptAndSign();
-  s.LoadTestKeys(pst, new_mac_keys_);
+      s.get_nonce(), pst));
+  ASSERT_NO_FATAL_FAILURE(s.EncryptAndSign());
+  ASSERT_NO_FATAL_FAILURE(s.LoadTestKeys(pst, new_mac_keys_));
 
   const int kLicenseReceivedTimeTolerance = kSpeedMultiplier;
   ASSERT_EQ(OEMCrypto_SUCCESS, OEMCrypto_UpdateUsageTable());
@@ -5537,11 +5529,12 @@ TEST_F(UsageTableTest, VerifyUsageTimes) {
   const time_t kUsageTableTimeTolerance = 10;
 
   cout << "This test verifies the elapsed time reported in the usage table "
-      "for a 2 minute simulated playback." << endl;
-  cout << "The total time for this test is about " <<
-      kPlaybackLoopInSeconds + 2 * kIdleInSeconds << " seconds." << endl;
-  cout << "Wait " << kIdleInSeconds <<
-      " seconds to verify usage table time before playback." << endl;
+          "for a 2 minute simulated playback."
+       << endl;
+  cout << "The total time for this test is about "
+       << kPlaybackLoopInSeconds + 2 * kIdleInSeconds << " seconds." << endl;
+  cout << "Wait " << kIdleInSeconds
+       << " seconds to verify usage table time before playback." << endl;
 
   PrintDotsWhileSleep(kIdleInSeconds, kDotIntervalInSeconds);
 
@@ -5556,7 +5549,7 @@ TEST_F(UsageTableTest, VerifyUsageTimes) {
   time_t playback_time = 0;
   time_t start_time = time(NULL);
   do {
-    s.TestDecryptCTR();
+    ASSERT_NO_FATAL_FAILURE(s.TestDecryptCTR());
     s.GenerateReport(pst);
     EXPECT_EQ(kActive, s.pst_report()->status);
     playback_time = time(NULL) - start_time;
@@ -5575,15 +5568,16 @@ TEST_F(UsageTableTest, VerifyUsageTimes) {
               playback_time + kIdleInSeconds, kLicenseReceivedTimeTolerance);
   EXPECT_NEAR(wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt),
               playback_time, kUsageTableTimeTolerance);
-  EXPECT_NEAR(wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt),
-              0, kUsageTableTimeTolerance);
-  EXPECT_NEAR(
-      wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt) -
-      wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt),
-      playback_time, kUsageTableTimeTolerance);
+  EXPECT_NEAR(wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt), 0,
+              kUsageTableTimeTolerance);
+  EXPECT_NEAR(wvcdm::htonll64(s.pst_report()->seconds_since_first_decrypt) -
+                  wvcdm::htonll64(s.pst_report()->seconds_since_last_decrypt),
+              playback_time, kUsageTableTimeTolerance);
 
-  cout << "Wait another " << kIdleInSeconds << " seconds "
-      "to verify usage table time since playback ended." << endl;
+  cout << "Wait another " << kIdleInSeconds
+       << " seconds "
+          "to verify usage table time since playback ended."
+       << endl;
   PrintDotsWhileSleep(kIdleInSeconds, kDotIntervalInSeconds);
 
   // At this point, this is what we expect:
@@ -5605,7 +5599,8 @@ TEST_F(UsageTableTest, VerifyUsageTimes) {
   DeactivatePST(pst);
   s.GenerateReport(pst);
   EXPECT_EQ(kInactive, s.pst_report()->status);
-  s.TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE);
+  ASSERT_NO_FATAL_FAILURE(
+      s.TestDecryptCTR(false, OEMCrypto_ERROR_UNKNOWN_FAILURE));
 }
 
 INSTANTIATE_TEST_CASE_P(TestUsageTables, UsageTableTestWithMAC,