diff --git a/libwvdrmengine/cdm/core/test/cdm_engine_test.cpp b/libwvdrmengine/cdm/core/test/cdm_engine_test.cpp
index 6428ad3c..9c4dd616 100644
--- a/libwvdrmengine/cdm/core/test/cdm_engine_test.cpp
+++ b/libwvdrmengine/cdm/core/test/cdm_engine_test.cpp
@@ -152,15 +152,9 @@ class WvCdmEngineTest : public WvCdmEnginePreProvTest {
   WvCdmEngineTest() {}
 
   virtual void SetUp() {
-    CdmResponseType status =
-        cdm_engine_.OpenSession(config_.key_system(), NULL, NULL, &session_id_);
-    if (status == NEED_PROVISIONING) {
-      Provision();
-      status = cdm_engine_.OpenSession(config_.key_system(), NULL, NULL, &session_id_);
-    }
-    ASSERT_EQ(NO_ERROR, status);
-    ASSERT_NE("", session_id_) << "Could not open CDM session.";
-    ASSERT_TRUE(cdm_engine_.IsOpenSession(session_id_));
+    WvCdmTestBase::SetUp();
+    session_opened_ = false;
+    WvCdmEnginePreProvTest::OpenSession();
   }
 
  protected:
diff --git a/libwvdrmengine/oemcrypto/ref/src/oemcrypto_old_usage_table_ref.cpp b/libwvdrmengine/oemcrypto/ref/src/oemcrypto_old_usage_table_ref.cpp
index 46eb8f20..2c19ef1b 100644
--- a/libwvdrmengine/oemcrypto/ref/src/oemcrypto_old_usage_table_ref.cpp
+++ b/libwvdrmengine/oemcrypto/ref/src/oemcrypto_old_usage_table_ref.cpp
@@ -95,6 +95,11 @@ OldUsageTable::OldUsageTable(CryptoEngine *ce) {
   // This should be encrypted and signed with a device specific key.
   // For the reference implementation, I'm just going to use the keybox key.
   const std::vector<uint8_t> &key = ce_->DeviceRootKey();
+  if (key.empty()) {
+    LOGE("OldUsageTable: DeviceRootKey is unexpectedly empty.");
+    table_.clear();
+    return;
+  }
 
   uint8_t computed_signature[SHA256_DIGEST_LENGTH];
   unsigned int sig_length = sizeof(computed_signature);
diff --git a/libwvdrmengine/oemcrypto/ref/src/oemcrypto_usage_table_ref.cpp b/libwvdrmengine/oemcrypto/ref/src/oemcrypto_usage_table_ref.cpp
index b91ed78b..a68c1973 100644
--- a/libwvdrmengine/oemcrypto/ref/src/oemcrypto_usage_table_ref.cpp
+++ b/libwvdrmengine/oemcrypto/ref/src/oemcrypto_usage_table_ref.cpp
@@ -197,6 +197,10 @@ OEMCryptoResult UsageTableEntry::SaveData(CryptoEngine* ce,
   // This should be encrypted and signed with a device specific key.
   // For the reference implementation, I'm just going to use the keybox key.
   const std::vector<uint8_t>& key = ce->DeviceRootKey();
+  if (key.empty()) {
+    LOGE("SaveUsageEntry: DeviceRootKey is unexpectedly empty.");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
 
   // Encrypt the entry.
   RAND_bytes(encrypted->iv, wvoec::KEY_IV_SIZE);
@@ -235,6 +239,10 @@ OEMCryptoResult UsageTableEntry::LoadData(CryptoEngine* ce, uint32_t index,
   // This should be encrypted and signed with a device specific key.
   // For the reference implementation, I'm just going to use the keybox key.
   const std::vector<uint8_t>& key = ce->DeviceRootKey();
+  if (key.empty()) {
+    LOGE("LoadUsageEntry: DeviceRootKey is unexpectedly empty.");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
 
   // Verify the signature of the usage entry. Sign encrypted into clear buffer.
   unsigned int sig_length = SHA256_DIGEST_LENGTH;
@@ -494,6 +502,10 @@ OEMCryptoResult UsageTable::SaveUsageTableHeader(uint8_t* signed_buffer,
   // This should be encrypted and signed with a device specific key.
   // For the reference implementation, I'm just going to use the keybox key.
   const std::vector<uint8_t>& key = ce_->DeviceRootKey();
+  if (key.empty()) {
+    LOGE("SaveUsageTableHeader: DeviceRootKey is unexpectedly empty.");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
 
   // Encrypt the entry.
   RAND_bytes(encrypted->iv, wvoec::KEY_IV_SIZE);
@@ -537,6 +549,10 @@ OEMCryptoResult UsageTable::LoadUsageTableHeader(
   // This should be encrypted and signed with a device specific key.
   // For the reference implementation, I'm just going to use the keybox key.
   const std::vector<uint8_t>& key = ce_->DeviceRootKey();
+  if (key.empty()) {
+    LOGE("LoadUsageTableHeader: DeviceRootKey is unexpectedly empty.");
+    return OEMCrypto_ERROR_INVALID_CONTEXT;
+  }
 
   // Verify the signature of the usage entry. Sign encrypted into clear buffer.
   unsigned int sig_length = SHA256_DIGEST_LENGTH;