diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
index 77bd175..55b6dad 100644
--- a/crypto/asn1/a_object.c
+++ b/crypto/asn1/a_object.c
@@ -261,16 +261,20 @@
   }
 }
 
-ASN1_OBJECT *ASN1_OBJECT_create(int nid, const unsigned char *data, int len,
+ASN1_OBJECT *ASN1_OBJECT_create(int nid, const unsigned char *data, size_t len,
                                 const char *sn, const char *ln) {
-  ASN1_OBJECT o;
+  if (len > INT_MAX) {
+    OPENSSL_PUT_ERROR(ASN1, ASN1_R_STRING_TOO_LONG);
+    return NULL;
+  }
 
+  ASN1_OBJECT o;
   o.sn = sn;
   o.ln = ln;
   o.data = data;
   o.nid = nid;
-  o.length = len;
+  o.length = (int)len;
   o.flags = ASN1_OBJECT_FLAG_DYNAMIC | ASN1_OBJECT_FLAG_DYNAMIC_STRINGS |
             ASN1_OBJECT_FLAG_DYNAMIC_DATA;
-  return (OBJ_dup(&o));
+  return OBJ_dup(&o);
 }
diff --git a/include/openssl/asn1.h b/include/openssl/asn1.h
index ff77955..59996b6 100644
--- a/include/openssl/asn1.h
+++ b/include/openssl/asn1.h
@@ -1432,7 +1432,7 @@
 // TODO(davidben): Should we just ignore all those parameters? NIDs and names
 // are only relevant for |ASN1_OBJECT|s in the obj.h table.
 OPENSSL_EXPORT ASN1_OBJECT *ASN1_OBJECT_create(int nid, const uint8_t *data,
-                                               int len, const char *sn,
+                                               size_t len, const char *sn,
                                                const char *ln);
 
 // ASN1_OBJECT_free releases memory associated with |a|. If |a| is a static