Commit this before the head-scratching leads to premature baldness:
    memset(a->data, 0, (unsigned int)a->max);
but the decl is:
    size_t max;
size_t could be larger than int, especially in some of the systems OpenSSL
purports to support.

How do _intentionally truncating_ casts like enter into a codebase?
Lack of understanding of C, at a minimum.  Generally the objects are
small, but this code is _intentionally unready_ for large objects.
ok miod
There is no need for is{upper,lower}() tests before to{lower,uppper}(),
since all other characters are mapped through transparently.
ok jsing