diff --git a/dlls/crypt32/msg.c b/dlls/crypt32/msg.c
index 7280642652c..7c7a8e029b4 100644
--- a/dlls/crypt32/msg.c
+++ b/dlls/crypt32/msg.c
@@ -132,19 +132,24 @@ static BOOL CDataEncodeMsg_GetParam(HCRYPTMSG hCryptMsg, DWORD dwParamType,
     switch (dwParamType)
     {
     case CMSG_CONTENT_PARAM:
-    {
-        CRYPT_CONTENT_INFO info;
-        char rsa_data[] = "1.2.840.113549.1.7.1";
+        if (msg->base.streamed)
+            SetLastError(E_INVALIDARG);
+        else
+        {
+            CRYPT_CONTENT_INFO info;
+            char rsa_data[] = "1.2.840.113549.1.7.1";
 
-        info.pszObjId = rsa_data;
-        info.Content.cbData = msg->bare_content_len;
-        info.Content.pbData = msg->bare_content;
-        ret = CryptEncodeObject(X509_ASN_ENCODING, PKCS_CONTENT_INFO, &info,
-         pvData, pcbData);
+            info.pszObjId = rsa_data;
+            info.Content.cbData = msg->bare_content_len;
+            info.Content.pbData = msg->bare_content;
+            ret = CryptEncodeObject(X509_ASN_ENCODING, PKCS_CONTENT_INFO, &info,
+             pvData, pcbData);
+        }
         break;
-    }
     case CMSG_BARE_CONTENT_PARAM:
-        if (!pvData)
+        if (msg->base.streamed)
+            SetLastError(E_INVALIDARG);
+        else if (!pvData)
         {
             *pcbData = msg->bare_content_len;
             ret = TRUE;
diff --git a/dlls/crypt32/tests/msg.c b/dlls/crypt32/tests/msg.c
index ed54e824a4c..2b0bc18b82f 100644
--- a/dlls/crypt32/tests/msg.c
+++ b/dlls/crypt32/tests/msg.c
@@ -345,6 +345,12 @@ static void test_data_msg_open(void)
 
 static const BYTE msgData[] = { 1, 2, 3, 4 };
 
+static BOOL WINAPI nop_stream_output(const void *pvArg, BYTE *pb, DWORD cb,
+ BOOL final)
+{
+    return TRUE;
+}
+
 static void test_data_msg_update(void)
 {
     HCRYPTMSG msg;
@@ -403,11 +409,12 @@ static void test_data_msg_get_param(void)
     HCRYPTMSG msg;
     DWORD size;
     BOOL ret;
+    CMSG_STREAM_INFO streamInfo = { 0, nop_stream_output, NULL };
 
     msg = CryptMsgOpenToEncode(PKCS_7_ASN_ENCODING, 0, CMSG_DATA, NULL, NULL,
      NULL);
 
-    /* Content and bare content are always gettable */
+    /* Content and bare content are always gettable when not streaming */
     size = 0;
     ret = CryptMsgGetParam(msg, CMSG_CONTENT_PARAM, 0, NULL, &size);
     ok(ret, "CryptMsgGetParam failed: %08x\n", GetLastError());
@@ -430,6 +437,19 @@ static void test_data_msg_get_param(void)
     ok(!ret && GetLastError() == CRYPT_E_INVALID_MSG_TYPE,
      "Expected CRYPT_E_INVALID_MSG_TYPE, got %x\n", GetLastError());
     CryptMsgClose(msg);
+
+    /* Can't get content or bare content when streaming */
+    msg = CryptMsgOpenToEncode(PKCS_7_ASN_ENCODING, 0, CMSG_DATA, NULL,
+     NULL, &streamInfo);
+    SetLastError(0xdeadbeef);
+    ret = CryptMsgGetParam(msg, CMSG_BARE_CONTENT_PARAM, 0, NULL, &size);
+    ok(!ret && GetLastError() == E_INVALIDARG,
+     "Expected E_INVALIDARG, got %x\n", GetLastError());
+    SetLastError(0xdeadbeef);
+    ret = CryptMsgGetParam(msg, CMSG_CONTENT_PARAM, 0, NULL, &size);
+    ok(!ret && GetLastError() == E_INVALIDARG,
+     "Expected E_INVALIDARG, got %x\n", GetLastError());
+    CryptMsgClose(msg);
 }
 
 static const BYTE dataEmptyBareContent[] = { 0x04,0x00 };