Juan Lang : rsaenh: Check pad bytes for consistency when decrypting.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f6833c4d096f9f9ceedef77c8d9bf63edaf74ea6
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=f6833c4d096f9f9ceedef77c8d...

Author: Juan Lang <juan.lang(a)gmail.com>
Date:   Sun Nov 11 12:33:09 2007 -0800

rsaenh: Check pad bytes for consistency when decrypting.

---

 dlls/rsaenh/rsaenh.c |   16 ++++++++++++++--
 1 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/dlls/rsaenh/rsaenh.c b/dlls/rsaenh/rsaenh.c
index 4bb64ab..7dc1cf2 100644
--- a/dlls/rsaenh/rsaenh.c
+++ b/dlls/rsaenh/rsaenh.c
@@ -2127,8 +2127,20 @@ BOOL WINAPI RSAENH_CPDecrypt(HCRYPTPROV hProv, HCRYPTKEY hKey, HCRYPTHASH hHash,
         if (Final) {
             if (pbData[*pdwDataLen-1] &&
              pbData[*pdwDataLen-1] <= pCryptKey->dwBlockLen &&
-             pbData[*pdwDataLen-1] < *pdwDataLen)
-                *pdwDataLen -= pbData[*pdwDataLen-1];
+             pbData[*pdwDataLen-1] < *pdwDataLen) {
+                BOOL padOkay = TRUE;
+
+                /* check that every bad byte has the same value */
+                for (i = 1; padOkay && i < pbData[*pdwDataLen-1]; i++)
+                    if (pbData[*pdwDataLen - i - 1] != pbData[*pdwDataLen - 1])
+                        padOkay = FALSE;
+                if (padOkay)
+                    *pdwDataLen -= pbData[*pdwDataLen-1];
+                else {
+                    SetLastError(NTE_BAD_DATA);
+                    return FALSE;
+                }
+            }
             else {
                 SetLastError(NTE_BAD_DATA);
                 return FALSE;