From: Piotr Caban <piotr@codeweavers.com> --- dlls/msv1_0/main.c | 23 ++++++++++++++++++----- dlls/secur32/tests/ntlm.c | 23 ++++++++++++++++++++++- 2 files changed, 40 insertions(+), 6 deletions(-) diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c index 985b83b327b..494aac05c72 100644 --- a/dlls/msv1_0/main.c +++ b/dlls/msv1_0/main.c @@ -1645,6 +1645,7 @@ static NTSTATUS verify_signature( struct ntlm_ctx *ctx, unsigned int flags, SecB } free( buf ); + if (status != SEC_E_OK) TRACE( "signature verification failed %lx\n", status ); return status; } @@ -1708,7 +1709,7 @@ static NTSTATUS NTAPI ntlm_SpSealMessage( LSA_SEC_HANDLE handle, ULONG qop, SecB static NTSTATUS NTAPI ntlm_SpUnsealMessage( LSA_SEC_HANDLE handle, SecBufferDesc *msg, ULONG msg_seq_no, ULONG *qop ) { - int data_idx, stream_idx, token_idx; + int i, data_idx, stream_idx, token_idx; SecBuffer token_buf; struct ntlm_ctx *ctx; @@ -1745,11 +1746,23 @@ static NTSTATUS NTAPI ntlm_SpUnsealMessage( LSA_SEC_HANDLE handle, SecBufferDesc ctx = (struct ntlm_ctx *)handle; if (ctx->flags & FLAG_NEGOTIATE_NTLM2 && ctx->flags & FLAG_NEGOTIATE_SEAL) - arc4_process( &ctx->crypt.ntlm2.recv_arc4info, msg->pBuffers[data_idx].pvBuffer, - msg->pBuffers[data_idx].cbBuffer ); + { + for (i = 0; i < msg->cBuffers; i++) + { + if (msg->pBuffers[i].BufferType != SECBUFFER_DATA) continue; + arc4_process( &ctx->crypt.ntlm2.recv_arc4info, msg->pBuffers[i].pvBuffer, + msg->pBuffers[i].cbBuffer ); + } + } else - arc4_process( &ctx->crypt.ntlm.arc4info, msg->pBuffers[data_idx].pvBuffer, - msg->pBuffers[data_idx].cbBuffer); + { + for (i = 0; i < msg->cBuffers; i++) + { + if (msg->pBuffers[i].BufferType != SECBUFFER_DATA) continue; + arc4_process( &ctx->crypt.ntlm.arc4info, msg->pBuffers[i].pvBuffer, + msg->pBuffers[i].cbBuffer); + } + } /* make sure we use a session key for the signature check, SealMessage always does that, even in the dummy case */ diff --git a/dlls/secur32/tests/ntlm.c b/dlls/secur32/tests/ntlm.c index a5bb40ba285..3973ac3ba49 100644 --- a/dlls/secur32/tests/ntlm.c +++ b/dlls/secur32/tests/ntlm.c @@ -1062,7 +1062,7 @@ static void test_Encrypt(void) BOOL first = TRUE; SspiData client = {{0}}, server = {{0}}; SecBufferDesc crypt; - SecBuffer data[2], complex_data[4]; + SecBuffer data[3], complex_data[4]; ULONG qop = 0xdeadbeef; SecPkgContext_Sizes ctxt_sizes; @@ -1192,6 +1192,25 @@ static void test_Encrypt(void) getSecError(sec_status)); ok(qop == 0xdeadbeef, "qop changed to %lu\n", qop); + /* Test decryption with multiple data buffers */ + crypt.ulVersion = SECBUFFER_VERSION; + crypt.cBuffers = 2; + crypt.pBuffers = data; + + sec_status = EncryptMessage(&client.ctxt, 0, &crypt, 0); + ok(sec_status == SEC_E_OK, "EncryptMessage returned %s, not SEC_E_OK.\n", + getSecError(sec_status)); + + crypt.cBuffers = 3; + data[2].BufferType = SECBUFFER_DATA; + data[2].cbBuffer = data[1].cbBuffer - 8; + data[2].pvBuffer = (BYTE *)data[1].pvBuffer + 8; + data[1].cbBuffer = 8; + + sec_status = DecryptMessage(&server.ctxt, &crypt, 0, &qop); + ok(sec_status == SEC_E_OK, "DecryptMessage returned %s, not SEC_E_OK.\n", getSecError(sec_status)); + ok(qop == 0xdeadbeef, "qop changed to %lu\n", qop); + end: cleanupBuffers(&client); cleanupBuffers(&server); @@ -1199,6 +1218,8 @@ end: DeleteSecurityContext(&client.ctxt); FreeCredentialsHandle(&client.cred); + HeapFree(GetProcessHeap(), 0, data[0].pvBuffer); + HeapFree(GetProcessHeap(), 0, data[1].pvBuffer); HeapFree(GetProcessHeap(), 0, complex_data[1].pvBuffer); HeapFree(GetProcessHeap(), 0, complex_data[3].pvBuffer); } -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/11292