[PATCH 0/1] MR11292: msv1_0: Decrypt all data buffers in ntlm_SpUnsealMessage.

[Piotr Caban (＠piotr)]

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11292

[PATCH 1/1] msv1_0: Decrypt all data buffers in ntlm_SpUnsealMessage.

[Piotr Caban]

From: Piotr Caban <[e-mail]>

---
 dlls/msv1_0/main.c        | 23 ++++++++++++++++++-----
 dlls/secur32/tests/ntlm.c | 23 ++++++++++++++++++++++-
 2 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/dlls/msv1_0/main.c b/dlls/msv1_0/main.c
index 985b83b327b..494aac05c72 100644
--- a/dlls/msv1_0/main.c
+++ b/dlls/msv1_0/main.c
@@ -1645,6 +1645,7 @@ static NTSTATUS verify_signature( struct ntlm_ctx *ctx, unsigned int flags, SecB
     }
 
     free( buf );
+    if (status != SEC_E_OK) TRACE( "signature verification failed %lx\n", status );
     return status;
 }
 
@@ -1708,7 +1709,7 @@ static NTSTATUS NTAPI ntlm_SpSealMessage( LSA_SEC_HANDLE handle, ULONG qop, SecB
 
 static NTSTATUS NTAPI ntlm_SpUnsealMessage( LSA_SEC_HANDLE handle, SecBufferDesc *msg, ULONG msg_seq_no, ULONG *qop )
 {
-    int data_idx, stream_idx, token_idx;
+    int i, data_idx, stream_idx, token_idx;
     SecBuffer token_buf;
     struct ntlm_ctx *ctx;
 
@@ -1745,11 +1746,23 @@ static NTSTATUS NTAPI ntlm_SpUnsealMessage( LSA_SEC_HANDLE handle, SecBufferDesc
 
     ctx = (struct ntlm_ctx *)handle;
     if (ctx->flags & FLAG_NEGOTIATE_NTLM2 && ctx->flags & FLAG_NEGOTIATE_SEAL)
-        arc4_process( &ctx->crypt.ntlm2.recv_arc4info, msg->pBuffers[data_idx].pvBuffer,
-                      msg->pBuffers[data_idx].cbBuffer );
+    {
+        for (i = 0; i < msg->cBuffers; i++)
+        {
+            if (msg->pBuffers[i].BufferType != SECBUFFER_DATA) continue;
+            arc4_process( &ctx->crypt.ntlm2.recv_arc4info, msg->pBuffers[i].pvBuffer,
+                          msg->pBuffers[i].cbBuffer );
+        }
+    }
     else
-        arc4_process( &ctx->crypt.ntlm.arc4info, msg->pBuffers[data_idx].pvBuffer,
-                      msg->pBuffers[data_idx].cbBuffer);
+    {
+        for (i = 0; i < msg->cBuffers; i++)
+        {
+            if (msg->pBuffers[i].BufferType != SECBUFFER_DATA) continue;
+            arc4_process( &ctx->crypt.ntlm.arc4info, msg->pBuffers[i].pvBuffer,
+                          msg->pBuffers[i].cbBuffer);
+        }
+    }
 
     /* make sure we use a session key for the signature check, SealMessage always does that,
        even in the dummy case */
diff --git a/dlls/secur32/tests/ntlm.c b/dlls/secur32/tests/ntlm.c
index a5bb40ba285..3973ac3ba49 100644
--- a/dlls/secur32/tests/ntlm.c
+++ b/dlls/secur32/tests/ntlm.c
@@ -1062,7 +1062,7 @@ static void test_Encrypt(void)
     BOOL                    first = TRUE;
     SspiData                client = {{0}}, server = {{0}};
     SecBufferDesc           crypt;
-    SecBuffer               data[2], complex_data[4];
+    SecBuffer               data[3], complex_data[4];
     ULONG                   qop = 0xdeadbeef;
     SecPkgContext_Sizes     ctxt_sizes;
 
@@ -1192,6 +1192,25 @@ static void test_Encrypt(void)
             getSecError(sec_status));
     ok(qop == 0xdeadbeef, "qop changed to %lu\n", qop);
 
+    /* Test decryption with multiple data buffers */
+    crypt.ulVersion = SECBUFFER_VERSION;
+    crypt.cBuffers = 2;
+    crypt.pBuffers = data;
+
+    sec_status = EncryptMessage(&client.ctxt, 0, &crypt, 0);
+    ok(sec_status == SEC_E_OK, "EncryptMessage returned %s, not SEC_E_OK.\n",
+            getSecError(sec_status));
+
+    crypt.cBuffers = 3;
+    data[2].BufferType = SECBUFFER_DATA;
+    data[2].cbBuffer = data[1].cbBuffer - 8;
+    data[2].pvBuffer = (BYTE *)data[1].pvBuffer + 8;
+    data[1].cbBuffer = 8;
+
+    sec_status = DecryptMessage(&server.ctxt, &crypt, 0, &qop);
+    ok(sec_status == SEC_E_OK, "DecryptMessage returned %s, not SEC_E_OK.\n", getSecError(sec_status));
+    ok(qop == 0xdeadbeef, "qop changed to %lu\n", qop);
+
 end:
     cleanupBuffers(&client);
     cleanupBuffers(&server);
@@ -1199,6 +1218,8 @@ end:
     DeleteSecurityContext(&client.ctxt);
     FreeCredentialsHandle(&client.cred);
 
+    HeapFree(GetProcessHeap(), 0, data[0].pvBuffer);
+    HeapFree(GetProcessHeap(), 0, data[1].pvBuffer);
     HeapFree(GetProcessHeap(), 0, complex_data[1].pvBuffer);
     HeapFree(GetProcessHeap(), 0, complex_data[3].pvBuffer);
 }
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/11292