http://bugs.winehq.org/show_bug.cgi?id=9685
--- Comment #32 from Juan Lang juan_lang@yahoo.com 2007-09-28 15:01:05 --- Here's a snippet from a +relay,+crypt log: 0009:Call KERNEL32.lstrcmpA(00149c5c "1.2.840.113549.1.9.6",004e4494 "1.2.840.113549.1.9.6") ret=004084dc 0009:Ret KERNEL32.lstrcmpA() retval=00000000 ret=004084dc 0009:Call crypt32.CryptDecodeObject(00010001,000001f4,30010102,67018230,00000000,00000000,0033c164) ret=0040850a trace:crypt:CryptDecodeObject (0x00010001, #01f4, 0x30010102, 1728152112, 0x00000000, (nil), 0x33c164) 0009:Ret crypt32.CryptDecodeObject() retval=00000000 ret=0040850a
The string is szOID_RSA_counterSign. The call flow looks a lot like the MS sample code here: http://support.microsoft.com/kb/323809
If that's being used, then the invalid pointer and length come from the unauthenticated attributes of the message. That points to a bug in message decoding.