Juan Lang : rsaenh: Validate pad byte when decrypting a block cipher.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: f0d2766fdc945fc967e5efbedbab9e022baabf4a
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=f0d2766fdc945fc967e5efbedbab9e022baabf4a

Author: Juan Lang <juan.lang at gmail.com>
Date:   Tue Sep 11 12:44:26 2007 -0700

rsaenh: Validate pad byte when decrypting a block cipher.

---

 dlls/rsaenh/rsaenh.c |   11 ++++++++++-
 1 files changed, 10 insertions(+), 1 deletions(-)

diff --git a/dlls/rsaenh/rsaenh.c b/dlls/rsaenh/rsaenh.c
index 4002f27..3318da6 100644
--- a/dlls/rsaenh/rsaenh.c
+++ b/dlls/rsaenh/rsaenh.c
@@ -2080,7 +2080,16 @@ BOOL WINAPI RSAENH_CPDecrypt(HCRYPTPROV hProv, HCRYPTKEY hKey, HCRYPTHASH hHash,
             }
             memcpy(in, out, pCryptKey->dwBlockLen);
         }
-        if (Final) *pdwDataLen -= pbData[*pdwDataLen-1]; 
+        if (Final) {
+            if (pbData[*pdwDataLen-1] &&
+             pbData[*pdwDataLen-1] <= pCryptKey->dwBlockLen &&
+             pbData[*pdwDataLen-1] < *pdwDataLen)
+                *pdwDataLen -= pbData[*pdwDataLen-1];
+            else {
+                SetLastError(NTE_BAD_DATA);
+                return FALSE;
+            }
+        }
 
     } else if (GET_ALG_TYPE(pCryptKey->aiAlgid) == ALG_TYPE_STREAM) {
         encrypt_stream_impl(pCryptKey->aiAlgid, &pCryptKey->context, pbData, *pdwDataLen);