Juan Lang : crypt32: Disallow embedded NULLs in alternate names.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 25e8f27817b18ecfd276bcdbba3313cc35e844ff
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=25e8f27817b18ecfd276bcdbba3313cc35e844ff

Author: Juan Lang <juan.lang at gmail.com>
Date:   Mon Nov  9 16:06:02 2009 -0800

crypt32: Disallow embedded NULLs in alternate names.

---

 dlls/crypt32/decode.c       |    8 +++++++-
 dlls/crypt32/tests/encode.c |    2 --
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/dlls/crypt32/decode.c b/dlls/crypt32/decode.c
index 090ab59..a16d89f 100644
--- a/dlls/crypt32/decode.c
+++ b/dlls/crypt32/decode.c
@@ -2990,7 +2990,13 @@ static BOOL CRYPT_AsnDecodeAltNameEntry(const BYTE *pbEncoded, DWORD cbEncoded,
         case 1: /* rfc822Name */
         case 2: /* dNSName */
         case 6: /* uniformResourceIdentifier */
-            bytesNeeded += (dataLen + 1) * sizeof(WCHAR);
+            if (memchr(pbEncoded + 1 + lenBytes, 0, dataLen))
+            {
+                SetLastError(CRYPT_E_ASN1_RULE);
+                ret = FALSE;
+            }
+            else
+                bytesNeeded += (dataLen + 1) * sizeof(WCHAR);
             break;
         case 4: /* directoryName */
         case 7: /* iPAddress */
diff --git a/dlls/crypt32/tests/encode.c b/dlls/crypt32/tests/encode.c
index 09402de..a46022b 100644
--- a/dlls/crypt32/tests/encode.c
+++ b/dlls/crypt32/tests/encode.c
@@ -1691,7 +1691,6 @@ static void test_decodeAltName(DWORD dwEncoding)
     /* Fails on WinXP with CRYPT_E_ASN1_RULE.  I'm not too concerned about the
      * particular failure, just that it doesn't decode.
      */
-    todo_wine
     ok(!ret, "expected failure\n");
     /* An embedded bell character is allowed, however. */
     ret = pCryptDecodeObjectEx(dwEncoding, X509_ALTERNATE_NAME,
@@ -1715,7 +1714,6 @@ static void test_decodeAltName(DWORD dwEncoding)
     /* Again, fails on WinXP with CRYPT_E_ASN1_RULE.  I'm not too concerned
      * about the particular failure, just that it doesn't decode.
      */
-    todo_wine
     ok(!ret, "expected failure\n");
 }