rsaenh: Check pad bytes for consistency when decrypting.

dlls/rsaenh/rsaenh.c

@@ -2127,8 +2127,20 @@ BOOL WINAPI RSAENH_CPDecrypt(HCRYPTPROV hProv, HCRYPTKEY hKey, HCRYPTHASH hHash,
         if (Final) {
             if (pbData[*pdwDataLen-1] &&
              pbData[*pdwDataLen-1] <= pCryptKey->dwBlockLen &&
-             pbData[*pdwDataLen-1] < *pdwDataLen)
-                *pdwDataLen -= pbData[*pdwDataLen-1];
+             pbData[*pdwDataLen-1] < *pdwDataLen) {
+                BOOL padOkay = TRUE;
+
+                /* check that every bad byte has the same value */
+                for (i = 1; padOkay && i < pbData[*pdwDataLen-1]; i++)
+                    if (pbData[*pdwDataLen - i - 1] != pbData[*pdwDataLen - 1])
+                        padOkay = FALSE;
+                if (padOkay)
+                    *pdwDataLen -= pbData[*pdwDataLen-1];
+                else {
+                    SetLastError(NTE_BAD_DATA);
+                    return FALSE;
+                }
+            }
             else {
                 SetLastError(NTE_BAD_DATA);
                 return FALSE;