rsaenh: Check pad bytes for consistency when decrypting.

dlls/rsaenh/rsaenh.c

@@ -2127,13 +2127,25 @@ BOOL WINAPI RSAENH_CPDecrypt(HCRYPTPROV hProv, HCRYPTKEY hKey, HCRYPTHASH hHash,
         if (Final) {
             if (pbData[*pdwDataLen-1] &&
              pbData[*pdwDataLen-1] <= pCryptKey->dwBlockLen &&
-             pbData[*pdwDataLen-1] < *pdwDataLen)
+             pbData[*pdwDataLen-1] < *pdwDataLen) {
+                BOOL padOkay = TRUE;
+
+                /* check that every bad byte has the same value */
+                for (i = 1; padOkay && i < pbData[*pdwDataLen-1]; i++)
+                    if (pbData[*pdwDataLen - i - 1] != pbData[*pdwDataLen - 1])
+                        padOkay = FALSE;
+                if (padOkay)
                     *pdwDataLen -= pbData[*pdwDataLen-1];
                 else {
                     SetLastError(NTE_BAD_DATA);
                     return FALSE;
                 }
             }
+            else {
+                SetLastError(NTE_BAD_DATA);
+                return FALSE;
+            }
+        }
 
     } else if (GET_ALG_TYPE(pCryptKey->aiAlgid) == ALG_TYPE_STREAM) {
         encrypt_stream_impl(pCryptKey->aiAlgid, &pCryptKey->context, pbData, *pdwDataLen);