secur32: We can't read more than expected_size - 5 in schan_DecryptMessage().

dlls/secur32/schannel.c

@@ -1067,7 +1067,7 @@ static SECURITY_STATUS SEC_ENTRY schan_DecryptMessage(PCtxtHandle context_handle
         return SEC_E_INCOMPLETE_MESSAGE;
     }
 
-    data_size = buffer->cbBuffer;
+    data_size = expected_size - 5;
     data = HeapAlloc(GetProcessHeap(), 0, data_size);
 
     transport.ctx = ctx;