From 024ece50e8a42b62800f899343b8330b5d831e61 Mon Sep 17 00:00:00 2001
From: Piotr Caban <piotr@codeweavers.com>
Date: Mon, 26 Aug 2013 13:29:27 +0200
Subject: [PATCH] msvcrt: Fix parameter validation in _stat64 function.

---
 dlls/msvcrt/file.c       |  6 ++++--
 dlls/msvcrt/tests/file.c | 10 ++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/dlls/msvcrt/file.c b/dlls/msvcrt/file.c
index 0054222ff96..1594c335ab7 100644
--- a/dlls/msvcrt/file.c
+++ b/dlls/msvcrt/file.c
@@ -2684,7 +2684,8 @@ int CDECL MSVCRT_stat64(const char* path, struct MSVCRT__stat64 * buf)
   while (plen && path[plen-1]==' ')
     plen--;
 
-  if (plen && (path[plen-1]=='\\' || path[plen-1]=='/'))
+  if (plen && (plen<2 || path[plen-2]!=':') &&
+          (path[plen-1]==':' || path[plen-1]=='\\' || path[plen-1]=='/'))
   {
     *MSVCRT__errno() = MSVCRT_ENOENT;
     return -1;
@@ -2784,7 +2785,8 @@ int CDECL MSVCRT__wstat64(const MSVCRT_wchar_t* path, struct MSVCRT__stat64 * bu
   while (plen && path[plen-1]==' ')
     plen--;
 
-  if(plen && (path[plen-1]=='\\' || path[plen-1]=='/'))
+  if(plen && (plen<2 || path[plen-2]!=':') &&
+          (path[plen-1]==':' || path[plen-1]=='\\' || path[plen-1]=='/'))
   {
     *MSVCRT__errno() = MSVCRT_ENOENT;
     return -1;
diff --git a/dlls/msvcrt/tests/file.c b/dlls/msvcrt/tests/file.c
index 7a3253a0cb0..2d2399a664d 100644
--- a/dlls/msvcrt/tests/file.c
+++ b/dlls/msvcrt/tests/file.c
@@ -1907,6 +1907,16 @@ static void test_stat(void)
     }
     else
         skip("mkdir failed with errno %d\n", errno);
+
+    errno = 0xdeadbeef;
+    ret = stat("c:", &buf);
+    ok(ret == -1, "stat returned %d\n", ret);
+    ok(errno == ENOENT, "errno = %d\n", errno);
+
+    ret = stat("c:/", &buf);
+    ok(!ret, "stat returned %d\n", ret);
+    ok(buf.st_dev == 2, "st_dev = %d\n", buf.st_dev);
+    ok(buf.st_rdev == 2, "st_rdev = %d\n", buf.st_rdev);
 }
 
 static const char* pipe_string="Hello world";