Piotr Caban : msvcrt: Fix parameter validation in _stat64 function.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: 024ece50e8a42b62800f899343b8330b5d831e61
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=024ece50e8a42b62800f899343b8330b5d831e61

Author: Piotr Caban <piotr at codeweavers.com>
Date:   Mon Aug 26 13:29:27 2013 +0200

msvcrt: Fix parameter validation in _stat64 function.

---

 dlls/msvcrt/file.c       |    6 ++++--
 dlls/msvcrt/tests/file.c |   10 ++++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/dlls/msvcrt/file.c b/dlls/msvcrt/file.c
index 0054222..1594c33 100644
--- a/dlls/msvcrt/file.c
+++ b/dlls/msvcrt/file.c
@@ -2684,7 +2684,8 @@ int CDECL MSVCRT_stat64(const char* path, struct MSVCRT__stat64 * buf)
   while (plen && path[plen-1]==' ')
     plen--;
 
-  if (plen && (path[plen-1]=='\\' || path[plen-1]=='/'))
+  if (plen && (plen<2 || path[plen-2]!=':') &&
+          (path[plen-1]==':' || path[plen-1]=='\\' || path[plen-1]=='/'))
   {
     *MSVCRT__errno() = MSVCRT_ENOENT;
     return -1;
@@ -2784,7 +2785,8 @@ int CDECL MSVCRT__wstat64(const MSVCRT_wchar_t* path, struct MSVCRT__stat64 * bu
   while (plen && path[plen-1]==' ')
     plen--;
 
-  if(plen && (path[plen-1]=='\\' || path[plen-1]=='/'))
+  if(plen && (plen<2 || path[plen-2]!=':') &&
+          (path[plen-1]==':' || path[plen-1]=='\\' || path[plen-1]=='/'))
   {
     *MSVCRT__errno() = MSVCRT_ENOENT;
     return -1;
diff --git a/dlls/msvcrt/tests/file.c b/dlls/msvcrt/tests/file.c
index 7a3253a..2d2399a 100644
--- a/dlls/msvcrt/tests/file.c
+++ b/dlls/msvcrt/tests/file.c
@@ -1907,6 +1907,16 @@ static void test_stat(void)
     }
     else
         skip("mkdir failed with errno %d\n", errno);
+
+    errno = 0xdeadbeef;
+    ret = stat("c:", &buf);
+    ok(ret == -1, "stat returned %d\n", ret);
+    ok(errno == ENOENT, "errno = %d\n", errno);
+
+    ret = stat("c:/", &buf);
+    ok(!ret, "stat returned %d\n", ret);
+    ok(buf.st_dev == 2, "st_dev = %d\n", buf.st_dev);
+    ok(buf.st_rdev == 2, "st_rdev = %d\n", buf.st_rdev);
 }
 
 static const char* pipe_string="Hello world";