Fix TOCTOU race condition

Separately checking the state of a file before operating on it may allow
an attacker to modify the file between the two operations. (CWE-367)
Fix by using fstat() instead of stat().

src/joystick/linux/SDL_sysjoystick.c

@@ -417,7 +417,13 @@ static void MaybeAddDevice(const char *path)
         return;
     }
 
-    if (stat(path, &sb) == -1) {
+    fd = open(path, O_RDONLY | O_CLOEXEC, 0);
+    if (fd < 0) {
+        return;
+    }
+
+    if (fstat(fd, &sb) == -1) {
+        close(fd);
         return;
     }
 
@@ -435,11 +441,6 @@ static void MaybeAddDevice(const char *path)
         }
     }
 
-    fd = open(path, O_RDONLY | O_CLOEXEC, 0);
-    if (fd < 0) {
-        goto done;
-    }
-
 #ifdef DEBUG_INPUT_EVENTS
     SDL_Log("Checking %s\n", path);
 #endif
@@ -507,9 +508,7 @@ static void MaybeAddDevice(const char *path)
     }
 
 done:
-    if (fd >= 0) {
-        close(fd);
-    }
+    close(fd);
     SDL_UnlockJoysticks();
 }