Commit 12a903f257 for openssl.org

commit 12a903f25738f4c4398f8d30445acd70c55025fa
Author: Nicky Mouha <nicky@mouha.be>
Date:   Sun Nov 8 18:39:31 2026 -0500

    fuzz/test-corpus.c: fix time-of-check time-of-use filesystem race condition

    Open the file first and then call fstat() the descriptor, rather than
    call stat() and then opening it;  this avoid a potential
    time-of-check/time-of-use race.

    Fixes: 90d28f051942 "Run the fuzzing corpora as tests."
    Reviewed-by: Paul Dale <paul.dale@oracle.com>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Tue Nov 10 13:45:35 2026
    Merged-from: https://github.com/openssl/openssl/pull/33607

diff --git a/fuzz/test-corpus.c b/fuzz/test-corpus.c
index 5decce1f8d..e5d47338c3 100644
--- a/fuzz/test-corpus.c
+++ b/fuzz/test-corpus.c
@@ -22,6 +22,7 @@
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include "fuzzer.h"
+#include "internal/e_os.h"
 #include "internal/o_dir.h"
 #include "mfail.h"

@@ -92,14 +93,16 @@ static void testfile(const char *pathname, int file_idx)
     unsigned char *buf;
     size_t s;

-    if (stat(pathname, &st) < 0 || !S_ISREG(st.st_mode))
+    f = fopen(pathname, "rb");
+    if (f == NULL)
+        return;
+    if (fstat(fileno(f), &st) < 0 || !S_ISREG(st.st_mode)) {
+        fclose(f);
         return;
+    }

     fprintf(stderr, "# CORPUS_FILE file_idx=%d size=%lld path=%s\n",
         file_idx, (long long)st.st_size, pathname);
-    f = fopen(pathname, "rb");
-    if (f == NULL)
-        return;
     buf = malloc(st.st_size);
     if (buf == NULL) {
         fclose(f);