u-a: Fix TOCTOU race when loading an alternative

This does not have any security implications, but it makes the code
more robust.

Warned-by: coverity

debian/changelog

@@ -11,6 +11,8 @@ dpkg (1.17.10) UNRELEASED; urgency=low
   * Test suite:
     - Improve C code coverage.
   * Fix non-security sensitive TOCTOU race in triggers database loading.
+  * Fix non-security sensitive TOCTOU race in update-alternative alternative
+    database loading.
 
   [ Updated manpages translations ]
   * German (Helge Kreutzmann).

utils/update-alternatives.c

@@ -1300,21 +1300,20 @@ alternative_load(struct alternative *a, enum altdb_flags flags)
 	xasprintf(&fn, "%s/%s", admdir, a->master_name);
 	ctx.filename = fn;
 
-	/* Verify the alternative exists */
-	if (stat(ctx.filename, &st) == -1) {
+	/* Open the alternative file. */
+	ctx.fh = fopen(ctx.filename, "r");
+	if (ctx.fh == NULL) {
 		if (errno == ENOENT)
 			return false;
-		else
-			syserr(_("cannot stat file '%s'"), ctx.filename);
-	}
-	if (st.st_size == 0) {
-		return false;
-	}
 
-	/* Open the database file */
-	ctx.fh = fopen(ctx.filename, "r");
-	if (ctx.fh == NULL)
 		syserr(_("unable to open file '%s'"), ctx.filename);
+	}
+
+	/* Verify the alternative is not empty. */
+	if (fstat(fileno(ctx.fh), &st) == -1)
+		syserr(_("cannot stat file '%s'"), ctx.filename);
+	if (st.st_size == 0)
+		return false;
 
 	/* Start parsing mandatory attributes (link+status) of the alternative */
 	alternative_reset(a);