libc/lib_remove: fix TOCTOU race condition

Separately checking the state of a file before operating on it may allow
an attacker to modify the file between the two operations.

Reference:
  CWE-367
  https://github.com/bminor/glibc/blob/4290aed05135ae4c0272006442d147f2155e70d7/sysdeps/posix/remove.c#L29-L41

Signed-off-by: Mingjie Shen <shen497@purdue.edu>

libs/libc/stdio/lib_remove.c

@@ -51,25 +51,18 @@
 
 int remove(FAR const char *path)
 {
-  struct stat buf;
-  int ret;
+  /* First try to unlink since this is
+   * more frequently the necessary action.
+   */
 
-  /* Check the kind of object pointed by path */
-
-  ret = stat(path, &buf);
-  if (ret != 0)
+  if (unlink(path) != 0  /* If it is indeed a directory...  */
+      && (errno != EPERM /* ...try to remove it.  */
+          || rmdir(path) != 0))
     {
-      return ret;
+      /* Cannot remove the object for whatever reason. */
+
+      return -1;
     }
 
-  /* Act according to the kind of object */
-
-  if (S_ISDIR(buf.st_mode))
-    {
-      return rmdir(path);
-    }
-  else
-    {
-      return unlink(path);
-    }
+  return 0;
 }