Fix CVE-2018-1000097:

https://security-tracker.debian.org/tracker/CVE-2018-1000097
https://nvd.nist.gov/vuln/detail/CVE-2018-1000097

Patch taken from upstream bug report:
https://lists.gnu.org/archive/html/bug-gnu-utils/2018-02/msg00005.html

diff --git a/src/unshar.c b/src/unshar.c
index 80bc3a9..0fc3773 100644
--- a/src/unshar.c
+++ b/src/unshar.c
@@ -240,7 +240,7 @@ find_archive (char const * name, FILE * file, off_t start)
       off_t position = ftello (file);
 
       /* Read next line, fail if no more and no previous process.  */
-      if (!fgets (rw_buffer, BUFSIZ, file))
+      if (!fgets (rw_buffer, rw_base_size, file))
 	{
 	  if (!start)
 	    error (0, 0, _("Found no shell commands in %s"), name);
alue='koszko' selected='selected'>koszko</option>
<option value='koszko-scripts'>koszko-scripts</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>Wojtek's customized Guix</td><td class='sub right'></td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>refs</a><a class='active' href='/guix/log/nix/libutil/util.cc'>log</a><a href='/guix/tree/nix/libutil/util.cc?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>tree</a><a href='/guix/commit/nix/libutil/util.cc?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>commit</a><a href='/guix/diff/nix/libutil/util.cc?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/nix/libutil/util.cc'>
<input type='hidden' name='id' value='cd6c61f8c8a411a53047714256eacde63635f9a2'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>root</a>/<a href='/guix/log/nix?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>nix</a>/<a href='/guix/log/nix/libutil?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>libutil</a>/<a href='/guix/log/nix/libutil/util.cc?id=cd6c61f8c8a411a53047714256eacde63635f9a2'>util.cc</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/nix/libutil/util.cc?id=cd6c61f8c8a411a53047714256eacde63635f9a2&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-12-08 22:30:07 +0100'>2020-12-08</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=2e308238ad09e9527f9b8c3ec4a90b6b05a93367'>daemon: 'Agent' constructor takes a list of environment variables.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libutil/util.hh (struct Agent)[Agent]: Add 'env' parameter.
* nix/libutil/util.cc (Agent::Agent): Honor it.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-09-14 15:42:55 +0200'>2020-09-14</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=ee9dff34f9317509cb2b833d07a0d5e01a36a4ae'>daemon: Move 'Agent' to libutil.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libstore/build.cc (DerivationGoal::tryBuildHook): Add "offload" to
'args' and pass settings.guixProgram as the first argument to
Agent::Agent.
(pathNullDevice, commonChildInit, Agent, Agent::Agent)
(Agent::~Agent): Move to...
* nix/libutil/util.cc: ... here.
* nix/libutil/util.hh (struct Agent, commonChildInit): New
declarations.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-03-26 12:59:33 +0100'>2020-03-26</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=d0ed201e0a9736c64cb3c59d8c987c79fd6046d6'>daemon: Avoid kill -1 bug on the Hurd.</a><span class='msg-avail'>...<span class='msg-tooltip'>This allows for native builds on the Hurd, doing

    sudo ./pre-inst-env guix-daemon --disable-chroot --build-users-group=guixbuild &amp;
    ./pre-inst-env guix build hello

* nix/libutil/util.cc (killUser)[__GNU__]: Avoid kill -1 bug; kill only
current process and ignore SIGKILL status in parent.

Co-authored-by: Jan Nieuwenhuizen &lt;janneke@gnu.org&gt;
</span></span></td><td>Manolis Ragkousis</td></tr>
<tr><td><span title='2020-01-12 00:19:09 +0100'>2020-01-12</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=7033c7692ccbbbad8f7b9952015de071a5588e87'>daemon: Account for deleted store files when deduplication is on.</a><span class='msg-avail'>...<span class='msg-tooltip'>Previously, a store item that is a regular file would not be accounted
for in the 'bytesFreed' value computed by 'deletePath' because its
'st_nlink' count would always be &gt;= 2.  This commit fixes that.

* nix/libutil/util.hh (deletePath): Add optional 'linkThreshold' argument.
* nix/libutil/util.cc (_deletePath): Add 'linkThreshold' argument and
honor it.  Pass it down in recursive call.
(deletePath): Add 'linkThreshold' and honor it.
* nix/libstore/gc.cc (LocalStore::deleteGarbage): Pass 'linkThreshold'
argument to 'deletePath', with a value of 2 when PATH is a store item
and deduplication is on.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-11-29 15:54:20 +0100'>2019-11-29</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=b6b014bf42f68fcb71d37204328babb81e0e0855'>daemon: 'pathExists' uses 'statx' when available.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libutil/util.cc (pathExists) [HAVE_STATX]: New code.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-11-27 00:03:03 +0100'>2019-11-27</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=fbecb5cddb2d36cc1a29dac3751b017fa531383c'>daemon: 'deletePath' uses 'statx' when available.</a><span class='msg-avail'>...<span class='msg-tooltip'>* nix/libutil/util.cc (_deletePath) [HAVE_STATX]: Use 'statx'.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2019-08-30 01:33:45 +0200'>2019-08-30</span></td><td><a href='/guix/commit/nix/libutil/util.cc?id=546a709f202024c8a5173ad372a87ddc1c284c63'>daemon: Don't reply on 'st_blocks'.</a><span class='msg-avail'>...<span class='msg-tooltip'>Ported by Ludovic Courtès &lt;ludo@gnu.org&gt;
from &lt;https://github.com/NixOS/nix/commit/a2c4fcd5e9782dc8d2998773380c7171ee53b813&gt;.

* nix/libstore/gc.cc (LocalStore::removeUnusedLinks): Use 'st.st_size'
instead of 'st.st_blocks * 512'.
* nix/libutil/util.cc (_deletePath): Likewise.
</span></span></td><td>Eelco Dolstra</td></tr>