Fix CVE-2018-1000097:

https://security-tracker.debian.org/tracker/CVE-2018-1000097
https://nvd.nist.gov/vuln/detail/CVE-2018-1000097

Patch taken from upstream bug report:
https://lists.gnu.org/archive/html/bug-gnu-utils/2018-02/msg00005.html

diff --git a/src/unshar.c b/src/unshar.c
index 80bc3a9..0fc3773 100644
--- a/src/unshar.c
+++ b/src/unshar.c
@@ -240,7 +240,7 @@ find_archive (char const * name, FILE * file, off_t start)
       off_t position = ftello (file);
 
       /* Read next line, fail if no more and no previous process.  */
-      if (!fgets (rw_buffer, BUFSIZ, file))
+      if (!fgets (rw_buffer, rw_base_size, file))
 	{
 	  if (!start)
 	    error (0, 0, _("Found no shell commands in %s"), name);
alue='koszko' selected='selected'>koszko</option>
<option value='koszko-scripts'>koszko-scripts</option>
</select> <input type='submit' value='switch'/></form></td></tr>
<tr><td class='sub'>Wojtek's customized Guix</td><td class='sub right'></td></tr></table>
<table class='tabs'><tr><td>
<a href='/guix/about/'>about</a><a href='/guix/'>summary</a><a href='/guix/refs/?id=8882ec71ddec3ff815613883f360f4c01a23983b'>refs</a><a class='active' href='/guix/log/tests/guix-shell.sh'>log</a><a href='/guix/tree/tests/guix-shell.sh?id=8882ec71ddec3ff815613883f360f4c01a23983b'>tree</a><a href='/guix/commit/tests/guix-shell.sh?id=8882ec71ddec3ff815613883f360f4c01a23983b'>commit</a><a href='/guix/diff/tests/guix-shell.sh?id=8882ec71ddec3ff815613883f360f4c01a23983b'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/tests/guix-shell.sh'>
<input type='hidden' name='id' value='8882ec71ddec3ff815613883f360f4c01a23983b'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=8882ec71ddec3ff815613883f360f4c01a23983b'>root</a>/<a href='/guix/log/tests?id=8882ec71ddec3ff815613883f360f4c01a23983b'>tests</a>/<a href='/guix/log/tests/guix-shell.sh?id=8882ec71ddec3ff815613883f360f4c01a23983b'>guix-shell.sh</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/guix-shell.sh?id=8882ec71ddec3ff815613883f360f4c01a23983b&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2023-08-25 14:23:43 +0200'>2023-08-25</span></td><td><a href='/guix/commit/tests/guix-shell.sh?id=519c3b7803c48bfbb42053ab8edf7e052071be5f'>tests: guix-shell: Use bash instead of user's $SHELL.</a><span class='msg-avail'>...<span class='msg-tooltip'>* tests/guix-shell.sh (fd_list): Use bash instead of $SHELL.  Some other
shells have trouble not opening too many fds.  Also, bash in an implicit input
of guix, so it should always be available.
</span></span></td><td>Josselin Poiret</td></tr>
<tr><td><span title='2023-04-21 16:16:38 +0200'>2023-04-21</span></td><td><a href='/guix/commit/tests/guix-shell.sh?id=37dd69b44511dc73eb04bdebe8d82c9a0386338e'>tests: Fix checks for expected failures.</a><span class='msg-avail'>...<span class='msg-tooltip'>Addresses &lt;https://issues.guix.gnu.org/62406&gt;.

With 'set -e', a return status inverted with '!' does not cause the shell to
exit immediately.  Instead use '&amp;&amp; false' to indicate an expected failure.

* tests/guix-archive.sh, tests/guix-build-branch.sh, tests/guix-build.sh,
tests/guix-daemon.sh, tests/guix-download.sh,
tests/guix-environment-container.sh, tests/guix-environment.sh,
tests/guix-gc.sh, tests/guix-git-authenticate.sh, tests/guix-graph.sh,
tests/guix-hash.sh, tests/guix-home.sh, tests/guix-pack-relocatable.sh,
tests/guix-pack.sh, tests/guix-package-aliases.sh, tests/guix-package-net.sh,
tests/guix-package.sh, tests/guix-refresh.sh, tests/guix-shell.sh,
tests/guix-style.sh, tests/guix-system.sh: Replace uses of '! ...' with
'... &amp;&amp; false' or `test ! ...` as appropriate.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Eric Bavier</td></tr>
<tr><td><span title='2022-11-15 14:15:11 -0500'>2022-11-15</span></td><td><a href='/guix/commit/tests/guix-shell.sh?id=b31ea797edb4f6e8c14e8fe790da1319607c5cb1'>guix: shell: Add '--symlink' option.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/scripts/pack.scm (%options): Extract symlink parsing logic to...
(symlink-spec-option-parser): ... here.
(self-contained-tarball/builder): Add a comment mentioning why a relative file
name is used for the link target.
* guix/scripts/environment.scm (show-environment-options-help): Document new
--symlink option.
(%default-options): Add default value for symlinks.
(%options): Register new symlink option.
(launch-environment/container): Add #:symlinks argument and extend doc, and
create symlinks using evaluate-populate-directive.
(guix-environment*): Pass symlinks arguments to launch-environment/container.
* doc/guix.texi (Invoking guix shell): Document it.
* tests/guix-shell.sh: Add a --symlink (negative) test.
* tests/guix-environment-container.sh: Add tests.
</span></span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2022-09-04 23:10:10 +0200'>2022-09-04</span></td><td><a href='/guix/commit/tests/guix-shell.sh?id=7a2acbdc5a9eed7c5dc3fe947f54fbebd89c0892'>store: Open daemon connections with SOCK_CLOEXEC.</a><span class='msg-avail'>...<span class='msg-tooltip'>Previously, 'guix shell' for example would leak the socket that's
connected to the daemon.

* guix/store.scm (open-unix-domain-socket, open-inet-socket): Pass
SOCK_CLOEXEC to 'socket'.
* tests/guix-shell.sh: Add test.
</span></span></td><td>Ludovic Courtès</td></tr>