From 37a40fcb450153f69537c7cbc2a7a4fb0b6f7826 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Mon, 29 Jun 2026 18:32:02 +0200
Subject: [PATCH] * src/metalink.c (clean_metalink_string): Fix buffer
 underflow

Reported-by: TristanInSec@gmail.com

Upstream commit (GitLab mirror):
https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826

--- wget-1.25.0/src/metalink.c
+++ wget-1.25.0/src/metalink.c
@@ -1041,7 +1041,6 @@ void
 clean_metalink_string (char **str)
 {
   int c;
-  size_t len;
   char *new, *beg, *end;
 
   if (!str || !*str)
@@ -1049,7 +1048,7 @@ return;
 
   beg = *str;
 
-  while ((c = *beg) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
+  while (isspace(*beg))
     beg++;
 
   end = beg;
@@ -1062,12 +1061,10 @@ end++;
   /* If we are at the end of the string, search the first legit
      character going backward.  */
   if (*end == '\0')
-    while ((c = *(end - 1)) && (c == '\n' || c == '\r' || c == '\t' || c == ' '))
+    while (end > beg && !isspace(*(end - 1)))
       end--;
 
-  len = end - beg;
-
-  new = xmemdup0 (beg, len);
+  new = xmemdup0 (beg, end - beg);
   xfree (*str);
   *str = new;
 }