From 43d3ba9336bc94937e6fae2365c6ffd30c34ffcf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim=20R=C3=BChsen?= <tim.ruehsen@gmx.de>
Date: Mon, 29 Jun 2026 18:57:54 +0200
Subject: [PATCH] * src/http.c (parse_content_range): Fix integer overflow

Reported-by: TristanInSec@gmail.com

Upstream commit (GitLab mirror):
https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf

--- wget-1.25.0/src/http.c
+++ wget-1.25.0/src/http.c
@@ -914,6 +914,7 @@ parse_content_range (const char *hdr, wg
                      wgint *last_byte_ptr, wgint *entity_length_ptr)
 {
   wgint num;
+  char *end;
 
   /* Ancient versions of Netscape proxy server, presumably predating
      rfc2068, sent out `Content-Range' without the "bytes"
@@ -932,27 +933,39 @@ return false;
     }
   if (!c_isdigit (*hdr))
     return false;
-  for (num = 0; c_isdigit (*hdr); hdr++)
-    num = 10 * num + (*hdr - '0');
-  if (*hdr != '-' || !c_isdigit (*(hdr + 1)))
+
+  errno = 0;
+  num = strtol(hdr, &end, 10);
+  if (errno == ERANGE)
+    return false;
+  hdr = end;
+
+  if (*hdr++ != '-' || !c_isdigit (*hdr))
     return false;
   *first_byte_ptr = num;
-  ++hdr;
-  for (num = 0; c_isdigit (*hdr); hdr++)
-    num = 10 * num + (*hdr - '0');
-  if (*hdr != '/')
+
+  errno = 0;
+  num = strtol(hdr, &end, 10);
+  if (errno == ERANGE)
+    return false;
+  hdr = end;
+
+  if (*hdr++ != '/')
     return false;
   *last_byte_ptr = num;
-  if (!(c_isdigit (*(hdr + 1)) || *(hdr + 1) == '*'))
+  if (!(c_isdigit (*hdr) || *hdr == '*'))
     return false;
   if (*last_byte_ptr < *first_byte_ptr)
     return false;
-  ++hdr;
   if (*hdr == '*')
     num = -1;
   else
-    for (num = 0; c_isdigit (*hdr); hdr++)
-      num = 10 * num + (*hdr - '0');
+    {
+      errno = 0;
+      num = strtol(hdr, NULL, 10);
+      if (errno == ERANGE)
+        return false;
+    }
   *entity_length_ptr = num;
   if ((*entity_length_ptr <= *last_byte_ptr) && *entity_length_ptr != -1)
     return false;