CVE-2017-13090

The retr.c:fd_read_body() function is called when processing OK responses.
When the response is sent chunked in wget before 1.19.2, the chunk parser
uses strtol() to read each chunk’s length, but doesn’t check that the chunk
length is a non-negative number. The code then tries to read the chunk in
pieces of 8192 bytes by using the MIN() macro, but ends up passing the
negative chunk length to retr.c:fd_read(). As fd_read() takes an int
argument, the high 32 bits of the chunk length are discarded, leaving
fd_read() with a completely attacker controlled length argument. The
attacker can corrupt malloc metadata after the allocated buffer.