REDHAT-BUG-2569520: High severity BusyBox BusyBox wget vulnerability

A flaw was found in BusyBox wget. When resuming an FTP download, prepareftpsession() in networking/wget.c subtracts the resume offset from the file size reported by the server without validating that the offset does not exceed it, allowing the contentlen variable to become negative. In retrievefiledata(), a (int) cast lets a negative contentlen whose low 32 bits are positive pass the length check, and the truncated value is then used as the fread() size into the heap-allocated wget buffer. A malicious FTP server, or an on-path attacker when plain FTP is used, can trigger this when wget resumes a download whose offset is more than 2 GiB larger than the reported file size, overwriting heap memory beyond the buffer with server-controlled data, which may lead to a crash or potentially code execution.