this affects 1.24.5, but versions newer than 1.20 don't seem to be in the dropdown?

reproducible by using -r on a url that wget treats as html and has a size which will become negative when casted from long to int (e.g. will crash with a 3gb file, but not a 5gb one). it will segfault reading out of bounds on the mapped file. seems this is because of map_html_tags size argument.

(while of course a 2+ gb html file is rare and i don't see how this would be exploitable, a misconfigured server can result in binary files being parsed as html, which is how i originally ran into this bug)

hope that helps!