Also guard the in-memory 206-resume buffer size against a hostile Content-Length

An adversarial review of the crange hardening surfaced a third overflow in the
same 206-resume path: the in-memory branch sizes its buffer as
`resume + 1 + totalsize`, and `totalsize` (Content-Length) is attacker-
controlled and unclamped. A resume answered with a 206 that lies `text/html`
(so the resume buffers in memory) and a matching INT64_MAX Content-Length drives
the add to INT64_MAX + 1 — a signed-overflow UBSan abort, reachable from a single
hostile response. Reject a Content-Length that would overflow the size, drop the
partial, and refetch from scratch (the retry restarts clean).

Test 48_local-crange-memresume drives it end to end (UBSan aborts pre-fix at
`alloc_mem += totalsize`); 01_engine-crange gains a `-5-10/20` case exercising
the clamp's independent per-field negativity.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

src/htsback.c

@@ -3908,11 +3908,10 @@ void back_wait(struct_back * sback, httrackp * opt, cache_back * cache,
                           if (fp) {
                             LLint alloc_mem = resume + 1;
 
-                            // Bound the in-memory buffer to a 32-bit size (real
-                            // in-RAM resources are far smaller); a hostile
-                            // Content-Length that would overflow the add or the
-                            // (size_t) cast is dropped and refetched instead.
-                            if (back[i].r.totalsize > INT32_MAX - alloc_mem) {
+                            // Reject a hostile Content-Length that would
+                            // overflow the buffer size: drop the partial and
+                            // refetch.
+                            if (back[i].r.totalsize > INT64_MAX - alloc_mem) {
                               url_savename_refname_remove(opt, back[i].url_adr,
                                                           back[i].url_fil);
                               UNLINK(back[i].url_sav);