Heap overflow in wget HTML extension appending

Wget's HTML/CSS filename extension helper reallocates a local filename buffer using a fixed arithmetic margin and then appends an extension with strcpy()/sprintf(). If the original filename is near the boundary of that margin, the final NUL byte and/or numeric suffix writes can overrun the allocation, leading to heap corruption during redirect/content-type handling.