- Stephen Collyer and Tor Arntsen helped identify a flaw in the range code

which output the range using a signed variable where it should rather use
  unsigned.

lib/url.c

@@ -3118,7 +3118,7 @@ static CURLcode setup_range(struct SessionHandle *data)
       free(s->range);
 
     if(s->resume_from)
-      s->range = aprintf("%" FORMAT_OFF_T "-", s->resume_from);
+      s->range = aprintf("%" FORMAT_OFF_TU "-", s->resume_from);
     else
       s->range = strdup(data->set.str[STRING_SET_RANGE]);