CVE-2017-1000101: cURL: URL globbing out of bounds read

**FYI, this security advisory will not be released until 9 August 2017:**

curl supports "globbing" of URLs, in which a user can pass a numerical range
to have the tool iterate over those numbers to do a sequence of transfers.

In the globbing function that parses the numerical range, there was an
omission that made curl read a byte beyond the end of the URL if given a …