CVE-2020-28026: Line truncation and injection in spool_read_header()