CVE-2020-28013: Heap buffer overflow in parse_fix_phrase()