CVE-2020-28016: Heap out-of-bounds write in parse_fix_phrase()