CVE-2020-28022: Heap out-of-bounds read and write in extract_option()