CVE-2022-35260: .netrc parser out-of-bounds access

Summary: Curl expects the .netrc file to have space characters. So if there is no space character, it will do an out-of-bounds read and a 1-byte out-of-bounds write. This can happen multiple times depending on the state of the memory.

    while(!done && fgets(netrcbuffer, netrcbuffsize, file)) {
      char *tok;
      char *tok_end;
      bool quoted;
      if(state == MACDEF) {
        if((netrcbuffer[0] == '\n') || (netrcbuffer[0] == '\r'))
          state = NOTHING;
        else
          continue;
      }
      tok = …