Sensitive information disclosure with malicious netrc file

libcurl at commit [879b6075a1132c137920060ed262b3f5a58c18c2](https://github.com/curl/curl/tree/879b6075a1132c137920060ed262b3f5a58c18c2) contains a vulnerability where it can be coerced into reading over the boundaries of a heap-chunk and sending the resulting data over the network to an attacker. …

    const char *tok = netrcbuffer;
    while(tok && !done) {
      const char *tok_end;
    
      // [...]
      
      tok_end = tok;
      if(!quoted) {
        size_t len = 0;
        CURLcode result;
        while(*tok_end > ' ') {
          tok_end++;
          len++;
        } …