CVE-2021-36159: libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric...

The vulnerability description pinpoints an out-of-bounds read in the FTP passive mode implementation due to mishandling of numeric strings with strtol. The provided GitLab issue #10749 contains a diff for ftp.c that shows the exact code change to fix this. The change is within a loop responsible for parsing the address and port from the FTP server's passive mode response. The surrounding code in the diff, and the logic itself, clearly indicate this is part of a function handling FTP passive mode, identified as fetch_ftp_passive_mode. The patch adds a check for premature null termination after strtol has potentially advanced the pointer, thus preventing the out-of-bounds read. Other patched functions in fetch.c and http.c address similar numeric parsing issues but are not the direct cause of the described FTP passive mode vulnerability.