busybox: backport fix for CVE-2021-28831