fix for CVE-2013-6458, 1/4