fix for CVE-2013-7336