fix for CVE-2013-4296