fix for CVE-2013-4291