fix for CVE-2013-4401