fix for security exploit described in bug #812690 reported by Neal Krawetz