sync with upstream (handles CVE-2013-0131).
sync with upstream.