security fix in lex.c