Fix CVE 2013-4495. Note: this patch has been verified as fixing this security hole but has not received other regression testing. Could not cherry-pick as 2.5 and 4.1 are very different.