upstream fixes for CVE-2013-4231, CVE-2013-4232