Merged idunham's CVE-2013-4396 fix.