[security] fix CVE-2014-7824