backport relevant security fixes from openssl 1.0.1i
tested by bcook jsg