backport fix for CVE-2014-0130 (directory traversal)

Backporting a patch.

PTAL

/to: @jeffyip