Properly sanitize mv parameters (CVE-2014-8990)

This pulls in the improved patch by Ángel González <angel@16bits.net>, which is far more elegant than my initial approach and fixes additional problems (such as lua 5.2 compatibility).