merge fix for CVE-2014-3510
basically a missing s->hit check
ok guenther