Backport CVE-2013-4396 fix.