Backport fix for CVE-2011-2202

Summary: Backported fix for file path injection. The code tries to strip
all path components from the filename, ( e.g. /abc/def/foobar -> foobar)
but filnames could include a single (back)slash in the beginning, which
the code wouldn't strip due to an off-by-one error. (e.g. /vmlinuz ->
/vmlinuz)

Reviewed By: @bertmaher

Differential Revision: D1303154