backport fix for CVE-2014-0130 (directory traversal)

PTAL

@jeffyip