This fixes CVE-2016-1283, which allows remote attackers to cause
a denial of service (heap-based buffer overflow) or possibly
have unspecified other impact via a crafted regular expression.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1283
