Backport the fix for CVE-2019-12816 from 1.7.4 to 1.6.x. Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>