fix for DoS vulnerability noted by Kevin S. Ho