Robert Buchholz on oss-security (as for >=2.85)), checked by myself by code inspection on 2.86 and 2.87. Commit OK by beefy@