lua5.3: backport CVE fix