Sorry we didn't get to this sooner. We're only taking security fixes for 1.0.1 now. Please open a new ticket if this is still an issue with current releases. Also, fixed in master (and maybe 1.0.2) -- Rich Salz, OpenSSL dev team; rsalz at openssl.org