Sorry we didn't get to this sooner. We're only taking security fixes for 1.0.1 now. Please open a new ticket if this is still an issue with current releases. Also fixed in master, and probably 1.0.2 -- Rich Salz, OpenSSL dev team; rsalz at openssl.org