Sorry we didn't get to this sooner. We're only taking security fixes for 1.0.1 now. Please open a new ticket if this is still an issue with current releases. fixed in master and perhaps 1.0.2 -- Rich Salz, OpenSSL dev team; rsalz at openssl.org