Thanks to Sunglin and HuanGMz of the Knownsec 404 security team and pangzi of pwnzen (cherry picked from commit 5592cb2e10da42592af98f5533d2e42181e86821)