If your conclusion that
the patch was bad is based on the fact that CVE-2014-7169 still exists, I think that's an unfair assessment.
The patch appears to have been a adequate fix to the bug that was discovered. The fact there is a second bug with a similar but not-identical attack vector, is a reflection on the robustness/correctness of the original code more than it is a reflection on the quality of the patch.
