The use in s3_srvr.c doesn't care (it doesn't even have to be in bounds), but it's good to have the value be initialized and not a function of the input. (The old uninitialized case wasn't hit in s3_srvr.c because of the earlier bounds check.) Change-Id: Ib6b418b3c140aa564f8a46da3d34bb2b69f06195 Reviewed-on: https://boringssl-review.googlesource.com/2845 Reviewed-by: Adam Langley <agl@google.com>