dependency: avoid exploitable (!) use of uninitialized length values introduced in commit 0ab3b32255