validation: don't use uninitialized data