Fix another buffer overrun bug (which is not really a bug because

s->s2->escape is never set when sending data because the escape
bit is just reserved for future use in SSL 2.0)