This bug was in fact discovered by a Google employee: https://www.openssl.org/news/secadv_20140407.txt