@qiangxue I think you are probably right on both points.

The main benefit for using a method is to provide a vehicle for documentation of a rather odd thing. That probably doesn't justify the cost of a method.

`strlen()` is ok if we assume that the hash table is unadulterated and the attacker is using our app's SW to test it. I think this is a fair assumption. Does anyone disagree with that?

Once the rewritten patch is nearly ready, it might be good get a security code review. Anyone know where to go for that?