I suppose it's safe to assume the input is correctly null-terminated.  And you're right, strnlen() is not available everywhere so I suppose we shouldn't introduce it.