one-pass... according to brighten's comment