avoid implicit int -> size_t cast