brute-force version of strstr