Good find! But I believe the fix, although not bad (despite me not liking the `strlen()` use here, but that hardly matters) is not nearly enough. This function is also *terrible* with non-ASCII handling, to the point where it does more harm than good.
I propose an alternate (yet a bit over-the-top) fix in #3846.