Bstring relies on undefined behavior for security. Don't use it if you care about security.