Comment by alberich

well, you're supposed to validate user input before passing it to the function.

I'm not sure this can be considered a bug.