array length * sz could overflow int size, so we store sz in a size_t  to force a cast to size_t