diff --git a/bitcoin/pubkey.c b/bitcoin/pubkey.c
index b93a1304a..9ff08e568 100644
--- a/bitcoin/pubkey.c
+++ b/bitcoin/pubkey.c
@@ -72,9 +72,9 @@ fail_free_secpctx:
 	return false;
 }
 	
-bool pubkey_from_hexstr(const char *derstr, struct pubkey *key)
+bool pubkey_from_hexstr(const char *derstr, size_t slen, struct pubkey *key)
 {
-	size_t slen = strlen(derstr), dlen;
+	size_t dlen;
 	unsigned char der[65];
 
 	dlen = hex_data_size(slen);
diff --git a/bitcoin/pubkey.h b/bitcoin/pubkey.h
index 2d9c5e7aa..53da04b49 100644
--- a/bitcoin/pubkey.h
+++ b/bitcoin/pubkey.h
@@ -15,7 +15,7 @@ struct pubkey {
 };
 
 /* Convert from hex string of DER (scriptPubKey from validateaddress) */
-bool pubkey_from_hexstr(const char *derstr, struct pubkey *key);
+bool pubkey_from_hexstr(const char *derstr, size_t derlen, struct pubkey *key);
 
 /* Pubkey from privkey */
 bool pubkey_from_privkey(const struct privkey *privkey,
diff --git a/test-cli/create-anchor-tx.c b/test-cli/create-anchor-tx.c
index 9a892106c..d38c7a705 100644
--- a/test-cli/create-anchor-tx.c
+++ b/test-cli/create-anchor-tx.c
@@ -142,7 +142,7 @@ int main(int argc, char *argv[])
 	if (change) {
 		struct pubkey change_key;
 
-		if (!pubkey_from_hexstr(argv[4], &change_key))
+		if (!pubkey_from_hexstr(argv[4], strlen(argv[4]), &change_key))
 			errx(1, "Invalid change key %s", argv[3]);
 
 		redeemscript = bitcoin_redeem_single(anchor, &change_key);
diff --git a/test-cli/create-commit-spend-tx.c b/test-cli/create-commit-spend-tx.c
index 79fbd56aa..9329cb8ce 100644
--- a/test-cli/create-commit-spend-tx.c
+++ b/test-cli/create-commit-spend-tx.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 	if (!testnet)
 		errx(1, "Private key '%s' not on testnet!", argv[5]);
 
-	if (!pubkey_from_hexstr(argv[6], &outpubkey))
+	if (!pubkey_from_hexstr(argv[6], strlen(argv[6]), &outpubkey))
 		errx(1, "Invalid bitcoin pubkey '%s'", argv[6]);
 
 	/* Get pubkeys */
diff --git a/test-cli/create-htlc-spend-tx.c b/test-cli/create-htlc-spend-tx.c
index 8c78adca2..571f3a046 100644
--- a/test-cli/create-htlc-spend-tx.c
+++ b/test-cli/create-htlc-spend-tx.c
@@ -93,7 +93,7 @@ int main(int argc, char *argv[])
 	if (!testnet)
 		errx(1, "Private key '%s' not on testnet!", argv[6]);
 
-	if (!pubkey_from_hexstr(argv[7], &outpubkey))
+	if (!pubkey_from_hexstr(argv[7], strlen(argv[7]), &outpubkey))
 		errx(1, "Invalid commit key '%s'", argv[7]);
 
 	/* Get pubkeys */
diff --git a/test-cli/create-steal-tx.c b/test-cli/create-steal-tx.c
index 6d9088b68..7b0163de0 100644
--- a/test-cli/create-steal-tx.c
+++ b/test-cli/create-steal-tx.c
@@ -73,7 +73,7 @@ int main(int argc, char *argv[])
 	if (!proto_to_rel_locktime(o1->delay, &locktime))
 		errx(1, "Invalid locktime in o2");
 
-	if (!pubkey_from_hexstr(argv[6], &outpubkey))
+	if (!pubkey_from_hexstr(argv[6], strlen(argv[6]), &outpubkey))
 		errx(1, "Invalid bitcoin pubkey '%s'", argv[6]);
 
 	/* Get pubkeys */
diff --git a/test-cli/open-channel.c b/test-cli/open-channel.c
index 54eb76f19..35071c3ae 100644
--- a/test-cli/open-channel.c
+++ b/test-cli/open-channel.c
@@ -69,10 +69,10 @@ int main(int argc, char *argv[])
 	if (!hex_decode(argv[1], strlen(argv[1]), &seed, sizeof(seed)))
 		errx(1, "Invalid seed '%s' - need 256 hex bits", argv[1]);
 
-	if (!pubkey_from_hexstr(argv[2], &commitkey))
+	if (!pubkey_from_hexstr(argv[2], strlen(argv[2]), &commitkey))
 		errx(1, "Invalid commit key '%s'", argv[2]);
 
-	if (!pubkey_from_hexstr(argv[3], &finalkey))
+	if (!pubkey_from_hexstr(argv[3], strlen(argv[3]), &finalkey))
 		errx(1, "Invalid final key '%s'", argv[3]);
 
 	if (offer_anchor && min_confirms == 0)