ping_iterator_get_info()'s 'buffer' argument _may_ be NULL, since the user
might only be interested in the size of the (to be) returned value. If
'buffer' is NULL, '*buffer_len' should be 0, though, to make sure nothing gets
written to 'buffer'.
This bug was introduced in commit
9ae85a09d919777c9be52e55b23c08bf2c8c1d0e.
size_t orig_buffer_len = *buffer_len;
- if ((iter == NULL) || (buffer == NULL) || (buffer_len == NULL))
+ if ((iter == NULL) || (buffer_len == NULL))
+ return (-1);
+
+ if ((buffer == NULL) && (*buffer_len != 0 ))
return (-1);
switch (info)