On Tue, Jun 04, 2019 at 07:01:01AM +0200, René Scharfe wrote: > It's a bit hard to see with the (extended, but still) limited context, > but url_decode_internal() effectively returns a NUL-terminated string, > even though it does use a strbuf parameter named "out" for temporary > storage. So callers really have no use for decoded NULs, and this > change thus makes sense to me. > That was more or less my train of thought as well. Thank you for taking a look.