fix null ref in SqlDataReader (dotnet#4159)

Author: SimonCropp

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/SqlDataReader.cs

@@ -2137,7 +2137,7 @@ override public long GetChars(int i, long dataIndex, char[] buffer, int bufferIn
                     // if bad buffer index, throw
                     if ((bufferIndex < 0) || (buffer != null && bufferIndex >= buffer.Length))
                     {
-                        throw ADP.InvalidDestinationBufferIndex(buffer.Length, bufferIndex, nameof(bufferIndex));
+                        throw ADP.InvalidDestinationBufferIndex(buffer?.Length ?? 0, bufferIndex, nameof(bufferIndex));
                     }
 
                     // if there is not enough room in the buffer for data

src/Microsoft.Data.SqlClient/tests/ManualTests/SQL/DataReaderTest/DataReaderTest.cs

@@ -741,6 +741,22 @@ DROP TABLE IF EXISTS [{tableName}]
             }
         }
 
+        [ConditionalFact(typeof(DataTestUtility), nameof(DataTestUtility.AreConnStringsSetup))]
+        public static async Task GetCharsSequentialAccess_NullBufferNegativeBufferIndex_ThrowsArgumentOutOfRange()
+        {
+            using var connection = new SqlConnection(DataTestUtility.TCPConnectionString);
+            await connection.OpenAsync();
+
+            using var command = connection.CreateCommand();
+            command.CommandText = "SELECT CONVERT(NVARCHAR(MAX), 'test')";
+
+            using var reader = await command.ExecuteReaderAsync(CommandBehavior.SequentialAccess);
+            Assert.True(await reader.ReadAsync());
+
+            var ex = Assert.Throws<ArgumentOutOfRangeException>(() => reader.GetChars(0, 0, null, -1, 0));
+            Assert.Equal("bufferIndex", ex.ParamName);
+        }
+
         [ConditionalFact(typeof(DataTestUtility), nameof(DataTestUtility.AreConnStringsSetup))]
         public static async Task CanGetCharsSequentially()
         {