Using ubsan and afl, I found that memcpy can be invoked on a null pointer, which is undefined behaviour. See #1442 for code to reproduce it.