NULL arguments of external calls don't propagate taint