Unfortunately that's not enough because you cannot always trust the length value. For example the `git_oid_fromstr` function delegates to this one with `GIT_OID_HEXSZ` as the length parameter regardless of the actual length of `str`. So the following would also cause the invalid access:
```C
git_oid out;
git_oid_fromstr(&out, "");
```

So I cannot actually remove the check, however, I should probably check the length value anyway. Something like `if ((str && !*str) || !length)` maybe?