hardening against null inputs, and a slight pointer swap