test "length" first (otherwise when "length" is 0, the *from invalid access still triggers a Valgrind warning).
I wrote to the Valgrind authors in case this is something fixable in Valgrind (normally the
decision to issue a warning is based on the simulated CPU condition code, which should not be undefined here).