NULL is OK, both for passing and for returning.
The caller owns the data, and is responsible for free it.