diff --git a/src/string.cpp b/src/string.cpp
index f4f93ba..af7e20e 100644
--- a/src/string.cpp
+++ b/src/string.cpp
@@ -1230,7 +1230,8 @@ namespace bx
 
 	int32_t vsnprintf(char* _out, int32_t _max, const char* _format, va_list _argList)
 	{
-		if (0 < _max)
+		if (   0 <  _max
+		&&  NULL != _out)
 		{
 			StaticMemoryBlockWriter writer(_out, uint32_t(_max) );
 
diff --git a/tests/vsnprintf_test.cpp b/tests/vsnprintf_test.cpp
index 24fb9f2..a4a432b 100644
--- a/tests/vsnprintf_test.cpp
+++ b/tests/vsnprintf_test.cpp
@@ -30,6 +30,14 @@ TEST_CASE("Truncated output buffer.", "[string][printf]")
 	REQUIRE(4    == bx::snprintf(buffer1, BX_COUNTOF(buffer1), "abvg") );
 	REQUIRE('\0' == buffer1[BX_COUNTOF(buffer1)-1]);
 
+	buffer1[0] = '\xfb'; // null destination
+	REQUIRE(4      == bx::snprintf(NULL, BX_COUNTOF(buffer1), "abvg") );
+	REQUIRE('\xfb' == buffer1[0]);
+
+	buffer1[0] = '\xbf'; // one byte destination
+	REQUIRE(4    == bx::snprintf(buffer1, 1, "abvg") );
+	REQUIRE('\0' == buffer1[0]);
+
 	char buffer7[7]; // truncate
 	REQUIRE(10   == bx::snprintf(NULL, 0, "Ten chars!") );
 	REQUIRE(10   == bx::snprintf(buffer7, BX_COUNTOF(buffer7), "Ten chars!") );