diff --git a/funcs/func_curl.c b/funcs/func_curl.c
index e5784652f46b5f2e9094eca70e099fdccb5463f0..24f6fd923f54a08f8ce9e2af86aaae9091d6cee7 100644
--- a/funcs/func_curl.c
+++ b/funcs/func_curl.c
@@ -582,6 +582,10 @@ static int acf_curl_helper(struct ast_channel *chan, const char *cmd, char *info
 		*buf = '\0';
 	}
 
+	if (!str) {
+		return -1;
+	}
+
 	if (ast_strlen_zero(info)) {
 		ast_log(LOG_WARNING, "CURL requires an argument (URL)\n");
 		ast_free(str);
@@ -651,21 +655,22 @@ static int acf_curl_helper(struct ast_channel *chan, const char *cmd, char *info
 			int rowcount = 0;
 			while (fields && values && (piece = strsep(&remainder, "&"))) {
 				char *name = strsep(&piece, "=");
-				if (!piece) {
-					piece = "";
-				}
 				/* Do this before the decode, because if something has encoded
 				 * a literal plus-sign, we don't want to translate that to a
 				 * space. */
 				if (hashcompat == HASHCOMPAT_LEGACY) {
-					ast_uri_decode(piece, ast_uri_http_legacy);
+					if (piece) {
+						ast_uri_decode(piece, ast_uri_http_legacy);
+					}
 					ast_uri_decode(name, ast_uri_http_legacy);
 				} else {
-					ast_uri_decode(piece, ast_uri_http);
+					if (piece) {
+						ast_uri_decode(piece, ast_uri_http);
+					}
 					ast_uri_decode(name, ast_uri_http);
 				}
 				ast_str_append(&fields, 0, "%s%s", rowcount ? "," : "", name);
-				ast_str_append(&values, 0, "%s%s", rowcount ? "," : "", piece);
+				ast_str_append(&values, 0, "%s%s", rowcount ? "," : "", S_OR(piece, ""));
 				rowcount++;
 			}
 			pbx_builtin_setvar_helper(chan, "~ODBCFIELDS~", ast_str_buffer(fields));