This was previously using the value of the uninitialized sz variable
before it was actually assigned a value, rather than assigning the size
indicated within the command buffer.
Based off the conditions, this is a potential null pointer dereference
that can occur. We need to check for null before accessing
nbPendingNotifications.
This is unlikely to occur in common usage, however it's a fairly
straightforward amendment.