So, you can allocate zero-length arrays in C++, and, unsurprisingly, dereferencing the returned pointer is undefined behavior:
malloc(3), however, the C++ standard codifies the return value to be non-null (sec. 18.104.22.168 of the C++11 standard):
If the request succeeds, the value returned shall be a non-null
pointer value (4.10) p0 different from any previously returned value
p1, unless that value p1 was subsequently passed to an operator
delete. The effect of dereferencing a pointer returned as a request
for zero size is undefined.
Personally I think that “this can return whatever, including null” is a lot more of a warn-off than “this will always return non-null, but don’t touch it”.