diff --git a/wutil-rs/src/prop_list.rs b/wutil-rs/src/prop_list.rs
index 0c303cca..c5b488b2 100644
--- a/wutil-rs/src/prop_list.rs
+++ b/wutil-rs/src/prop_list.rs
@@ -666,10 +666,11 @@ pub mod ffi {
         }
         let plist = unsafe { &*plist };
         if let Node::Array(ref items) = *plist.0.borrow() {
-            Box::leak(Box::new(items[index as usize].clone()))
-        } else {
-            ptr::null_mut()
+            if let Some(x) = items.get(index as usize) {
+                return Box::leak(Box::new(x.clone()));
+            }
         }
+        ptr::null_mut()
     }
 
     #[unsafe(no_mangle)]
@@ -850,4 +851,13 @@ mod test {
 
         unsafe { memory::ffi::wfree(desc.cast()); }
     }
+
+    #[test]
+    fn oob_array_access_returns_null() {
+        // This is the original WMArray behavior. I don't like it, but a bunch
+        // of existing code relies on it.
+        let mut list = PropList::new(Node::Array(vec![PropList::new(Node::String(CString::from(c"hello"))),
+                                                      PropList::new(Node::String(CString::from(c"world!")))]));
+        assert!(unsafe { ffi::WMGetFromPLArray(&mut list, 3) }.is_null());
+    }
 }