Code:
malloc(sizeof(strlen(src)));
You're not allocating enough space for the terminating NUL character. strlen does not count it.