> 2. This will not fail because there is a statement len++ for the '\0';
Except by doing so, you step off the end of the memory you allocated, write a \0 into someone else's memory, then get abnormal program termination.
You need to allocate len+1 slots if you want to read len items, then append a \0.
