`FUNC_ATTR_ALLOC_SIZE(2)` may cause problems as the actual allocated size is `len + 1`.