malloc(strlen(src) + 1), not sentence

Just so happens that sentence and src are the same length,
hence no crash.