string_len: check calls like strcpy(buf + 1, src, size);