pos should never exceed strlen, else the overflow check 'if (!len)' will wrongfully pass