return error if len is negative, prevent segfault