Otherwise, the check is just undefined behaviour. gcc even takes out
this check because len can never be zero if len does not wrap around.

Found with -Wstrict-overflow=2