downcast len to int. The code has already checked that len < INT_MAX