https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81984 --- Comment #4 from Vittorio Zecca <zeccav at gmail dot com> --- There is no core dump because by default the ubsan sanitizer does not abort. But I am pretty sure len1==0 at that point.