Your code will only work if malloc() pads with 0s. Otherwise it will be missing the null character at the end of the out string. So I would switch it to calloc() which is guaranteed to pad with 0s. Or use memset to set it all to 0s.
Writing C code with well-defined semantics in the face of existing heap corruption is harder. The strn* functions don't do that either though.
For real programs you basically have to put it in the initial computation, or it will be forgotten somewhere later (maybe in a later commit).
Mayhaps "len" should be renamed to something clearer?