permissions: safety check of src len before copying to dst buffer