Len in the function is defined as an unsigned integer. When you pass a parameter of 0, what is len- 1? -1, but due to unsigned shaping, the calculation result of complement is binary 32-bit all 1, that is, len- 1==4294967295, so the for circular access array is out of bounds, and there are exceptions.