Should have checks in it:
b = (string)malloc(sizeof(char) * 3);
assert(b != NULL);
strcpy(b, "Bob\0", 3);
len = strlen(b);
assert really doesn't count as a check, since it is only functional during debugging sessions. For runtime checks you really should use a proper if else construct.
Well if we're being fussy we can go into propagating error results or implementing the C Exception library, but I was just trying to get my point across, not write release code