Neither alloc
nor strncpy
zero out the newly allocated memory. You need to manually add a zero at the end of your new string.
Possibly you are running this in Debug mode on your desktop, and lots of compilers do zero out newly allocated memory in debug mode (only).
All it needs is this additional line:
alloc[len] = 0;
Note: You don't need to/should not cast malloc in C: Do I cast the result of malloc?