为什么输入字符串长为2，4，5等，输出都会乱码？

C语言递归实现

int QPL(char* n, int len, int a);
int main() {
    int a;
    char* str = NULL;
    printf("请输入将输入字符串的长度\n");
    scanf_s("%d", &a);
    printf("请输入字符串\n");
    str = (char*)malloc(sizeof(char) * a);
    scanf_s("%s", str, sizeof(str));
    printf("排列如下：\n");
    QPL(str, a, 1);
    return 0;
}
int QPL(char* n, int len, int a) {
    char* str = NULL;
    str = (char*)malloc(len * sizeof(char));
    if (a <= len - 1) {
        for (int i = a; i >= 0; i--) {
            for (int j = 0; j < i; j++) {
                str[j] = n[j];
            }
            str[i] = n[a];
            for (int k = i + 1; k <= a; k++) {
                str[k] = n[k - 1];
            }
            for (int l = a + 1; l < len; l++) {
                str[l] = n[l];
            }
            QPL(str, len, a + 1);
        }
        free(str);
    }
    else {
        printf("%s\n", n);
        free(str);
    }
    return 0;
}

scanf_s("%s", str, sizeof(str));
这个一看就不对
应该是
scanf_s("%s", str, a);

还有
str = (char*)malloc(sizeof(char) * a);
->
str = (char*)malloc(sizeof(char) * (a + 1));
否则没地方放\0