请教大神，下面这段代码有哪些漏洞？

#include
#include
typedef unsigned char u_int8_t;

void test( u_int8_t len, char* s)
{
char a[20];//6+14,"ftp://"
u_int8_t len2;
len2 = len+6;
if( len2 > 20 )
{
printf("The host is so long\n");
}
else
{
strncpy(a,"ftp://",6);
strncpy(a+6, s, len);
a[len]='\0';
printf("host : %s\n", a);
}
}

int main(int argc , char ** argv)
{
u_int8_t len;
if( argc <2 )
{
printf("Please input the host\n");
return 1;
}
len = strlen(argv[1]);
printf("len:%d\n", len);
test(len ,argv[1]);
return 1;
}

a[len]='\0';//是len吗,但如果是len2的话，当len2的20时，下标是否又越界了呢