Why it will overflow? malloc accepts size_t as a parameter (which is unsigned integer), before giving it the (2 * len) + 1 I check if len is smaller than 1024^3

Why it will overflow? malloc accepts size_t as a parameter (which is unsigned integer), before giving it the (2 * len) + 1 I check if len is smaller than 1024^3 (1 GiB), so (2 * len) + 1 can not be greater than 2147483649 (which is 0x80000001).