Why does the 17 character of my output string get replaced with an 'o'?

I was trying to write a simple code that evaluates simple mathematical expressions and I just stumbled across this error. I tried various ways to find the issue, but I couldn't. It seems fine to me, but when I execute it, it replaces the 17 character (index 16) of the string 'res' with an 'o' or it just deletes it.

This piece of code is what I wrote to convert from Infix to Postfix expression :

#include <ctype.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

char * ascan()
{
    char * s, c;
    int len = -1;

    s = (char *)malloc(sizeof(char));

    while (scanf("%c", &c) == 1)
    {
        if(c == '\n')
            break;
        len += 1;
        s = (char *)realloc(s, (len + 1));
        s[len] = c;
        s[len + 1] = '\0';
    }

    return s;
}

char * chcpy(char * str, char chr)
{
    int len = strlen(str);

    str[len] = chr;
    str = (char *)realloc(str, (len + 1));
    str[len + 1] = '\0';
    len++;

    return str;
}

typedef struct stack stack;
struct stack
{
    char opr;
    stack * pre;
};

stack * createStack()
{
    stack * stk;

    stk = NULL;

    return stk;
}

stack * push(stack * top, char opr)
{
    stack * new = (stack *)malloc(sizeof(stack));
    new -> opr = opr;

    new -> pre = top;
    top = new;

    return top;
}

char pop(stack ** top)
{
    if ((*top) != NULL)
    {
        char opr = (*top) -> opr;

        stack * tmp = (*top);
        (*top) = (*top) -> pre;
        free(tmp);

        return opr;
    }

    return '\0';
}

char * evaluatePostfix(char * exp)
{
    char * pfe = (char *)malloc(sizeof(char));
    stack * ops = createStack();
    int i = 0, p = 0;

    while (exp[i] != '\0')
    {
        if (exp[i] == '(')
            p++;
        else if (isdigit(exp[i]))
            pfe = chcpy(pfe, *(exp + i));
        else if (exp[i] == ')')
        {
            p--;

            if (ops != NULL)
            {
                pfe = chcpy(pfe, ' ');
                pfe = chcpy(pfe, pop(&ops));
            }
        }
        else if (exp[i] == '+' || exp[i] == '-' || exp[i] == '*' || exp[i] == '/')
        {
            pfe = chcpy(pfe, ' ');

            ops = push(ops, exp[i]);
        }

        i++;
    }

    while (ops != NULL)
    {
        pfe = chcpy(pfe, ' ');
        pfe = chcpy(pfe, pop(&ops));
    }

    if (p < 0)
        return NULL;

    return pfe;
}

int main()
{
    char * exp = ascan(), * res;

    res = evaluatePostfix(exp);

    printf("%s\n", res);

    return 0;
}

I don't really know why it affects only that exact character, and I don't know if it's exactly an allocation bug, but if it is please help me solve it.

Input :

10*(2+8*(3-2))

Output :

10 2 8 3 2 - * +o*
                ^