Are you sure you need two microcontrollers for your project? I guess only one of them would be enough. I would keep the ESP8266 because of the web server.
If you want to keep the two microcontrollers, you need to wire ESP Tx to UNO Rx pin. Do not connect the ESP Rx to the UNO Tx, because ESP works under 3.3.V and UNO under 5V. So it is OK for the ESP to send ...
Why it does not work? You already got the answer in comments:
You are reading more bytes from the serial stream than what you know
are available. Then, your length variable can contain garbage, which
makes malloc() fail even if you have plenty of available memory.
You write into the memory buffer even if the allocation failed, which
makes your program ...