fixed unsafe usage of malloc() pointed out by jtsiomb.