avoid NULL dereference on failed malloc