switch to calloc() so that NULL compare works below