application supplies malloc