safer realloc()