safe_malloc implemented