use malloc, not alloca

It seems that even on ext4, 4096 is used as max path length by the
code here, but how could I be sure that's not much larger in other
places. And alloca doesn't return false, it would just lead to a
segfault.