bug fix: missing braces in malloc() arg