AIM: abort on memory allocation failure

Memory allocations will not fail in practice.
AIM: use attribute((malloc))

See http://gcc.gnu.org/onlinedocs/gcc/Function-Attributes.html