convert alloca() calls to malloc()

doing this win32 port. still a few alloca() calls in cabbage patch, will
cross that bridge when i come to it.