stat: added malloc() return value check