exit on fail to malloc, no need to null-check