Fix a bug in malloc