BUG: add more malloc failure checks