sanity check: return value of malloc is not NULL