bug in realloc