Check malloc() return value and set length upper bound