- out of bound read initially uncovered by sam,
 - also malloc() can really return NULL for arbitrary large alloc,
   return value MUST be checked.