fix bad XMALLOC call