integer and buffer overflows: introduce safe_malloc_ary