stupid string parameter got broken again, since I keep trying to get rid
of address sanitizer complaints.
this time, I'm just using malloc with free, and apparently all's fine.