ctl: proper handling of realloc failure to avoid leak