json: fix off-by-one in memory alloc