util: add some defensive coding in u_upload_alloc()