fail if nmemb * size overflows

1 files changed, 6 insertions, 1 deletions

diff --git a/src/stdlib/calloc.c b/src/stdlib/calloc.c
index aeed4aef..ec5fbfdb 100644
--- a/src/stdlib/calloc.c
+++ b/src/stdlib/calloc.c
@@ -6,12 +6,17 @@
 void * calloc(size_t nmemb, size_t size)
 {
 	void *p = NULL;
+	size_t total = nmemb * size;
+
+	if (total < nmemb || total < size) {
+		return NULL;
+	}
 
 	if (nmemb == 0 || size == 0) {
 		return NULL;
 	}
 
-	p = realloc(NULL, size * nmemb);
+	p = malloc(total);
 	if (p != NULL) {
 		memset(p, 0, size * nmemb);
 	}