Correctly handle the case in calloc(num, size) where

  (size_t)(num * size) == 0
but both num and size are nonzero.

Reported by:	Ilja van Sprundel
Approved by:	jasone
Security:	Integer overflow; calloc was allocating 1 byte in
		response to a request for a multiple of 2^32 (or 2^64)
		bytes instead of returning NULL.

1 files changed, 1 insertions, 1 deletions

diff --git a/lib/libc/stdlib/malloc.c b/lib/libc/stdlib/malloc.c
index a3f6e27..eb9bf56 100644
--- a/lib/libc/stdlib/malloc.c
+++ b/lib/libc/stdlib/malloc.c
@@ -3495,7 +3495,7 @@ calloc(size_t num, size_t size)
 
 	num_size = num * size;
 	if (num_size == 0) {
-		if (opt_sysv == false)
+		if ((opt_sysv == false) && ((num == 0) || (size == 0)))
 			num_size = 1;
 		else {
 			ret = NULL;