Index: sbin/ipfw/ipfw2.c
===================================================================
--- sbin/ipfw/ipfw2.c
+++ sbin/ipfw/ipfw2.c
@@ -2903,7 +2903,7 @@
 
 	if (tstate->count + 1 > tstate->size) {
 		tstate->size += 4;
-		tstate->idx = realloc(tstate->idx, tstate->size *
+		tstate->idx = reallocarray(tstate->idx, tstate->size,
 		    sizeof(ipfw_obj_ntlv));
 		if (tstate->idx == NULL)
 			return (0);
Index: sbin/newfs_nandfs/newfs_nandfs.c
===================================================================
--- sbin/newfs_nandfs/newfs_nandfs.c
+++ sbin/newfs_nandfs/newfs_nandfs.c
@@ -1041,8 +1041,8 @@
 			printf("cannot delete segment %jx (offset %jd)\n",
 			    i, offset);
 			bad_segments_count++;
-			bad_segments = realloc(bad_segments,
-			    bad_segments_count * sizeof(uint32_t));
+			bad_segments = reallocarray(bad_segments,
+			    bad_segments_count, sizeof(uint32_t));
 			bad_segments[bad_segments_count - 1] = i;
 		}
 	}
Index: usr.bin/c99/c99.c
===================================================================
--- usr.bin/c99/c99.c
+++ usr.bin/c99/c99.c
@@ -96,8 +96,8 @@
 {
 	if (nargs + 1 >= cargs) {
 		cargs += 16;
-		if ((args = realloc(args, sizeof(*args) * cargs)) == NULL)
-			err(1, "malloc");
+		if ((args = reallocarray(args, cargs, sizeof(*args))) == NULL)
+			err(1, "realloc");
 	}
 	if ((args[nargs++] = strdup(item)) == NULL)
 		err(1, "strdup");
Index: usr.bin/col/col.c
===================================================================
--- usr.bin/col/col.c
+++ usr.bin/col/col.c
@@ -91,8 +91,8 @@
 	CHAR	*l_line;		/* characters on the line */
 	LINE	*l_prev;		/* previous line */
 	LINE	*l_next;		/* next line */
-	int	l_lsize;		/* allocated sizeof l_line */
-	int	l_line_len;		/* strlen(l_line) */
+	unsigned l_lsize;		/* allocated sizeof l_line */
+	unsigned l_line_len;		/* strlen(l_line) */
 	int	l_needs_sort;		/* set if chars went in out of order */
 	int	l_max_col;		/* max column in the line */
 };
@@ -312,11 +312,11 @@
 		}
 		/* grow line's buffer? */
 		if (l->l_line_len + 1 >= l->l_lsize) {
-			int need;
+			unsigned need;
 
 			need = l->l_lsize ? l->l_lsize * 2 : 90;
-			if ((l->l_line = realloc(l->l_line,
-			    (unsigned)need * sizeof(CHAR))) == NULL)
+			if ((l->l_line = reallocarray(l->l_line, need,
+			    sizeof(CHAR))) == NULL)
 				err(1, NULL);
 			l->l_lsize = need;
 		}
@@ -426,7 +426,8 @@
 
 	if (l->l_needs_sort) {
 		static CHAR *sorted;
-		static int count_size, *count, sorted_size;
+		static int count_size, *count;
+		static unsigned sorted_size;
 
 		/*
 		 * Do an O(n) sort on l->l_line by column being careful to
@@ -434,14 +435,14 @@
 		 */
 		if (l->l_lsize > sorted_size) {
 			sorted_size = l->l_lsize;
-			if ((sorted = realloc(sorted,
-			    (unsigned)sizeof(CHAR) * sorted_size)) == NULL)
+			if ((sorted = reallocarray(sorted, sorted_size,
+			    sizeof(CHAR))) == NULL)
 				err(1, NULL);
 		}
 		if (l->l_max_col >= count_size) {
 			count_size = l->l_max_col + 1;
-			if ((count = realloc(count,
-			    (unsigned)sizeof(int) * count_size)) == NULL)
+			if ((count = reallocarray(count, count_size,
+			    sizeof(int))) == NULL)
 				err(1, NULL);
 		}
 		memset(count, 0, sizeof(int) * l->l_max_col + 1);
@@ -552,7 +553,7 @@
 	int i;
 
 	if (!line_freelist) {
-		if ((l = realloc(NULL, sizeof(LINE) * NALLOC)) == NULL)
+		if ((l = reallocarray(NULL, NALLOC, sizeof(LINE))) == NULL)
 			err(1, NULL);
 		line_freelist = l;
 		for (i = 1; i < NALLOC; i++, l++)
Index: usr.bin/column/column.c
===================================================================
--- usr.bin/column/column.c
+++ usr.bin/column/column.c
@@ -243,10 +243,10 @@
 		    (cols[coloff] = wcstok(p, separator, &last));
 		    p = NULL)
 			if (++coloff == maxcols) {
-				if (!(cols = realloc(cols, ((u_int)maxcols +
-				    DEFCOLS) * sizeof(wchar_t *))) ||
-				    !(lens = realloc(lens,
-				    ((u_int)maxcols + DEFCOLS) * sizeof(int))))
+				if (!(cols = reallocarray(cols, (u_int)maxcols +
+				    DEFCOLS, sizeof(wchar_t *))) ||
+				    !(lens = reallocarray(lens,
+				    (u_int)maxcols + DEFCOLS, sizeof(int))))
 					err(1, NULL);
 				memset((char *)lens + maxcols * sizeof(int),
 				    0, DEFCOLS * sizeof(int));
@@ -300,8 +300,8 @@
 			maxlength = len;
 		if (entries == maxentry) {
 			maxentry += DEFNUM;
-			if (!(list = realloc(list,
-			    (u_int)maxentry * sizeof(*list))))
+			if (!(list = reallocarray(list,
+			    (u_int)maxentry, sizeof(*list))))
 				err(1, NULL);
 		}
 		list[entries] = malloc((wcslen(buf) + 1) * sizeof(wchar_t));
Index: usr.bin/join/join.c
===================================================================
--- usr.bin/join/join.c
+++ usr.bin/join/join.c
@@ -292,8 +292,8 @@
 		if (F->setcnt == F->setalloc) {
 			cnt = F->setalloc;
 			F->setalloc += 50;
-			if ((F->set = realloc(F->set,
-			    F->setalloc * sizeof(LINE))) == NULL)
+			if ((F->set = reallocarray(F->set,
+			    F->setalloc, sizeof(LINE))) == NULL)
 				err(1, NULL);
 			memset(F->set + cnt, 0, 50 * sizeof(LINE));
 
@@ -343,8 +343,8 @@
 				continue;
 			if (lp->fieldcnt == lp->fieldalloc) {
 				lp->fieldalloc += 50;
-				if ((lp->fields = realloc(lp->fields,
-				    lp->fieldalloc * sizeof(char *))) == NULL)
+				if ((lp->fields = reallocarray(lp->fields,
+				    lp->fieldalloc, sizeof(char *))) == NULL)
 					err(1, NULL);
 			}
 			lp->fields[lp->fieldcnt++] = fieldp;
@@ -559,8 +559,8 @@
 			errx(1, "malformed -o option field");
 		if (olistcnt == olistalloc) {
 			olistalloc += 50;
-			if ((olist = realloc(olist,
-			    olistalloc * sizeof(OLIST))) == NULL)
+			if ((olist = reallocarray(olist,
+			    olistalloc, sizeof(OLIST))) == NULL)
 				err(1, NULL);
 		}
 		olist[olistcnt].filenum = filenum;
Index: usr.bin/last/last.c
===================================================================
--- usr.bin/last/last.c
+++ usr.bin/last/last.c
@@ -230,7 +230,7 @@
 	/* Load the last entries from the file. */
 	while ((ut = getutxent()) != NULL) {
 		if (amount % 128 == 0) {
-			buf = realloc(buf, (amount + 128) * sizeof *ut);
+			buf = reallocarray(buf, amount + 128, sizeof(*ut));
 			if (buf == NULL)
 				err(1, "realloc");
 		}
Index: usr.bin/locate/locate/util.c
===================================================================
--- usr.bin/locate/locate/util.c
+++ usr.bin/locate/locate/util.c
@@ -85,7 +85,8 @@
 char **
 colon(char **dbv, char *path, char *dot)
 {
-	int vlen, slen;
+	int slen;
+	u_int vlen;
 	char *c, *ch, *p;
 	char **pv;
 
@@ -120,8 +121,8 @@
 				*(p + slen) = '\0';
 			}
 			/* increase dbv with element p */
-			if ((dbv = realloc(dbv, sizeof(char *) * (vlen + 2)))
-			    == NULL)
+			if ((dbv = reallocarray(dbv, vlen + 2,
+			    sizeof(char *))) == NULL)
 				err(1, "realloc");
 			*(dbv + vlen) = p;
 			*(dbv + ++vlen) = NULL;
Index: usr.bin/mklocale/yacc.y
===================================================================
--- usr.bin/mklocale/yacc.y
+++ usr.bin/mklocale/yacc.y
@@ -295,8 +295,7 @@
 static uint32_t *
 xrelalloc(uint32_t *old, unsigned int sz)
 {
-    uint32_t *r = (uint32_t *)realloc((char *)old,
-						sz * sizeof(uint32_t));
+    uint32_t *r = (uint32_t *)reallocarray((char *)old, sz, sizeof(uint32_t));
     if (!r)
 	errx(1, "xrelalloc");
     return(r);
Index: usr.bin/rs/rs.c
===================================================================
--- usr.bin/rs/rs.c
+++ usr.bin/rs/rs.c
@@ -80,7 +80,7 @@
 static char	**elem;
 static char	**endelem;
 static char	*curline;
-static int	allocsize = BUFSIZ;
+static unsigned	allocsize = BUFSIZ;
 static int	curlen;
 static int	irows, icols;
 static int	orows = 0, ocols = 0;
@@ -378,7 +378,7 @@
 	char **p;
 
 	allocsize += allocsize;
-	p = (char **)realloc(elem, allocsize * sizeof(char *));
+	p = reallocarray(elem, allocsize, sizeof(char *));
 	if (p == NULL)
 		err(1, "no memory");
 
Index: usr.bin/ruptime/ruptime.c
===================================================================
--- usr.bin/ruptime/ruptime.c
+++ usr.bin/ruptime/ruptime.c
@@ -213,8 +213,8 @@
 		}
 
 		if (nhosts == hspace) {
-			if ((hs =
-			    realloc(hs, (hspace += 40) * sizeof(*hs))) == NULL)
+			if ((hs = reallocarray(hs, hspace += 40,
+			    sizeof(*hs))) == NULL)
 				err(1, NULL);
 			hsp = hs + nhosts;
 		}
Index: usr.sbin/mailwrapper/mailwrapper.c
===================================================================
--- usr.sbin/mailwrapper/mailwrapper.c
+++ usr.sbin/mailwrapper/mailwrapper.c
@@ -73,7 +73,7 @@
 
 	if (al->argc == al->maxc) {
 		al->maxc <<= 1;
-		al->argv = realloc(al->argv, al->maxc * sizeof(char *));
+		al->argv = reallocarray(al->argv, al->maxc, sizeof(char *));
 		if (al->argv == NULL)
 			err(EX_TEMPFAIL, "realloc");
 	}
Index: usr.sbin/newsyslog/newsyslog.c
===================================================================
--- usr.sbin/newsyslog/newsyslog.c
+++ usr.sbin/newsyslog/newsyslog.c
@@ -1577,8 +1577,8 @@
 			/* Detect integer overflow */
 			if (max_logcnt < logcnt)
 				errx(1, "Too many old logfiles found");
-			oldlogs = realloc(oldlogs,
-			    max_logcnt * sizeof(struct oldlog_entry));
+			oldlogs = reallocarray(oldlogs, max_logcnt,
+			    sizeof(struct oldlog_entry));
 			if (oldlogs == NULL)
 				err(1, "realloc()");
 		}
@@ -1586,7 +1586,7 @@
 
 	/* Second, if needed we delete oldest archived logfiles */
 	if (logcnt > 0 && logcnt >= ent->numlogs && ent->numlogs > 1) {
-		oldlogs = realloc(oldlogs, logcnt *
+		oldlogs = reallocarray(oldlogs, logcnt,
 		    sizeof(struct oldlog_entry));
 		if (oldlogs == NULL)
 			err(1, "realloc()");
Index: usr.sbin/portsnap/make_index/make_index.c
===================================================================
--- usr.sbin/portsnap/make_index/make_index.c
+++ usr.sbin/portsnap/make_index/make_index.c
@@ -288,7 +288,7 @@
 				N++;
 				if (N >= *nd) {
 					*nd += *nd;
-					d = realloc(d, *nd * sizeof(DEP));
+					d = reallocarray(d, *nd, sizeof(DEP));
 					if (d == NULL)
 						err(1, "realloc(d)");
 				}
@@ -452,7 +452,8 @@
 		/* Enlarge array if needed */
 		if (i >= pplen) {
 			pplen *= 2;
-			if ((pp = realloc(pp, pplen * sizeof(PORT *))) == NULL)
+			if ((pp = reallocarray(pp, pplen,
+			    sizeof(PORT *))) == NULL)
 				err(1, "realloc(pp)");
 		}
 
Index: usr.sbin/ppp/iface.c
===================================================================
--- usr.sbin/ppp/iface.c
+++ usr.sbin/ppp/iface.c
@@ -173,8 +173,8 @@
                              )) {
           /* Record the address */
 
-          addr = (struct iface_addr *)
-            realloc(iface->addr, (iface->addrs + 1) * sizeof iface->addr[0]);
+          addr = reallocarray(iface->addr, iface->addrs + 1,
+	      sizeof iface->addr[0]);
           if (addr == NULL)
             break;
           iface->addr = addr;
@@ -575,8 +575,7 @@
     }
   }
 
-  addr = (struct iface_addr *)realloc
-    (iface->addr, (iface->addrs + 1) * sizeof iface->addr[0]);
+  addr = reallocarray(iface->addr, (iface->addrs + 1), sizeof iface->addr[0]);
   if (addr == NULL) {
     log_Printf(LogERROR, "iface_inAdd: realloc: %s\n", strerror(errno));
     close(s);
Index: usr.sbin/ppp/ncp.c
===================================================================
--- usr.sbin/ppp/ncp.c
+++ usr.sbin/ppp/ncp.c
@@ -387,8 +387,7 @@
 
   if (range->nports == range->maxports) {
     range->maxports += 10;
-    newport = (u_short *)realloc(range->port,
-                                 range->maxports * sizeof(u_short));
+    newport = reallocarray(range->port, range->maxports, sizeof(u_short));
     if (newport == NULL) {
       log_Printf(LogERROR, "ncp_AddUrgentPort: realloc: %s\n",
                  strerror(errno));