Index: head/lib/libc/gen/glob.c
===================================================================
--- head/lib/libc/gen/glob.c
+++ head/lib/libc/gen/glob.c
@@ -850,7 +850,7 @@
     const char *origpat)
 {
 	char **pathv;
-	size_t i, newsize, len;
+	size_t i, newn, len;
 	char *copy;
 	const Char *p;
 
@@ -860,9 +860,9 @@
 		return (GLOB_NOSPACE);
 	}
 
-	newsize = sizeof(*pathv) * (2 + pglob->gl_pathc + pglob->gl_offs);
-	/* realloc(NULL, newsize) is equivalent to malloc(newsize). */
-	pathv = realloc((void *)pglob->gl_pathv, newsize);
+	newn = 2 + pglob->gl_pathc + pglob->gl_offs;
+	/* reallocarray(NULL, newn, size) is equivalent to malloc(newn*size). */
+	pathv = reallocarray(pglob->gl_pathv, newn, sizeof(*pathv));
 	if (pathv == NULL)
 		return (GLOB_NOSPACE);
 
Index: head/lib/libc/gen/scandir.c
===================================================================
--- head/lib/libc/gen/scandir.c
+++ head/lib/libc/gen/scandir.c
@@ -116,8 +116,8 @@
 		if (numitems >= arraysz) {
 			struct dirent **names2;
 
-			names2 = (struct dirent **)realloc((char *)names,
-				(arraysz * 2) * sizeof(struct dirent *));
+			names2 = reallocarray(names, arraysz,
+			    2 * sizeof(struct dirent *));
 			if (names2 == NULL) {
 				free(p);
 				goto fail;
Index: head/lib/libc/gen/setmode.c
===================================================================
--- head/lib/libc/gen/setmode.c
+++ head/lib/libc/gen/setmode.c
@@ -155,7 +155,7 @@
 	if (set >= endset) {						\
 		BITCMD *newset;						\
 		setlen += SET_LEN_INCR;					\
-		newset = realloc(saveset, sizeof(BITCMD) * setlen);	\
+		newset = reallocarray(saveset, setlen, sizeof(BITCMD));	\
 		if (newset == NULL)					\
 			goto out;					\
 		set = newset + (set - saveset);				\
Index: head/lib/libc/gen/wordexp.c
===================================================================
--- head/lib/libc/gen/wordexp.c
+++ head/lib/libc/gen/wordexp.c
@@ -234,8 +234,8 @@
 		vofs += we->we_offs;
 	we->we_wordc += nwords;
 	we->we_nbytes += nbytes;
-	if ((nwv = realloc(we->we_wordv, (we->we_wordc + 1 +
-	    (flags & WRDE_DOOFFS ?  we->we_offs : 0)) *
+	if ((nwv = reallocarray(we->we_wordv, (we->we_wordc + 1 +
+	    (flags & WRDE_DOOFFS ? we->we_offs : 0)),
 	    sizeof(char *))) == NULL) {
 		error = WRDE_NOSPACE;
 		goto cleanup;
Index: head/lib/libc/iconv/citrus_esdb.c
===================================================================
--- head/lib/libc/iconv/citrus_esdb.c
+++ head/lib/libc/iconv/citrus_esdb.c
@@ -347,7 +347,7 @@
 	ret = 0;
 	/* XXX: why reallocing the list space posteriorly?
 	    shouldn't be done earlier? */
-	q = realloc(list, num * sizeof(char *));
+	q = reallocarray(list, num, sizeof(char *));
 	if (!q) {
 		ret = ENOMEM;
 		goto quit3;
Index: head/lib/libc/net/nsdispatch.c
===================================================================
--- head/lib/libc/net/nsdispatch.c
+++ head/lib/libc/net/nsdispatch.c
@@ -213,7 +213,7 @@
 	void	*p;
 
 	if ((*count % ELEMSPERCHUNK) == 0) {
-		p = realloc(vec, (*count + ELEMSPERCHUNK) * esize);
+		p = reallocarray(vec, *count + ELEMSPERCHUNK, esize);
 		if (p == NULL) {
 			nss_log_simple(LOG_ERR, "memory allocation failure");
 			return (vec);
Index: head/lib/libc/regex/regcomp.c
===================================================================
--- head/lib/libc/regex/regcomp.c
+++ head/lib/libc/regex/regcomp.c
@@ -1143,7 +1143,7 @@
 {
 	cset *cs, *ncs;
 
-	ncs = realloc(p->g->sets, (p->g->ncsets + 1) * sizeof(*ncs));
+	ncs = reallocarray(p->g->sets, p->g->ncsets + 1, sizeof(*ncs));
 	if (ncs == NULL) {
 		SETERROR(REG_ESPACE);
 		return (NULL);
@@ -1206,7 +1206,7 @@
 	if (ch < NC)
 		cs->bmp[ch >> 3] |= 1 << (ch & 7);
 	else {
-		newwides = realloc(cs->wides, (cs->nwides + 1) *
+		newwides = reallocarray(cs->wides, cs->nwides + 1,
 		    sizeof(*cs->wides));
 		if (newwides == NULL) {
 			SETERROR(REG_ESPACE);
@@ -1235,7 +1235,7 @@
 		CHadd(p, cs, min);
 	if (min >= max)
 		return;
-	newranges = realloc(cs->ranges, (cs->nranges + 1) *
+	newranges = reallocarray(cs->ranges, cs->nranges + 1,
 	    sizeof(*cs->ranges));
 	if (newranges == NULL) {
 		SETERROR(REG_ESPACE);
@@ -1259,7 +1259,7 @@
 	for (i = 0; i < NC; i++)
 		if (iswctype(i, wct))
 			CHadd(p, cs, i);
-	newtypes = realloc(cs->types, (cs->ntypes + 1) *
+	newtypes = reallocarray(cs->types, cs->ntypes + 1,
 	    sizeof(*cs->types));
 	if (newtypes == NULL) {
 		SETERROR(REG_ESPACE);
@@ -1382,7 +1382,7 @@
 	if (p->ssize >= size)
 		return 1;
 
-	sp = (sop *)realloc(p->strip, size*sizeof(sop));
+	sp = reallocarray(p->strip, size, sizeof(sop));
 	if (sp == NULL) {
 		SETERROR(REG_ESPACE);
 		return 0;
@@ -1400,7 +1400,7 @@
 stripsnug(struct parse *p, struct re_guts *g)
 {
 	g->nstates = p->slen;
-	g->strip = (sop *)realloc((char *)p->strip, p->slen * sizeof(sop));
+	g->strip = reallocarray((char *)p->strip, p->slen, sizeof(sop));
 	if (g->strip == NULL) {
 		SETERROR(REG_ESPACE);
 		g->strip = p->strip;
Index: head/lib/libc/rpc/getnetconfig.c
===================================================================
--- head/lib/libc/rpc/getnetconfig.c
+++ head/lib/libc/rpc/getnetconfig.c
@@ -630,8 +630,8 @@
 	ncp->nc_lookups = NULL;
 	ncp->nc_nlookups = 0;
 	while ((cp = tokenp) != NULL) {
-	    if ((nc_lookups = realloc(ncp->nc_lookups,
-		(ncp->nc_nlookups + 1) * sizeof *ncp->nc_lookups)) == NULL) {
+	    if ((nc_lookups = reallocarray(ncp->nc_lookups,
+		ncp->nc_nlookups + 1, sizeof(*ncp->nc_lookups))) == NULL) {
 		    free(ncp->nc_lookups);
 		    ncp->nc_lookups = NULL;
 		    return (-1);
Index: head/lib/libc/stdio/open_wmemstream.c
===================================================================
--- head/lib/libc/stdio/open_wmemstream.c
+++ head/lib/libc/stdio/open_wmemstream.c
@@ -63,7 +63,7 @@
 	else
 		newsize = newoff;
 	if (newsize > ms->len) {
-		buf = realloc(*ms->bufp, (newsize + 1) * sizeof(wchar_t));
+		buf = reallocarray(*ms->bufp, newsize + 1, sizeof(wchar_t));
 		if (buf != NULL) {
 #ifdef DEBUG
 			fprintf(stderr, "WMS: %p growing from %zd to %zd\n",
Index: head/lib/libc/stdio/printf-pos.c
===================================================================
--- head/lib/libc/stdio/printf-pos.c
+++ head/lib/libc/stdio/printf-pos.c
@@ -655,7 +655,7 @@
 			return (-1);
 		bcopy(oldtable, newtable, oldsize * sizeof(enum typeid));
 	} else {
-		newtable = realloc(oldtable, newsize * sizeof(enum typeid));
+		newtable = reallocarray(oldtable, newsize, sizeof(enum typeid));
 		if (newtable == NULL)
 			return (-1);
 	}
Index: head/lib/libc/stdio/ungetc.c
===================================================================
--- head/lib/libc/stdio/ungetc.c
+++ head/lib/libc/stdio/ungetc.c
@@ -73,14 +73,14 @@
 		return (0);
 	}
 	i = fp->_ub._size;
-	p = realloc(fp->_ub._base, (size_t)(i << 1));
+	p = reallocarray(fp->_ub._base, i, 2);
 	if (p == NULL)
 		return (EOF);
 	/* no overlap (hence can use memcpy) because we doubled the size */
 	(void)memcpy((void *)(p + i), (void *)p, (size_t)i);
 	fp->_p = p + i;
 	fp->_ub._base = p;
-	fp->_ub._size = i << 1;
+	fp->_ub._size = i * 2;
 	return (0);
 }
 
Index: head/lib/libc/stdlib/getenv.c
===================================================================
--- head/lib/libc/stdlib/getenv.c
+++ head/lib/libc/stdlib/getenv.c
@@ -272,8 +272,8 @@
 	/* Resize environ. */
 	if (newEnvironSize > environSize) {
 		tmpEnvironSize = newEnvironSize * 2;
-		tmpEnviron = realloc(intEnviron, sizeof (*intEnviron) *
-		    (tmpEnvironSize + 1));
+		tmpEnviron = reallocarray(intEnviron, tmpEnvironSize + 1,
+		    sizeof(*intEnviron));
 		if (tmpEnviron == NULL)
 			return (-1);
 		environSize = tmpEnvironSize;
@@ -306,8 +306,8 @@
 	envVarsTotal++;
 	if (envVarsTotal > envVarsSize) {
 		newEnvVarsSize = envVarsTotal * 2;
-		tmpEnvVars = realloc(envVars, sizeof (*envVars) *
-		    newEnvVarsSize);
+		tmpEnvVars = reallocarray(envVars, newEnvVarsSize,
+		    sizeof(*envVars));
 		if (tmpEnvVars == NULL) {
 			envVarsTotal--;
 			return (false);