Index: lib/libgssapi/gss_buffer_set.c
===================================================================
--- lib/libgssapi/gss_buffer_set.c
+++ lib/libgssapi/gss_buffer_set.c
@@ -76,8 +76,8 @@
 	}
 
 	set = *buffer_set;
-	set->elements = realloc(set->elements,
-	    (set->count + 1) * sizeof(set->elements[0]));
+	set->elements = reallocarray(set->elements,
+	    (set->count + 1), sizeof(set->elements[0]));
 	if (set->elements == NULL) {
 		*minor_status = ENOMEM;
 		return (GSS_S_FAILURE);
Index: lib/libiconv_modules/ISO2022/citrus_iso2022.c
===================================================================
--- lib/libiconv_modules/ISO2022/citrus_iso2022.c
+++ lib/libiconv_modules/ISO2022/citrus_iso2022.c
@@ -259,8 +259,8 @@
 	if (!ei->recommend[i])
 		ei->recommend[i] = malloc(sizeof(_ISO2022Charset));
 	else {
-		p = realloc(ei->recommend[i],
-		    sizeof(_ISO2022Charset) * (ei->recommendsize[i] + 1));
+		p = reallocarray(ei->recommend[i], ei->recommendsize[i] + 1,
+		    sizeof(_ISO2022Charset));
 		if (!p)
 			return (_PARSEFAIL);
 		ei->recommend[i] = p;
Index: lib/libjail/jail.c
===================================================================
--- lib/libjail/jail.c
+++ lib/libjail/jail.c
@@ -250,7 +250,7 @@
 		/* Add the parameter to the list */
 		if (njp >= nlist) {
 			nlist *= 2;
-			tjp = realloc(jp, nlist * sizeof(*jp));
+			tjp = reallocarray(jp, nlist, sizeof(*jp));
 			if (tjp == NULL)
 				goto error;
 			jp = tjp;
@@ -259,7 +259,7 @@
 			goto error;
 		mib1[1] = 2;
 	}
-	jp = realloc(jp, njp * sizeof(*jp));
+	jp = reallocarray(jp, njp, sizeof(*jp));
 	*jpp = jp;
 	return (njp);
 
Index: lib/libkvm/kvm_proc.c
===================================================================
--- lib/libkvm/kvm_proc.c
+++ lib/libkvm/kvm_proc.c
@@ -721,7 +721,7 @@
 		p += strlen(p) + 1;
 		if (i >= argc) {
 			argc += argc;
-			nbufp = realloc(bufp, sizeof(char *) * argc);
+			nbufp = reallocarray(bufp, argc, sizeof(char *));
 			if (nbufp == NULL)
 				return (NULL);
 			bufp = nbufp;
Index: lib/libprocstat/libprocstat.c
===================================================================
--- lib/libprocstat/libprocstat.c
+++ lib/libprocstat/libprocstat.c
@@ -1783,7 +1783,7 @@
 			continue;
 		/* Grow argv. */
 		argc += argc;
-		argv = realloc(argv, sizeof(char *) * argc);
+		argv = reallocarray(argv, argc, sizeof(char *));
 		if (argv == NULL) {
 			warn("malloc(%zu)", sizeof(char *) * argc);
 			return (NULL);
Index: lib/libthread_db/libpthread_db.c
===================================================================
--- lib/libthread_db/libpthread_db.c
+++ lib/libthread_db/libpthread_db.c
@@ -94,8 +94,8 @@
 			ta->map_len = 20;
 			first = 1;
 		} else {
-			new = realloc(ta->map,
-			              sizeof(struct pt_map) * ta->map_len * 2);
+			new = reallocarray(ta->map, ta->map_len,
+			    2 * sizeof(struct pt_map));
 			if (new == NULL)
 				return (-1);
 			memset(new + ta->map_len, '\0', sizeof(struct pt_map) *
Index: lib/libusbhid/usage.c
===================================================================
--- lib/libusbhid/usage.c
+++ lib/libusbhid/usage.c
@@ -113,8 +113,8 @@
 			if (curpage->pagesize >= curpage->pagesizemax) {
 				curpage->pagesizemax += 10;
 				curpage->page_contents =
-					realloc(curpage->page_contents,
-						curpage->pagesizemax *
+					reallocarray(curpage->page_contents,
+						curpage->pagesizemax,
 						sizeof (struct usage_in_page));
 				if (!curpage->page_contents)
 					err(1, "realloc");
Index: lib/libutil/gr_util.c
===================================================================
--- lib/libutil/gr_util.c
+++ lib/libutil/gr_util.c
@@ -205,7 +205,7 @@
 			if (eof)
 				break;
 			while ((size_t)(q - p) >= size) {
-				if ((tmp = realloc(buf, size * 2)) == NULL) {
+				if ((tmp = reallocarray(buf, 2, size)) == NULL) {
 					warnx("group line too long");
 					goto err;
 				}
Index: lib/libutil/login_cap.c
===================================================================
--- lib/libutil/login_cap.c
+++ lib/libutil/login_cap.c
@@ -86,7 +86,7 @@
 
     if (sz <= internal_arraysz)
 	p = internal_array;
-    else if ((p = realloc(internal_array, sz * sizeof(char*))) != NULL) {
+    else if ((p = reallocarray(internal_array, sz, sizeof(char*))) != NULL) {
 	internal_arraysz = sz;
 	internal_array = p;
     }
Index: lib/libutil/login_ok.c
===================================================================
--- lib/libutil/login_ok.c
+++ lib/libutil/login_ok.c
@@ -101,7 +101,8 @@
 	    ;
 	if (*ltno >= j)
 	    lt = *ltptr;
-	else if ((lt = realloc(*ltptr, j * sizeof(struct login_time))) != NULL) {
+	else if ((lt = reallocarray(*ltptr, j, sizeof(struct login_time))) !=
+	    NULL) {
 	    *ltno = j;
 	    *ltptr = lt;
 	}
Index: lib/libutil/pw_util.c
===================================================================
--- lib/libutil/pw_util.c
+++ lib/libutil/pw_util.c
@@ -468,7 +468,7 @@
 			if (eof)
 				break;
 			while ((size_t)(q - p) >= size) {
-				if ((tmp = realloc(buf, size * 2)) == NULL) {
+				if ((tmp = reallocarray(buf, 2, size)) == NULL) {
 					warnx("passwd line too long");
 					goto err;
 				}