MFC (deraadt):

return failure if integer overflow happens.  sigh; too people had to
help get this right.

src/lib/libc/stdlib/calloc.c

@@ -32,11 +32,13 @@
  */
 
 #if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$OpenBSD: calloc.c,v 1.5 1999/11/10 20:12:31 millert Exp $";
+static char *rcsid = "$OpenBSD: calloc.c,v 1.5.8.1 2002/07/30 07:31:20 miod Exp $";
 #endif /* LIBC_SCCS and not lint */
 
 #include <stdlib.h>
 #include <string.h>
+#include <limits.h>
+#include <errno.h>
 
 void *
 calloc(num, size)
@@ -45,6 +47,10 @@ calloc(num, size)
 {
 	register void *p;
 
+	if (SIZE_T_MAX / num < size) {
+		errno = ENOMEM;
+		return NULL;
+	}
 	size *= num;
 	p = malloc(size);
 	if (p)