1 files changed, 13 insertions, 6 deletions

diff --git a/src/gc.c b/src/gc.c
index 22175a958..78d8ee6a9 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -167,10 +167,17 @@ mrb_malloc(mrb_state *mrb, size_t len)
 void*
 mrb_calloc(mrb_state *mrb, size_t nelem, size_t len)
 {
-  void *p = mrb_realloc(mrb, 0, nelem*len);
+  void *p = NULL;
+  size_t size;
+
+  if (nelem <= SIZE_MAX / len) {
+    size = nelem * len;
+    p = mrb_realloc(mrb, 0, size);
+
+    if (p && size > 0)
+      memset(p, 0, size);
+  }
 
-  if (len > 0)
-    memset(p, 0, nelem*len);
   return p;
 }
 
@@ -239,12 +246,10 @@ unlink_free_heap_page(mrb_state *mrb, struct heap_page *page)
 static void
 add_heap(mrb_state *mrb)
 {
-  struct heap_page *page = mrb_malloc(mrb, sizeof(struct heap_page));
+  struct heap_page *page = mrb_calloc(mrb, 1, sizeof(struct heap_page));
   RVALUE *p, *e;
   struct RBasic *prev = NULL;
 
-  memset(page, 0, sizeof(struct heap_page));
-
   for (p = page->objects, e=p+HEAP_PAGE_SIZE; p<e; p++) {
     p->as.free.tt = MRB_TT_FREE;
     p->as.free.next = prev;
@@ -528,6 +533,7 @@ obj_free(mrb_state *mrb, struct RBasic *obj)
       if (d->type->dfree) {
         d->type->dfree(mrb, d->data);
       }
+      mrb_gc_free_iv(mrb, (struct RObject*)obj);
     }
     break;
 
@@ -607,6 +613,7 @@ gc_gray_mark(mrb_state *mrb, struct RBasic *obj)
     break;
 
   case MRB_TT_OBJECT:
+  case MRB_TT_DATA:
     children += mrb_gc_mark_iv_size(mrb, (struct RObject*)obj);
     break;