1 files changed, 11 insertions, 6 deletions
diff --git a/src/gc.c b/src/gc.c
index 2663e9780..78d8ee6a9 100644
--- a/src/gc.c
+++ b/src/gc.c
@@ -167,10 +167,17 @@ mrb_malloc(mrb_state *mrb, size_t len)
 void*
 mrb_calloc(mrb_state *mrb, size_t nelem, size_t len)
 {
-  void *p = mrb_realloc(mrb, 0, nelem*len);
+  void *p = NULL;
+  size_t size;
+
+  if (nelem <= SIZE_MAX / len) {
+    size = nelem * len;
+    p = mrb_realloc(mrb, 0, size);
+
+    if (p && size > 0)
+      memset(p, 0, size);
+  }
 
-  if (len > 0)
-    memset(p, 0, nelem*len);
   return p;
 }
 
@@ -239,12 +246,10 @@ unlink_free_heap_page(mrb_state *mrb, struct heap_page *page)
 static void
 add_heap(mrb_state *mrb)
 {
-  struct heap_page *page = mrb_malloc(mrb, sizeof(struct heap_page));
+  struct heap_page *page = mrb_calloc(mrb, 1, sizeof(struct heap_page));
   RVALUE *p, *e;
   struct RBasic *prev = NULL;
 
-  memset(page, 0, sizeof(struct heap_page));
-
   for (p = page->objects, e=p+HEAP_PAGE_SIZE; p<e; p++) {
     p->as.free.tt = MRB_TT_FREE;
     p->as.free.next = prev;