malloc: handle size overflows in realloc()

The malloc() code checks the incoming size to make sure the header
adjustment doesn't cause overflow in the size storage.  Add the same
check to realloc() to catch stupid stuff like realloc(..., -1).

Reported-by: James Coleman <james.coleman@ubicom.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

libc/stdlib/malloc/realloc.c

@@ -34,6 +34,9 @@ realloc (void *mem, size_t new_size)
     }
   if (! mem)
     return malloc (new_size);
+  /* This matches the check in malloc() */
+  if (unlikely(((unsigned long)new_size > (unsigned long)(MALLOC_HEADER_SIZE*-2))))
+    return NULL;
 
   /* Normal realloc.  */