xcalloc() is documented to disallow zero for its second argument:
/* Allocate zeroed memory for N elements of S bytes, with error
checking. S must be nonzero. */
void *
xcalloc (size_t n, size_t s)
This code didn't always call it properly.
Found with AFL++.
Thanks to Andrea Fioraldi for reporting the problem.
Bug #58600.
if (vars)
{
int i;
- *vars = xcalloc (sizeof (struct variable **), *n_vars);
+ *vars = xcalloc (*n_vars, sizeof (struct variable **));
for (i = 0; i < *n_vars; ++i)
{