Check for integer overflow before calling sbrk(2), since it uses a

signed increment argument, but the size is an unsigned integer.

lib/libc/stdlib/malloc.c

@@ -1530,6 +1530,13 @@ static void *
 chunk_alloc_dss(size_t size)
 {
 
+	/*
+	 * sbrk() uses a signed increment argument, so take care not to
+	 * interpret a huge allocation request as a negative increment.
+	 */
+	if ((intptr_t)size < 0)
+		return (NULL);
+
 	malloc_mutex_lock(&dss_mtx);
 	if (dss_prev != (void *)-1) {
 		intptr_t incr;