Letting the user (try) use as much as he needs can be perfectly okay. Even if it weren't, it doesn't necessarily mean the program itself needs to impose some l

Letting the user (try) use as much as he needs can be perfectly okay. Even if it weren't, it doesn't necessarily mean the program itself needs to impose some limit to check the inputs against. There are other means, e.g. rlimits (which are enabled by default on OpenBSD). What reallocarray does is the bare minimum validation that shoud always be done. And in many cases that is enough, though not always.