harden REALLOC_ARRAY and xcalloc against size_t overflow