Comment by ksherlock

It may be true today that calloc checks for multiplication overflow and doesn't zero memory if it doesn't need to, that's modern revisionism. Historically, calloc did not do either of those things.

eg, from the 4.4 BSD, circa 1993:

https://minnie.tuhs.org/cgi-bin/utree.pl?file=4.4BSD/usr/src...

    void *
    calloc(num, size)
     size_t num;
     register size_t size;
    {
     register void *p;
    
     size *= num;
     if (p = malloc(size))
      bzero(p, size);
     return(p);
    }