"Integer overflow" sounds different though. Sounds like there is some computation inside e.g. malloc(a*b*c) itself, that cannot be checked after malloc returns - assert() or not. I also see we have it on SLE12?