I wonder if GNU libc will ever get something like this.
> ((SIZE_MAX / nmemb) >= size)
before doing the size_t multiplication. That's no rocket science. Anyone who's worried about his size_ts overflowing should be able to come up with this.
I think the main benefit of adding functions like reallocarray is that they make the right tool for the job available by default. Plain realloc for array resizing is a timebomb in the same way as strncpy for normal strings - it will work (by accident) until it doesn't, and when it fails, it's likely to be an exploitable security hole.