unsigned long checked_mul_size(unsigned long a, unsigned long b)Multiply two allocation-size factors (typically an element count and an element size) and abort with a diagnostic instead of silently wrapping if the product overflows unsigned long — the classic "count * elem_size" integer-overflow-to-undersized-allocation bug. Use this instead of a bare '*' anywhere the multiplicands aren't both compile-time constants small enough to prove can't overflow.