Coccinelle is a semantic patching tool that can automatically change C code via semantic patching. This script also replaces realloc with reallocarray as appropriate.
@@ -0,0 +1,20 @@
+// Use calloc or realloc as appropriate instead of multiply-and-alloc
+
+@malloc_to_calloc@
+expression a,b;
+@@
+- tor_malloc(a * b)
++ tor_calloc(a, b)
+@malloc_zero_to_calloc@
+expression a, b;
+- tor_malloc_zero(a * b)
+@realloc_to_reallocarray@
+expression p;
+- tor_realloc(p, a * b)
++ tor_reallocarray(p, a, b)