diff --git a/src/modules/module-client-node/client-node.c b/src/modules/module-client-node/client-node.c
index db3abbe1c..2533c360c 100644
--- a/src/modules/module-client-node/client-node.c
+++ b/src/modules/module-client-node/client-node.c
@@ -76,6 +76,11 @@ struct mix {
 	struct buffer buffers[MAX_BUFFERS];
 };
 
+struct params {
+	uint32_t n_params;
+	struct spa_pod **params;
+};
+
 struct port {
 	struct pw_impl_port *port;
 	struct node *node;
@@ -89,8 +94,7 @@ struct port {
 	struct spa_port_info info;
 	struct pw_properties *properties;
 
-	uint32_t n_params;
-	struct spa_pod **params;
+	struct params params;
 
 	unsigned int removed:1;
 	unsigned int destroyed:1;
@@ -120,8 +124,7 @@ struct node {
 
 	struct port dummy;
 
-	uint32_t n_params;
-	struct spa_pod **params;
+	struct params params;
 };
 
 struct impl {
@@ -177,6 +180,32 @@ struct impl {
 #define pw_client_node_resource_port_set_mix_info(r,...)	\
 	pw_client_node_resource(r,port_set_mix_info,1,__VA_ARGS__)
 
+static int update_params(struct params *p, uint32_t n_params, const struct spa_pod **params)
+{
+	uint32_t i;
+	for (i = 0; i < p->n_params; i++)
+		free(p->params[i]);
+	p->n_params = n_params;
+	if (p->n_params == 0) {
+		free(p->params);
+		p->params = NULL;
+	} else {
+		struct spa_pod **np;
+		np = reallocarray(p->params, p->n_params, sizeof(struct spa_pod *));
+		if (np == NULL) {
+			pw_log_error("%p: can't realloc: %m", p);
+			free(p->params);
+			p->params = NULL;
+			p->n_params = 0;
+			return -errno;
+		}
+		p->params = np;
+	}
+	for (i = 0; i < p->n_params; i++)
+		p->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
+	return 0;
+}
+
 static int
 do_port_use_buffers(struct impl *impl,
 		    enum spa_direction direction,
@@ -309,10 +338,10 @@ static int impl_node_enum_params(void *object, int seq,
 		struct spa_pod *param;
 
 		result.index = result.next++;
-		if (result.index >= this->n_params)
+		if (result.index >= this->params.n_params)
 			break;
 
-		param = this->params[result.index];
+		param = this->params.params[result.index];
 
 		if (param == NULL || !spa_pod_is_object_id(param, id))
 			continue;
@@ -472,17 +501,9 @@ do_update_port(struct node *this,
 	       const struct spa_pod **params,
 	       const struct spa_port_info *info)
 {
-	uint32_t i;
-
 	if (change_mask & PW_CLIENT_NODE_PORT_UPDATE_PARAMS) {
 		spa_log_debug(this->log, "%p: port %u update %d params", this, port->id, n_params);
-		for (i = 0; i < port->n_params; i++)
-			free(port->params[i]);
-		port->n_params = n_params;
-		port->params = realloc(port->params, port->n_params * sizeof(struct spa_pod *));
-		for (i = 0; i < port->n_params; i++) {
-			port->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
-		}
+		update_params(&port->params, n_params, params);
 	}
 
 	if (change_mask & PW_CLIENT_NODE_PORT_UPDATE_INFO) {
@@ -577,7 +598,7 @@ impl_node_port_enum_params(void *object, int seq,
 	spa_return_val_if_fail(port != NULL, -EINVAL);
 
 	pw_log_debug("%p: seq:%d port %d.%d id:%u start:%u num:%u n_params:%d",
-			this, seq, direction, port_id, id, start, num, port->n_params);
+			this, seq, direction, port_id, id, start, num, port->params.n_params);
 
 	result.id = id;
 	result.next = 0;
@@ -586,10 +607,10 @@ impl_node_port_enum_params(void *object, int seq,
 		struct spa_pod *param;
 
 		result.index = result.next++;
-		if (result.index >= port->n_params)
+		if (result.index >= port->params.n_params)
 			break;
 
-		param = port->params[result.index];
+		param = port->params.params[result.index];
 
 		if (param == NULL || !spa_pod_is_object_id(param, id))
 			continue;
@@ -951,16 +972,8 @@ client_node_update(void *data,
 	struct node *this = &impl->node;
 
 	if (change_mask & PW_CLIENT_NODE_UPDATE_PARAMS) {
-		uint32_t i;
 		pw_log_debug("%p: update %d params", this, n_params);
-
-		for (i = 0; i < this->n_params; i++)
-			free(this->params[i]);
-		this->n_params = n_params;
-		this->params = realloc(this->params, this->n_params * sizeof(struct spa_pod *));
-
-		for (i = 0; i < this->n_params; i++)
-			this->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
+		update_params(&this->params, n_params, params);
 	}
 	if (change_mask & PW_CLIENT_NODE_UPDATE_INFO) {
 		spa_node_emit_info(&this->hooks, info);
@@ -1186,12 +1199,7 @@ node_init(struct node *this,
 
 static int node_clear(struct node *this)
 {
-	uint32_t i;
-
-	for (i = 0; i < this->n_params; i++)
-		free(this->params[i]);
-	free(this->params);
-
+	update_params(&this->params, 0, NULL);
 	return 0;
 }
 
diff --git a/src/modules/module-client-node/remote-node.c b/src/modules/module-client-node/remote-node.c
index fcce40de8..c04273e95 100644
--- a/src/modules/module-client-node/remote-node.c
+++ b/src/modules/module-client-node/remote-node.c
@@ -317,8 +317,15 @@ static int add_node_update(struct node_data *data, uint32_t change_mask, uint32_
 	                        res = spa_node_enum_params_sync(node->node,
 							id, &idx, NULL, &param, &b.b);
 				if (res == 1) {
-					params = realloc(params, sizeof(struct spa_pod *) * (n_params + 1));
-					params[n_params++] = spa_pod_copy(param);
+					void *p;
+					p = reallocarray(params, n_params + 1, sizeof(struct spa_pod *));
+					if (p == NULL) {
+						res = -errno;
+						pw_log_error("realloc failed: %m");
+					} else {
+						params = p;
+						params[n_params++] = spa_pod_copy(param);
+					}
 				}
 				spa_pod_dynamic_builder_clean(&b);
 				if (res != 1)
@@ -376,8 +383,15 @@ static int add_port_update(struct node_data *data, struct pw_impl_port *port, ui
 							port->direction, port->port_id,
 							id, &idx, NULL, &param, &b.b);
 				if (res == 1) {
-					params = realloc(params, sizeof(struct spa_pod *) * (n_params + 1));
-					params[n_params++] = spa_pod_copy(param);
+					void *p;
+					p = reallocarray(params, n_params + 1, sizeof(struct spa_pod*));
+					if (p == NULL) {
+						res = -errno;
+						pw_log_error("realloc failed: %m");
+					} else {
+						params = p;
+						params[n_params++] = spa_pod_copy(param);
+					}
 				}
 				spa_pod_dynamic_builder_clean(&b);
 
diff --git a/src/modules/module-client-node/v0/client-node.c b/src/modules/module-client-node/v0/client-node.c
index 61338ee34..e71abbb14 100644
--- a/src/modules/module-client-node/v0/client-node.c
+++ b/src/modules/module-client-node/v0/client-node.c
@@ -471,8 +471,19 @@ do_update_port(struct node *this,
 		for (i = 0; i < port->n_params; i++)
 			free(port->params[i]);
 		port->n_params = n_params;
-		port->params = realloc(port->params, port->n_params * sizeof(struct spa_pod *));
-
+		if (port->n_params == 0) {
+			free(port->params);
+			port->params = NULL;
+		} else {
+			void *p;
+			p = reallocarray(port->params, port->n_params, sizeof(struct spa_pod *));
+			if (p == NULL) {
+				pw_log_error("%p: port %u can't realloc: %m", this, port_id);
+				free(port->params);
+				port->n_params = 0;
+			}
+			port->params = p;
+		}
 		for (i = 0; i < port->n_params; i++) {
 			port->params[i] = params[i] ?
 				pw_protocol_native0_pod_from_v2(this->resource->client, params[i]) : NULL;
@@ -1033,8 +1044,19 @@ client_node0_update(void *data,
 		for (i = 0; i < this->n_params; i++)
 			free(this->params[i]);
 		this->n_params = n_params;
-		this->params = realloc(this->params, this->n_params * sizeof(struct spa_pod *));
-
+		if (this->n_params == 0) {
+			free(this->params);
+			this->params = NULL;
+		} else {
+			void *p;
+			p = reallocarray(this->params, this->n_params, sizeof(struct spa_pod *));
+			if (p == NULL) {
+				pw_log_error("%p: can't realloc: %m", this);
+				free(this->params);
+				this->n_params = 0;
+			}
+			this->params = p;
+		}
 		for (i = 0; i < this->n_params; i++)
 			this->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
 	}
diff --git a/src/modules/module-protocol-native/connection.c b/src/modules/module-protocol-native/connection.c
index b810ab02a..6383024bb 100644
--- a/src/modules/module-protocol-native/connection.c
+++ b/src/modules/module-protocol-native/connection.c
@@ -156,17 +156,23 @@ static void *connection_ensure_size(struct pw_protocol_native_connection *conn,
 	int res;
 
 	if (buf->buffer_size + size > buf->buffer_maxsize) {
-		buf->buffer_maxsize = SPA_ROUND_UP_N(buf->buffer_size + size, MAX_BUFFER_SIZE);
-		buf->buffer_data = realloc(buf->buffer_data, buf->buffer_maxsize);
-		if (buf->buffer_data == NULL) {
+		void *np;
+		size_t ns;
+
+		ns = SPA_ROUND_UP_N(buf->buffer_size + size, MAX_BUFFER_SIZE);
+		np = realloc(buf->buffer_data, ns);
+		if (np == NULL) {
 			res = -errno;
+			free(buf->buffer_data);
 			buf->buffer_maxsize = 0;
 			spa_hook_list_call(&conn->listener_list,
 					struct pw_protocol_native_connection_events,
-					error, 0, -res);
+					error, 0, res);
 			errno = -res;
 			return NULL;
 		}
+		buf->buffer_maxsize = ns;
+		buf->buffer_data = np;
 		pw_log_debug("connection %p: resize buffer to %zd %zd %zd",
 			    conn, buf->buffer_size, size, buf->buffer_maxsize);
 	}
diff --git a/src/modules/module-protocol-pulse/message.c b/src/modules/module-protocol-pulse/message.c
index f0d3d7e2f..641b4ef6b 100644
--- a/src/modules/module-protocol-pulse/message.c
+++ b/src/modules/module-protocol-pulse/message.c
@@ -395,8 +395,12 @@ static int ensure_size(struct message *m, uint32_t size)
 
 	alloc = SPA_ROUND_UP_N(SPA_MAX(m->allocated + size, 4096u), 4096u);
 	diff = alloc - m->allocated;
-	if ((data = realloc(m->data, alloc)) == NULL)
+	if ((data = realloc(m->data, alloc)) == NULL) {
+		free(m->data);
+		m->stat->allocated -= m->allocated;
+		m->allocated = 0;
 		return -errno;
+	}
 	m->stat->allocated += diff;
 	m->stat->accumulated += diff;
 	m->data = data;
diff --git a/src/modules/module-session-manager/client-endpoint/endpoint-stream.c b/src/modules/module-session-manager/client-endpoint/endpoint-stream.c
index e31bcbaa5..8d7f2da2b 100644
--- a/src/modules/module-session-manager/client-endpoint/endpoint-stream.c
+++ b/src/modules/module-session-manager/client-endpoint/endpoint-stream.c
@@ -185,19 +185,26 @@ int endpoint_stream_update(struct endpoint_stream *this,
 {
 	if (change_mask & PW_CLIENT_ENDPOINT_UPDATE_PARAMS) {
 		uint32_t i;
-		size_t size = n_params * sizeof(struct spa_pod *);
 
 		pw_log_debug(NAME" %p: update %d params", this, n_params);
 
 		for (i = 0; i < this->n_params; i++)
 			free(this->params[i]);
-		this->params = realloc(this->params, size);
-		if (size > 0 && !this->params) {
-			this->n_params = 0;
-			goto no_mem;
-		}
 		this->n_params = n_params;
-
+		if (this->n_params == 0) {
+			free(this->params);
+			this->params = NULL;
+		} else {
+			void *p;
+			p = reallocarray(this->params, n_params, sizeof(struct spa_pod*));
+			if (p == NULL) {
+				free(this->params);
+				this->params = NULL;
+				this->n_params = 0;
+				goto no_mem;
+			}
+			this->params = p;
+		}
 		for (i = 0; i < this->n_params; i++) {
 			this->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
 			endpoint_stream_notify_subscribed(this, i, i+1);
@@ -214,16 +221,22 @@ int endpoint_stream_update(struct endpoint_stream *this,
 			pw_properties_update(this->props, info->props);
 
 		if (info->change_mask & PW_ENDPOINT_STREAM_CHANGE_MASK_PARAMS) {
-			size_t size = info->n_params * sizeof(struct spa_param_info);
-
-			this->info.params = realloc(this->info.params, size);
-			if (size > 0 && !this->info.params) {
-				this->info.n_params = 0;
-				goto no_mem;
-			}
 			this->info.n_params = info->n_params;
-
-			memcpy(this->info.params, info->params, size);
+			if (info->n_params == 0) {
+				free(this->info.params);
+				this->info.params = NULL;
+			} else {
+				void *p;
+				p = reallocarray(this->info.params, info->n_params, sizeof(struct spa_param_info));
+				if (p == NULL) {
+					free(this->info.params);
+					this->info.params = NULL;
+					this->info.n_params = 0;
+					goto no_mem;
+				}
+				this->info.params = p;
+				memcpy(this->info.params, info->params, info->n_params * sizeof(struct spa_param_info));
+			}
 		}
 
 		if (!this->info.name)
diff --git a/src/modules/module-session-manager/client-endpoint/endpoint.c b/src/modules/module-session-manager/client-endpoint/endpoint.c
index 16e07f019..8a7863ee1 100644
--- a/src/modules/module-session-manager/client-endpoint/endpoint.c
+++ b/src/modules/module-session-manager/client-endpoint/endpoint.c
@@ -202,19 +202,26 @@ int endpoint_update(struct endpoint *this,
 {
 	if (change_mask & PW_CLIENT_ENDPOINT_UPDATE_PARAMS) {
 		uint32_t i;
-		size_t size = n_params * sizeof(struct spa_pod *);
 
 		pw_log_debug(NAME" %p: update %d params", this, n_params);
 
 		for (i = 0; i < this->n_params; i++)
 			free(this->params[i]);
-		this->params = realloc(this->params, size);
-		if (size > 0 && !this->params) {
-			this->n_params = 0;
-			goto no_mem;
-		}
 		this->n_params = n_params;
-
+		if (this->n_params == 0) {
+			free(this->params);
+			this->params = NULL;
+		} else {
+			void *p;
+			p = reallocarray(this->params, n_params, sizeof(struct spa_pod*));
+			if (p == NULL) {
+				free(this->params);
+				this->params = NULL;
+				this->n_params = 0;
+				goto no_mem;
+			}
+			this->params = p;
+		}
 		for (i = 0; i < this->n_params; i++) {
 			this->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
 			endpoint_notify_subscribed(this, i, i+1);
@@ -232,16 +239,22 @@ int endpoint_update(struct endpoint *this,
 			pw_properties_update(this->props, info->props);
 
 		if (info->change_mask & PW_ENDPOINT_CHANGE_MASK_PARAMS) {
-			size_t size = info->n_params * sizeof(struct spa_param_info);
-
-			this->info.params = realloc(this->info.params, size);
-			if (size > 0 && !this->info.params) {
-				this->info.n_params = 0;
-				goto no_mem;
-			}
 			this->info.n_params = info->n_params;
-
-			memcpy(this->info.params, info->params, size);
+			if (info->n_params == 0) {
+				free(this->info.params);
+				this->info.params = NULL;
+			} else {
+				void *p;
+				p = reallocarray(this->info.params, info->n_params, sizeof(struct spa_param_info));
+				if (p == NULL) {
+					free(this->info.params);
+					this->info.params = NULL;
+					this->info.n_params = 0;
+					goto no_mem;
+				}
+				this->info.params = p;
+				memcpy(this->info.params, info->params, info->n_params * sizeof(struct spa_param_info));
+			}
 		}
 
 		if (!this->info.name) {
diff --git a/src/modules/module-session-manager/client-session/endpoint-link.c b/src/modules/module-session-manager/client-session/endpoint-link.c
index 215cbfdb9..9048fe30c 100644
--- a/src/modules/module-session-manager/client-session/endpoint-link.c
+++ b/src/modules/module-session-manager/client-session/endpoint-link.c
@@ -198,19 +198,26 @@ int endpoint_link_update(struct endpoint_link *this,
 {
 	if (change_mask & PW_CLIENT_SESSION_UPDATE_PARAMS) {
 		uint32_t i;
-		size_t size = n_params * sizeof(struct spa_pod *);
 
 		pw_log_debug(NAME" %p: update %d params", this, n_params);
 
 		for (i = 0; i < this->n_params; i++)
 			free(this->params[i]);
-		this->params = realloc(this->params, size);
-		if (size > 0 && !this->params) {
-			this->n_params = 0;
-			goto no_mem;
-		}
 		this->n_params = n_params;
-
+		if (this->n_params == 0) {
+			free(this->params);
+			this->params = NULL;
+		} else {
+			void *p;
+			p = reallocarray(this->params, n_params, sizeof(struct spa_pod*));
+			if (p == NULL) {
+				free(this->params);
+				this->params = NULL;
+				this->n_params = 0;
+				goto no_mem;
+			}
+			this->params = p;
+		}
 		for (i = 0; i < this->n_params; i++) {
 			this->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
 			endpoint_link_notify_subscribed(this, i, i+1);
@@ -228,16 +235,22 @@ int endpoint_link_update(struct endpoint_link *this,
 			pw_properties_update(this->props, info->props);
 
 		if (info->change_mask & PW_ENDPOINT_LINK_CHANGE_MASK_PARAMS) {
-			size_t size = info->n_params * sizeof(struct spa_param_info);
-
-			this->info.params = realloc(this->info.params, size);
-			if (size > 0 && !this->info.params) {
-				this->info.n_params = 0;
-				goto no_mem;
-			}
 			this->info.n_params = info->n_params;
-
-			memcpy(this->info.params, info->params, size);
+			if (info->n_params == 0) {
+				free(this->info.params);
+				this->info.params = NULL;
+			} else {
+				void *p;
+				p = reallocarray(this->info.params, info->n_params, sizeof(struct spa_param_info));
+				if (p == NULL) {
+					free(this->info.params);
+					this->info.params = NULL;
+					this->info.n_params = 0;
+					goto no_mem;
+				}
+				this->info.params = p;
+				memcpy(this->info.params, info->params, info->n_params * sizeof(struct spa_param_info));
+			}
 		}
 
 		if (!this->info.output_endpoint_id) {
diff --git a/src/modules/module-session-manager/client-session/session.c b/src/modules/module-session-manager/client-session/session.c
index 498b9323d..681c56118 100644
--- a/src/modules/module-session-manager/client-session/session.c
+++ b/src/modules/module-session-manager/client-session/session.c
@@ -185,19 +185,26 @@ int session_update(struct session *this,
 {
 	if (change_mask & PW_CLIENT_SESSION_UPDATE_PARAMS) {
 		uint32_t i;
-		size_t size = n_params * sizeof(struct spa_pod *);
 
 		pw_log_debug(NAME" %p: update %d params", this, n_params);
 
 		for (i = 0; i < this->n_params; i++)
 			free(this->params[i]);
-		this->params = realloc(this->params, size);
-		if (size > 0 && !this->params) {
-			this->n_params = 0;
-			goto no_mem;
-		}
 		this->n_params = n_params;
-
+		if (this->n_params == 0) {
+			free(this->params);
+			this->params = NULL;
+		} else {
+			void *p;
+			p = reallocarray(this->params, n_params, sizeof(struct spa_pod*));
+			if (p == NULL) {
+				free(this->params);
+				this->params = NULL;
+				this->n_params = 0;
+				goto no_mem;
+			}
+			this->params = p;
+		}
 		for (i = 0; i < this->n_params; i++) {
 			this->params[i] = params[i] ? spa_pod_copy(params[i]) : NULL;
 			session_notify_subscribed(this, i, i+1);
@@ -209,18 +216,23 @@ int session_update(struct session *this,
 			pw_properties_update(this->props, info->props);
 
 		if (info->change_mask & PW_SESSION_CHANGE_MASK_PARAMS) {
-			size_t size = info->n_params * sizeof(struct spa_param_info);
-
-			this->info.params = realloc(this->info.params, size);
-			if (size > 0 && !this->info.params) {
-				this->info.n_params = 0;
-				goto no_mem;
-			}
 			this->info.n_params = info->n_params;
-
-			memcpy(this->info.params, info->params, size);
+			if (info->n_params == 0) {
+				free(this->info.params);
+				this->info.params = NULL;
+			} else {
+				void *p;
+				p = reallocarray(this->info.params, info->n_params, sizeof(struct spa_param_info));
+				if (p == NULL) {
+					free(this->info.params);
+					this->info.params = NULL;
+					this->info.n_params = 0;
+					goto no_mem;
+				}
+				this->info.params = p;
+				memcpy(this->info.params, info->params, info->n_params * sizeof(struct spa_param_info));
+			}
 		}
-
 		this->info.change_mask = info->change_mask;
 		pw_global_for_each_resource(this->global, emit_info, this);
 		this->info.change_mask = 0;
diff --git a/src/pipewire/introspect.c b/src/pipewire/introspect.c
index 0c7454cbb..35598a90d 100644
--- a/src/pipewire/introspect.c
+++ b/src/pipewire/introspect.c
@@ -211,10 +211,15 @@ struct pw_node_info *pw_node_info_merge(struct pw_node_info *info,
 	}
 	if (update->change_mask & PW_NODE_CHANGE_MASK_PARAMS) {
 		uint32_t i, user, n_params = update->n_params;
+		void *np;
 
-		info->params = realloc(info->params, n_params * sizeof(struct spa_param_info));
-		if (info->params == NULL)
-			n_params = 0;
+		np = reallocarray(info->params, n_params, sizeof(struct spa_param_info));
+		if (np == NULL) {
+			free(info->params);
+			info->params = NULL;
+			info->n_params = n_params = 0;
+		}
+		info->params = np;
 
 		for (i = 0; i < SPA_MIN(info->n_params, n_params); i++) {
 			user = reset ? 0 : info->params[i].user;
@@ -276,10 +281,15 @@ struct pw_port_info *pw_port_info_merge(struct pw_port_info *info,
 	}
 	if (update->change_mask & PW_PORT_CHANGE_MASK_PARAMS) {
 		uint32_t i, user, n_params = update->n_params;
+		void *np;
 
-		info->params = realloc(info->params, n_params * sizeof(struct spa_param_info));
-		if (info->params == NULL)
-			n_params = 0;
+		np = reallocarray(info->params, n_params, sizeof(struct spa_param_info));
+		if (np == NULL) {
+			free(info->params);
+			info->params = NULL;
+			info->n_params = n_params = 0;
+		}
+		info->params = np;
 
 		for (i = 0; i < SPA_MIN(info->n_params, n_params); i++) {
 			user = reset ? 0 : info->params[i].user;
@@ -431,10 +441,15 @@ struct pw_device_info *pw_device_info_merge(struct pw_device_info *info,
 	}
 	if (update->change_mask & PW_DEVICE_CHANGE_MASK_PARAMS) {
 		uint32_t i, user, n_params = update->n_params;
+		void *np;
 
-		info->params = realloc(info->params, n_params * sizeof(struct spa_param_info));
-		if (info->params == NULL)
-			n_params = 0;
+		np = reallocarray(info->params, n_params, sizeof(struct spa_param_info));
+		if (np == NULL) {
+			free(info->params);
+			info->params = NULL;
+			info->n_params = n_params = 0;
+		}
+		info->params = np;
 
 		for (i = 0; i < SPA_MIN(info->n_params, n_params); i++) {
 			user = reset ? 0 : info->params[i].user;