OS X 10.10 – Source Code
and they fixed a few Integer overflows
-    int size = inCapacity * sizeof(dictEntry);
+    if (inCapacity > (UINT_MAX / sizeof(dictEntry)))
+        return false;+    unsigned int size = inCapacity * sizeof(dictEntry);