Related other bugs: #40535, #32702

The realloc() function does not respect the __freelist size when resizing an allocation down to 0 or 1 bytes.  If this allocation is then deallocated with free(), a __freelist entry is placed in its slot that can partially overwrite an adjacent allocation, leading to irrecoverable memory corruption.  The following code can reproduce the corruption:

// Relevant bytes in heap allocation shown in comments (User storage denoted with 0xFF)
char * resizedVar = (char*)malloc(6);       // 0x06 0x00 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
resizedVar = (char*)realloc(resizedVar, 1); // 0x01 0x00 0xFF
char * fixedVar = (char*)malloc(4);         // 0x01 0x00 0xFF 0x04 0x00 0xFF 0xFF 0xFF 0xFF
free(resizedVar);                           // 0x01 0x00 0x00 0x00 0x00 0xFF 0xFF 0xFF 0xFF
                                            //                  ^ Size of fixedVar overwritten

malloc() handles this issue with a minimum allocation size, so that requested allocations of 0, 1, or 2 bytes all take the same storage.  The same technique can be used here to prevent problems, as shown in the attached patch.