Overflow checks in huge_alloc; return NULL on error