Redis Will redis intset upgrade have memory overflow？

Hello, I am reading redis source code. When I read insert upgrade, I found that it was upgrade to expand memory backward in the current object location. Since I am not familiar with C, I put forward this question. very thanks your response.

This is a intsetUpgradeAndAdd method code.

static intset *intsetUpgradeAndAdd(intset *is, int64_t value) {
uint8_t curenc = intrev32ifbe(is->encoding);
uint8_t newenc = _intsetValueEncoding(value);
int length = intrev32ifbe(is->length);
int prepend = value < 0 ? 1 : 0;

/* First set new encoding and resize */
is->encoding = intrev32ifbe(newenc);
is = intsetResize(is,intrev32ifbe(is->length)+1);

/* Upgrade back-to-front so we don't overwrite values.
 * Note that the "prepend" variable is used to make sure we have an empty
 * space at either the beginning or the end of the intset. */
while(length--)
    _intsetSet(is,length+prepend,_intsetGetEncoded(is,length,curenc));

/* Set the value at the beginning or the end. */
if (prepend)
    _intsetSet(is,0,value);
else
    _intsetSet(is,intrev32ifbe(is->length),value);
is->length = intrev32ifbe(intrev32ifbe(is->length)+1);
return is;
}

This is the code that I find problematic.

static intset *intsetResize(intset *is, uint32_t len) {
uint32_t size = len*intrev32ifbe(is->encoding);
is = zrealloc(is,sizeof(intset)+size);
return is;
}

Comment From: ChangwangChen

You can find answer in here https://en.cppreference.com/w/c/memory/realloc