Oops, forgot to make the explicit connection to your comment - the TL;DR is really the last paragraph. OpenSSL is a beautiful case study in this. If it were w

Oops, forgot to make the explicit connection to your comment - the TL;DR is really the last paragraph. OpenSSL is a beautiful case study in this. If it were written in a memory-safe language, you're right that many things would still be wrong with it - the author(s) very well may have botched "heartbleed" anyway with their custom allocator, but the parade of other buffer handling errors would not have been exploitable except potentially as denials of service. The weaknesses would have at least been interesting (and less numerous, all other things being equal).