So, afaik, the bug is not a bug. It should be, but the language specification says it's not. To quote richard smith on a related issue (malloc(-1) succeeds):

So, afaik, the bug is not a bug. It should be, but the language specification says it's not. To quote richard smith on a related issue (malloc(-1) succeeds): " * malloc is part of the implementation, so LLVM is allowed to optimize it to allocate memory from "somewhere else". * In this case, LLVM allocates SIZE_MAX bytes of memory in some hypothetical space that exists only in its imagination. * This allocation succeeds, so the pointer is non-null, and errno is not set. * However, as a result, malloc need not actually be called at runtime. " Does this lead to silly results? Yes.