I think you are greatly exaggerating how hard it is to find invalid memory use in openssl. According to Ted Unangst, all you have to do is turn off the custom

I think you are greatly exaggerating how hard it is to find invalid memory use in openssl. According to Ted Unangst, all you have to do is turn off the custom allocator in openssl to immediately hit a use-after-free bug. He writes: "This bug would have been utterly trivial to detect when introduced had the OpenSSL developers bothered testing with a normal malloc (not even a security focused malloc, just one that frees memory every now and again). Instead, it lay dormant for years until I went looking for a way to disable their Heartbleed accelerating custom allocator." http://www.tedunangst.com/flak/post/analysis-of-openssl-freelist-reuse http://www.tedunangst.com/flak/post/analysis-of-openssl-free...