> If not, why doesn't OpenSSL use an existing secure malloc library? Any extra library dependency makes OpenSSL less portable. It doubles the work needed to ge

> If not, why doesn't OpenSSL use an existing secure malloc library? Any extra library dependency makes OpenSSL less portable. It doubles the work needed to get it running on your new embedded system. shrug It may also increase the code size and attack surface (although probably a good trade-off). I don't disagree that it sounds like a good idea :).