Not checking malloc's return value can easily lead to security vulnerabilities, particularly in bytecode interpreters and things like that. The basic plan is s

Not checking malloc's return value can easily lead to security vulnerabilities, particularly in bytecode interpreters and things like that. The basic plan is simple: Trick the target program into allocating an impossible huge block of memory (e.g. 3 gigabyte on a 32 bit system). Malloc will return NULL but the program blindly assumes the allocation has succeeded. Now use carefully chosen indices to read and write whatever memory you want. As an example, here's a classic Flash exploit that used this technique: http://chargen.matasano.com/chargen/2007/7/27/this-new-vulnerability-dowds-inhuman-flash-exploit.html http://chargen.matasano.com/chargen/2007/7/27/this-new-vulne... Really, xmalloc is five lines of code. Just use it. void *xmalloc(size_t size) { void *ptr = malloc(size); if (!ptr) abort(); return ptr; }