> OpenSSL has an abstraction layer over malloc, which uses an internal stack-based free-list, and which it uses for all allocations To be clear, this is NOT TR

> OpenSSL has an abstraction layer over malloc, which uses an internal stack-based free-list, and which it uses for all allocations To be clear, this is NOT TRUE. The freelist is used for some allocations, but not in the patch in point. Here is the patch that addresses the bug: https://github.com/openssl/openssl/commit/731f431497f463f3a2a97236fe0187b11c44aead https://github.com/openssl/openssl/commit/731f431497f463f3a2... It clearly uses OPENSSL_Malloc which is basically the equivalent of calling malloc. https://github.com/openssl/openssl/commit/731f431497f463f3a2a97236fe0187b11c44aead#diff-38dc72994741420e2b6c5ee074941a45L1352 https://github.com/openssl/openssl/commit/731f431497f463f3a2...