The Only Solution was to grab a Big Fork With the actual bugs in the allocator reported and rotting in OpenSSL's RT for four years, it's painfully obvious that this is not a priority. The style of code and layers of obfuscation being preserved also demonstrated that the existing maintainers were effectively not "maintaining" the code, merely adding to it. We would never be able to clean this to the standards we expect, and to attract and involve other developers. So, we imported 1.0.1g, and started the nasty work: