> In fact, the article's conclusion that the OpenSSH team should have > rolled their own memory management code rather than use tried, > tested and approved libraries

That's not the conclusion I draw from the article.

I rather read it as warning that even innocent and quite common operations like realloc() or using buffered I/O can have security implications, so one need to be extra extra extra careful when writing code that handles sensitive data. In other words, security can be even harder than security professionals think.