That's an argument in favor of offloading allocation/deallocation to the library's users, which is exactly the core of my, and OP's, proposals. We're saying the same thing here - developers should be able to determine/control how memory is allocated and deallocated.
> "And sometimes this stuff needs to read a JSON object or decode base64 or utf8 too, and can't because the library is too thick."
I'm losing you here. I honestly feel that my proposal is all about keeping the API as simple as humanely possible, without compromising the library's flexibility when it comes to the scenarios your mentioned earlier.
In your case:
BASE64DECODER_Decode(...)
BASE64DECODER_DecodeEx(..., allocator, deallocator)
BYTE * BASE64DECODER_GetDecodedBuffer(handle)
BASE64DECODER_Free(handle)