I believe the point tedunangst is trying to make is that if the API works something like this:<p><pre><code>  size_t sz = lib_get_buffer_size();
  char *buf = malloc(sz);
  lib_fill_buffer(buf);
</code></pre>
and there&#x27;s a bug in lib_get_buffer_size that causes it to return too small a number, but lib_fill_buffer assumes it&#x27;s big enough, you&#x27;ve got a vulnerability regardless of what language the library is written in.  This isn&#x27;t a bug in the application, because it&#x27;s doing what it was told to do.  It will be hard to spot in an audit of the library because the bug is in lib_get_buffer_size, which probably contains no unsafe blocks, while lib_fill_buffer probably looks fine.<p>It&#x27;s a deficiency in the API, which should require the buffer size to be passed to lib_fill_buffer so lib_fill_buffer doesn&#x27;t have to make any assumptions about the size.  But if you&#x27;re trying to preserve compatibility with existing C APIs, you might be stuck with APIs like this.