> But I guess you could also use a special malloc that randomly returns NULL to do that..
On Linux, set the sysctl vm.overcommit_memory = 2.
You can also usually instruct libc to trash freed memory as a debugging mode. But I don't know how to get glibc to do so. Valgrind is good at tracking this kind of thing as well, although slower.
Imagine running OpenSSL on this and seeing where the malloc() would fail and start garbaging the memory.
But I guess you could also use a special malloc that randomly returns NULL to do that..