I stopped looking when I saw it doesn't check for malloc failure. I am going to say space flight is a no-go.

This is quite common because the alloc() call itself would panic if out-of-memory.

Remember, a large proportion of C code is for embedded/real-time systems where the only sensible recovery option is to reset.

Attempting to 'handle' an error manually in every case is simply not possible. Better to reset and come up in a clean state than propagate errors.

Having said that, dynamic memory allocation is itself frowned upon in embedded systems.

But for this kind of application, wouldn't you just panic and do a soft restart on malloc failure anyway? Actually recovering from an out-of-memory situation is incredibly fraught and unreliable; most of the realtime operating systems I've used don't even bother to try.

That depends on when a failure were to occur. If we have a failure while the spacecraft is en route to its destination, perhaps we can recover because we may have enough time.

If we have a failure during rendezvous with our target, it could be a very bad day.

...necropost, but:

You always need to be able to recover from a soft reboot, even during maneuvers; you're in a high radiation environment and any passing high energy particle or cosmic ray can trigger this.

Dynamic memory allocation is extremely frowned-upon in embedded/real-time systems such as flight systems for exactly that reason. You simply cannot handle out-of-memory and fragmentation issues in a safe manner.

Even then you'd want proper logging and panicking over a segfault (the likely result).

In such an environment, malloc() will do that.

Thank you. There is somebody else on this fucking planet who understands that memory is not limitless manna from heaven.

Ouch. I'll keep looking then.

Any recommendations for reliable C data structures?

Don 't take this personally, but it worries me that someone who is not well versed with things like safe memory structures is tasked with writing software like this.

Don't dismiss it because of that, handling OOM errors is best handled by the alloc call by panicing.

If that situation is not allowed, I would suggest you shouldn't be performing memory allocation (or any other resource allocation) dynamically.

Give Ada a try

[Un]fortunately, we are tied to C/C++ due to mission requirements and our hardware platform.