> What's the reason for using malloc(3) in the first place? Is this a limitation of the library or just openssl cms ? It is a limitation of the CMS command. You might look at the -stream option. If you need more then that, well, a PR is also welcomed.