The 'new' operator in C++ has a severe bug.  According to the ANSI C++ specification, 'new' can now return NULL on failure.  The DJGPP standard operator 'new' will just exit to DOS on failure, but if it is overloaded, the operator can now return NULL.  In this case, the vftbl is written to the NULL address.

Example:

class test {
  public:
         virtual void me() {};
         void* operator new(size_t s)
         {
                  return malloc(s);
         }
};

 If malloc returns NULL, this program overwrites NULL.  This bug is somewhere in GCC.

Are you sure? This is what is told in the December -96 draft:

A new_handler shall perform one of the following:

  --make more storage available for allocation and then return;

  --throw an exception  of  type  bad_alloc  or  a  class  derived  from
    bad_alloc;

  --call either abort() or exit();

Default behavior:
    The implementation's default new_handler throws an exception of type
    bad_alloc.