An embedded device with limited memory is already using OpenSSL for communication.

I am implementing a CMS signature verification wrapper library using OpenSSL that should work for the device.

We already have the below code which is working.

CMS_ContentInfo *cms = d2i_CMS_ContentInfo(nullptr, in, len); // allocates memory 1

if (CMS_verify(cms, nullptr, store, nullptr, nullptr, 0))
{
  ASN1_OCTET_STRING **data = CMS_get0_content(cms);
  out = OPENSSL_zalloc(len); // allocates memory 2
  memcpy(out, (*data)->data, len);
}

CMS_ContentInfo_free(cms); // frees memory 1

But it allocates redundant memory 2 times.

Any way to make OpenSSL use the input buffer itself for holding the data?