This type of bug is equally well implemented with malloc(). If you take a step back then this seems to be happening because C structs are both used for data structures and for (de)serialization. In languages where the data structures are not fit to pass along to other programs as raw bytes, because e.g. they are pointers to other objects or have peculiar tagged encodings, this kind of bug is less likely to appear. In such languages, programs would instead have special routines to (de)serialize data structures.
C and Pascal are prone to this type of bug. How do D and Rust fare?