From 7551cb9ee9b13da9c03b56b643f813303c8056c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= <mpg@elzevir.fr>
Date: Tue, 26 May 2015 16:04:06 +0200
Subject: [PATCH] Replace malloc with calloc

- platform layer currently broken (not adapted yet)
- memmory_buffer_alloc too
---
 include/mbedtls/config.h             |  2 +-
 library/asn1parse.c                  |  4 ++--
 library/asn1write.c                  | 10 ++++----
 library/bignum.c                     | 10 +++-----
 library/cipher_wrap.c                | 18 +++++++-------
 library/dhm.c                        |  4 ++--
 library/ecp.c                        | 11 +++------
 library/md.c                         |  4 ++--
 library/md_wrap.c                    | 20 ++++++++--------
 library/memory_buffer_alloc.c        | 24 +++++++++----------
 library/pem.c                        |  6 ++---
 library/pk_wrap.c                    | 10 ++++----
 library/pkcs11.c                     |  4 ++--
 library/pkparse.c                    |  4 ++--
 library/pkwrite.c                    |  2 +-
 library/ssl_cache.c                  |  8 +++----
 library/ssl_cli.c                    |  6 ++---
 library/ssl_cookie.c                 |  2 +-
 library/ssl_srv.c                    |  8 +++----
 library/ssl_ticket.c                 |  5 ++--
 library/ssl_tls.c                    | 36 ++++++++++++++--------------
 library/x509.c                       |  8 +++----
 library/x509_crl.c                   |  8 +++----
 library/x509_crt.c                   |  8 +++----
 library/x509_csr.c                   |  4 ++--
 programs/ssl/ssl_server2.c           | 12 +++++-----
 programs/test/benchmark.c            |  1 +
 programs/util/pem2der.c              |  4 ++--
 tests/suites/helpers.function        |  6 ++---
 tests/suites/main_test.function      |  2 +-
 tests/suites/test_suite_pem.function |  2 +-
 31 files changed, 122 insertions(+), 131 deletions(-)

diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 466e3374d..bd28406ec 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -1986,7 +1986,7 @@
  *
  * This module enables abstraction of common (libc) functions.
  */
-#define MBEDTLS_PLATFORM_C
+//#define MBEDTLS_PLATFORM_C
 
 /**
  * \def MBEDTLS_RIPEMD160_C
diff --git a/library/asn1parse.c b/library/asn1parse.c
index a399a7f41..ae392bb7f 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -270,7 +270,7 @@ int mbedtls_asn1_get_sequence_of( unsigned char **p,
         /* Allocate and assign next pointer */
         if( *p < end )
         {
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_ASN1_MALLOC_FAILED );
diff --git a/library/asn1write.c b/library/asn1write.c
index 5219fcfec..7862961f7 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -313,13 +313,13 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
     {
         // Add new entry if not present yet based on OID
         //
-        if( ( cur = mbedtls_malloc( sizeof(mbedtls_asn1_named_data) ) ) == NULL )
+        if( ( cur = mbedtls_calloc( 1, sizeof(mbedtls_asn1_named_data) ) ) == NULL )
             return( NULL );
 
         memset( cur, 0, sizeof(mbedtls_asn1_named_data) );
 
         cur->oid.len = oid_len;
-        cur->oid.p = mbedtls_malloc( oid_len );
+        cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
         {
             mbedtls_free( cur );
@@ -329,7 +329,7 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
         memcpy( cur->oid.p, oid, oid_len );
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
@@ -348,7 +348,7 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
         cur->val.p = NULL;
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
diff --git a/library/bignum.c b/library/bignum.c
index 977609218..b65858dbc 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -46,7 +46,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -109,11 +109,9 @@ int mbedtls_mpi_grow( mbedtls_mpi *X, size_t nblimbs )
 
     if( X->n < nblimbs )
     {
-        if( ( p = mbedtls_malloc( nblimbs * ciL ) ) == NULL )
+        if( ( p = mbedtls_calloc( nblimbs, ciL ) ) == NULL )
             return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-        memset( p, 0, nblimbs * ciL );
-
         if( X->p != NULL )
         {
             memcpy( p, X->p, X->n * ciL );
@@ -149,11 +147,9 @@ int mbedtls_mpi_shrink( mbedtls_mpi *X, size_t nblimbs )
     if( i < nblimbs )
         i = nblimbs;
 
-    if( ( p = mbedtls_malloc( i * ciL ) ) == NULL )
+    if( ( p = mbedtls_calloc( i, ciL ) ) == NULL )
         return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-    memset( p, 0, i * ciL );
-
     if( X->p != NULL )
     {
         memcpy( p, X->p, i * ciL );
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index 490f9816d..59d77df45 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -70,7 +70,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -78,7 +78,7 @@
 /* shared by all GCM ciphers */
 static void *gcm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_gcm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_gcm_context ) );
 }
 
 static void gcm_ctx_free( void *ctx )
@@ -92,7 +92,7 @@ static void gcm_ctx_free( void *ctx )
 /* shared by all CCM ciphers */
 static void *ccm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_ccm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_ccm_context ) );
 }
 
 static void ccm_ctx_free( void *ctx )
@@ -153,7 +153,7 @@ static int aes_setkey_enc_wrap( void *ctx, const unsigned char *key,
 
 static void * aes_ctx_alloc( void )
 {
-    mbedtls_aes_context *aes = mbedtls_malloc( sizeof( mbedtls_aes_context ) );
+    mbedtls_aes_context *aes = mbedtls_calloc( 1, sizeof( mbedtls_aes_context ) );
 
     if( aes == NULL )
         return( NULL );
@@ -510,7 +510,7 @@ static int camellia_setkey_enc_wrap( void *ctx, const unsigned char *key,
 static void * camellia_ctx_alloc( void )
 {
     mbedtls_camellia_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_camellia_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_camellia_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -897,7 +897,7 @@ static int des3_set3key_enc_wrap( void *ctx, const unsigned char *key,
 
 static void * des_ctx_alloc( void )
 {
-    mbedtls_des_context *des = mbedtls_malloc( sizeof( mbedtls_des_context ) );
+    mbedtls_des_context *des = mbedtls_calloc( 1, sizeof( mbedtls_des_context ) );
 
     if( des == NULL )
         return( NULL );
@@ -916,7 +916,7 @@ static void des_ctx_free( void *ctx )
 static void * des3_ctx_alloc( void )
 {
     mbedtls_des3_context *des3;
-    des3 = mbedtls_malloc( sizeof( mbedtls_des3_context ) );
+    des3 = mbedtls_calloc( 1, sizeof( mbedtls_des3_context ) );
 
     if( des3 == NULL )
         return( NULL );
@@ -1115,7 +1115,7 @@ static int blowfish_setkey_wrap( void *ctx, const unsigned char *key,
 static void * blowfish_ctx_alloc( void )
 {
     mbedtls_blowfish_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_blowfish_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_blowfish_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -1225,7 +1225,7 @@ static int arc4_setkey_wrap( void *ctx, const unsigned char *key,
 static void * arc4_ctx_alloc( void )
 {
     mbedtls_arc4_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_arc4_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_arc4_context ) );
 
     if( ctx == NULL )
         return( NULL );
diff --git a/library/dhm.c b/library/dhm.c
index f09592a92..af7088597 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -51,7 +51,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -531,7 +531,7 @@ static int load_file( const char *path, unsigned char **buf, size_t *n )
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_DHM_MALLOC_FAILED );
diff --git a/library/ecp.c b/library/ecp.c
index 003ed5923..37c2472b5 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -59,7 +59,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -790,12 +790,10 @@ static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
     if( t_len < 2 )
         return( ecp_normalize_jac( grp, *T ) );
 
-    if( ( c = mbedtls_malloc( t_len * sizeof( mbedtls_mpi ) ) ) == NULL )
+    if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
         return( MBEDTLS_ERR_ECP_MALLOC_FAILED );
 
     mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
-    for( i = 0; i < t_len; i++ )
-        mbedtls_mpi_init( &c[i] );
 
     /*
      * c[i] = Z_0 * ... * Z_i
@@ -1363,16 +1361,13 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
 
     if( T == NULL )
     {
-        T = mbedtls_malloc( pre_len * sizeof( mbedtls_ecp_point ) );
+        T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
         if( T == NULL )
         {
             ret = MBEDTLS_ERR_ECP_MALLOC_FAILED;
             goto cleanup;
         }
 
-        for( i = 0; i < pre_len; i++ )
-            mbedtls_ecp_point_init( &T[i] );
-
         MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
 
         if( p_eq_g )
diff --git a/library/md.c b/library/md.c
index 8359d05af..dfa4526dd 100644
--- a/library/md.c
+++ b/library/md.c
@@ -39,7 +39,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -216,7 +216,7 @@ int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_inf
 
     if( hmac != 0 )
     {
-        ctx->hmac_ctx = mbedtls_malloc( 2 * md_info->block_size );
+        ctx->hmac_ctx = mbedtls_calloc( 2, md_info->block_size );
         if( ctx->hmac_ctx == NULL )
         {
             md_info->ctx_free_func( ctx->md_ctx );
diff --git a/library/md_wrap.c b/library/md_wrap.c
index 9a9d19109..4f12ed6b1 100644
--- a/library/md_wrap.c
+++ b/library/md_wrap.c
@@ -66,7 +66,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -106,7 +106,7 @@ static int md2_file_wrap( const char *path, unsigned char *output )
 
 static void * md2_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md2_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md2_context ) );
 }
 
 static void md2_ctx_free( void *ctx )
@@ -170,7 +170,7 @@ static int md4_file_wrap( const char *path, unsigned char *output )
 
 static void *md4_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md4_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md4_context ) );
 }
 
 static void md4_ctx_free( void *ctx )
@@ -232,7 +232,7 @@ static int md5_file_wrap( const char *path, unsigned char *output )
 
 static void * md5_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md5_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md5_context ) );
 }
 
 static void md5_ctx_free( void *ctx )
@@ -295,7 +295,7 @@ static int ripemd160_file_wrap( const char *path, unsigned char *output )
 static void * ripemd160_ctx_alloc( void )
 {
     mbedtls_ripemd160_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_ripemd160_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_ripemd160_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -365,7 +365,7 @@ static int sha1_file_wrap( const char *path, unsigned char *output )
 static void * sha1_ctx_alloc( void )
 {
     mbedtls_sha1_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha1_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha1_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -443,7 +443,7 @@ static int sha224_file_wrap( const char *path, unsigned char *output )
 
 static void * sha224_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 }
 
 static void sha224_ctx_free( void *ctx )
@@ -508,7 +508,7 @@ static int sha256_file_wrap( const char *path, unsigned char *output )
 static void * sha256_ctx_alloc( void )
 {
     mbedtls_sha256_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -583,7 +583,7 @@ static int sha384_file_wrap( const char *path, unsigned char *output )
 
 static void * sha384_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 }
 
 static void sha384_ctx_free( void *ctx )
@@ -648,7 +648,7 @@ static int sha512_file_wrap( const char *path, unsigned char *output )
 static void * sha512_ctx_alloc( void )
 {
     mbedtls_sha512_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 
     if( ctx == NULL )
         return( NULL );
diff --git a/library/memory_buffer_alloc.c b/library/memory_buffer_alloc.c
index 8918c5cdf..38b105082 100644
--- a/library/memory_buffer_alloc.c
+++ b/library/memory_buffer_alloc.c
@@ -649,9 +649,9 @@ int mbedtls_memory_buffer_alloc_self_test( int verbose )
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( 1 );
-    q = mbedtls_malloc( 128 );
-    r = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, 1 );
+    q = mbedtls_calloc( 1, 128 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -678,9 +678,9 @@ int mbedtls_memory_buffer_alloc_self_test( int verbose )
 
     TEST_ASSERT( heap.buf + heap.len == end );
 
-    p = mbedtls_malloc( 1 );
-    q = mbedtls_malloc( 128 );
-    r = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, 1 );
+    q = mbedtls_calloc( 1, 128 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -702,22 +702,22 @@ int mbedtls_memory_buffer_alloc_self_test( int verbose )
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( sizeof( buf ) - sizeof( memory_header ) );
+    p = mbedtls_calloc( 1, sizeof( buf ) - sizeof( memory_header ) );
 
     TEST_ASSERT( check_pointer( p ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( p );
 
-    p = mbedtls_malloc( sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
-    q = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
+    q = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 && check_pointer( q ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( q );
 
-    TEST_ASSERT( mbedtls_malloc( 17 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 17 ) == NULL );
 
     mbedtls_free( p );
 
diff --git a/library/pem.c b/library/pem.c
index c97e800aa..ed6747af1 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -41,7 +41,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -321,7 +321,7 @@ int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const
     if( ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER )
         return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
 
-    if( ( buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_decode( buf, &len, s1, s2 - s1 ) ) != 0 )
@@ -407,7 +407,7 @@ int mbedtls_pem_write_buffer( const char *header, const char *footer,
         return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
     }
 
-    if( ( encode_buf = mbedtls_malloc( use_len ) ) == NULL )
+    if( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_encode( encode_buf, &use_len, der_data,
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index 7a4751167..7012b127c 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -46,7 +46,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -134,7 +134,7 @@ static int rsa_check_pair_wrap( const void *pub, const void *prv )
 
 static void *rsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_context ) );
 
     if( ctx != NULL )
         mbedtls_rsa_init( (mbedtls_rsa_context *) ctx, 0, 0 );
@@ -250,7 +250,7 @@ static int eckey_check_pair( const void *pub, const void *prv )
 
 static void *eckey_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecp_keypair ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
 
     if( ctx != NULL )
         mbedtls_ecp_keypair_init( ctx );
@@ -349,7 +349,7 @@ static int ecdsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
 
 static void *ecdsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecdsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_context ) );
 
     if( ctx != NULL )
         mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
@@ -458,7 +458,7 @@ static int rsa_alt_check_pair( const void *pub, const void *prv )
 
 static void *rsa_alt_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_alt_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_alt_context ) );
 
     if( ctx != NULL )
         memset( ctx, 0, sizeof( mbedtls_rsa_alt_context ) );
diff --git a/library/pkcs11.c b/library/pkcs11.c
index e2ad9890b..b3a3be6c3 100644
--- a/library/pkcs11.c
+++ b/library/pkcs11.c
@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -64,7 +64,7 @@ int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t
         goto cleanup;
     }
 
-    cert_blob = mbedtls_malloc( cert_blob_size );
+    cert_blob = mbedtls_calloc( 1, cert_blob_size );
     if( NULL == cert_blob )
     {
         ret = 4;
diff --git a/library/pkparse.c b/library/pkparse.c
index f8800f81f..254a04d13 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -57,7 +57,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -93,7 +93,7 @@ int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n )
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_PK_MALLOC_FAILED );
diff --git a/library/pkwrite.c b/library/pkwrite.c
index 6c982ee09..a8cbd6b95 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index ca42b7ab3..6a20cd328 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -103,7 +103,7 @@ int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session )
          */
         if( entry->peer_cert.p != NULL )
         {
-            if( ( session->peer_cert = mbedtls_malloc(
+            if( ( session->peer_cert = mbedtls_calloc( 1,
                                  sizeof(mbedtls_x509_crt) ) ) == NULL )
             {
                 ret = 1;
@@ -222,7 +222,7 @@ int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
             /*
              * max_entries not reached, create new entry
              */
-            cur = mbedtls_malloc( sizeof(mbedtls_ssl_cache_entry) );
+            cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
             if( cur == NULL )
             {
                 ret = 1;
@@ -259,7 +259,7 @@ int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
      */
     if( session->peer_cert != NULL )
     {
-        cur->peer_cert.p = mbedtls_malloc( session->peer_cert->raw.len );
+        cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
         if( cur->peer_cert.p == NULL )
         {
             ret = 1;
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index b935f596f..25a5d0035 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -38,7 +38,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -1151,7 +1151,7 @@ static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
 
     mbedtls_free( ssl->handshake->verify_cookie );
 
-    ssl->handshake->verify_cookie = mbedtls_malloc( cookie_len );
+    ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
     if( ssl->handshake->verify_cookie  == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", cookie_len ) );
@@ -2911,7 +2911,7 @@ static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
     ssl->session_negotiate->ticket = NULL;
     ssl->session_negotiate->ticket_len = 0;
 
-    if( ( ticket = mbedtls_malloc( ticket_len ) ) == NULL )
+    if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket malloc failed" ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/ssl_cookie.c b/library/ssl_cookie.c
index 7663e3606..8b993ac1c 100644
--- a/library/ssl_cookie.c
+++ b/library/ssl_cookie.c
@@ -38,7 +38,7 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 08f228bec..d2b585bd0 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -42,7 +42,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -67,7 +67,7 @@ int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
 
     mbedtls_free( ssl->cli_id );
 
-    if( ( ssl->cli_id = mbedtls_malloc( ilen ) ) == NULL )
+    if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
     memcpy( ssl->cli_id, info, ilen );
@@ -263,11 +263,9 @@ static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
     if( our_size > MBEDTLS_ECP_DP_MAX )
         our_size = MBEDTLS_ECP_DP_MAX;
 
-    if( ( curves = mbedtls_malloc( our_size * sizeof( *curves ) ) ) == NULL )
+    if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
-    /* explicit void pointer cast for buggy MS compiler */
-    memset( (void *) curves, 0, our_size * sizeof( *curves ) );
     ssl->handshake->curves = curves;
 
     p = buf + 2;
diff --git a/library/ssl_ticket.c b/library/ssl_ticket.c
index 80a0356d8..7b7621862 100644
--- a/library/ssl_ticket.c
+++ b/library/ssl_ticket.c
@@ -33,7 +33,8 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#include <stdlib.h>
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -243,7 +244,7 @@ static int ssl_load_session( mbedtls_ssl_session *session,
         if( p + cert_len > end )
             return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-        session->peer_cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( session->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index f22c56186..e35382955 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -173,7 +173,7 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
     {
         int ret;
 
-        dst->peer_cert = mbedtls_malloc( sizeof(mbedtls_x509_crt) );
+        dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
         if( dst->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -192,7 +192,7 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
     if( src->ticket != NULL )
     {
-        dst->ticket = mbedtls_malloc( src->ticket_len );
+        dst->ticket = mbedtls_calloc( 1, src->ticket_len );
         if( dst->ticket == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -929,7 +929,7 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
         if( ssl->compress_buf == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
-            ssl->compress_buf = mbedtls_malloc( MBEDTLS_SSL_BUFFER_LEN );
+            ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
             if( ssl->compress_buf == NULL )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
@@ -2454,14 +2454,14 @@ static int ssl_flight_append( mbedtls_ssl_context *ssl )
     mbedtls_ssl_flight_item *msg;
 
     /* Allocate space for current message */
-    if( ( msg = mbedtls_malloc( sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
+    if( ( msg = mbedtls_calloc( 1, sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed",
                             sizeof( mbedtls_ssl_flight_item ) ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
-    if( ( msg->p = mbedtls_malloc( ssl->out_msglen ) ) == NULL )
+    if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed", ssl->out_msglen ) );
         mbedtls_free( msg );
@@ -2924,7 +2924,7 @@ static int ssl_reassemble_dtls_handshake( mbedtls_ssl_context *ssl )
         /* The bitmask needs one bit per byte of message excluding header */
         alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
 
-        ssl->handshake->hs_msg = mbedtls_malloc( alloc_len );
+        ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len );
         if( ssl->handshake->hs_msg == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", alloc_len ) );
@@ -3975,7 +3975,7 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
         mbedtls_free( ssl->session_negotiate->peer_cert );
     }
 
-    if( ( ssl->session_negotiate->peer_cert = mbedtls_malloc(
+    if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
                     sizeof( mbedtls_x509_crt ) ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
@@ -4898,17 +4898,17 @@ static int ssl_handshake_init( mbedtls_ssl_context *ssl )
      */
     if( ssl->transform_negotiate == NULL )
     {
-        ssl->transform_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_transform) );
+        ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
     }
 
     if( ssl->session_negotiate == NULL )
     {
-        ssl->session_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_session) );
+        ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
     }
 
     if( ssl->handshake == NULL )
     {
-        ssl->handshake = mbedtls_malloc( sizeof(mbedtls_ssl_handshake_params) );
+        ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
     }
 
     /* All pointers should exist and can be directly freed without issue */
@@ -5002,8 +5002,8 @@ int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
     /*
      * Prepare base structures
      */
-    if( ( ssl-> in_buf = mbedtls_malloc( len ) ) == NULL ||
-        ( ssl->out_buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
+        ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
         mbedtls_free( ssl->in_buf );
@@ -5309,7 +5309,7 @@ static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
 {
     mbedtls_ssl_key_cert *new;
 
-    new = mbedtls_malloc( sizeof( mbedtls_ssl_key_cert ) );
+    new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
     if( new == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -5384,8 +5384,8 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
         mbedtls_free( conf->psk_identity );
     }
 
-    if( ( conf->psk = mbedtls_malloc( psk_len ) ) == NULL ||
-        ( conf->psk_identity = mbedtls_malloc( psk_identity_len ) ) == NULL )
+    if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
+        ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
     {
         mbedtls_free( conf->psk );
         conf->psk = NULL;
@@ -5413,7 +5413,7 @@ int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
     if( ssl->handshake->psk != NULL )
         mbedtls_free( ssl->conf->psk );
 
-    if( ( ssl->handshake->psk = mbedtls_malloc( psk_len ) ) == NULL )
+    if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
     {
         mbedtls_free( ssl->handshake->psk );
         ssl->handshake->psk = NULL;
@@ -5492,7 +5492,7 @@ int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
     if( hostname_len + 1 == 0 )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    ssl->hostname = mbedtls_malloc( hostname_len + 1 );
+    ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
 
     if( ssl->hostname == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/x509.c b/library/x509.c
index a3e288b89..3cddc5f46 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -55,7 +55,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #define mbedtls_snprintf   snprintf
 #endif
@@ -452,7 +452,7 @@ int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
             /* Mark this item as being no the only one in a set */
             cur->next_merged = 1;
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
@@ -468,7 +468,7 @@ int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
         if( *p == end )
             return( 0 );
 
-        cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+        cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
         if( cur->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
@@ -597,7 +597,7 @@ int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x50
     {
         mbedtls_pk_rsassa_pss_options *pss_opts;
 
-        pss_opts = mbedtls_malloc( sizeof( mbedtls_pk_rsassa_pss_options ) );
+        pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
         if( pss_opts == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
diff --git a/library/x509_crl.c b/library/x509_crl.c
index e193919b3..5c2c7d5ec 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -238,7 +238,7 @@ static int x509_get_entries( unsigned char **p,
 
         if( *p < end )
         {
-            cur_entry->next = mbedtls_malloc( sizeof( mbedtls_x509_crl_entry ) );
+            cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
@@ -281,7 +281,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
 
     if( crl->version != 0 && crl->next == NULL )
     {
-        crl->next = mbedtls_malloc( sizeof( mbedtls_x509_crl ) );
+        crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
 
         if( crl->next == NULL )
         {
@@ -296,7 +296,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
     /*
      * Copy raw DER-encoded CRL
      */
-    if( ( p = mbedtls_malloc( buflen ) ) == NULL )
+    if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
     memcpy( p, buf, buflen );
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 11eb7cf18..849ea7bd9 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -53,7 +53,7 @@
 #else
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -359,7 +359,7 @@ static int x509_get_subject_alt_name( unsigned char **p,
             if( cur->next != NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
@@ -553,7 +553,7 @@ static int x509_crt_parse_der_core( mbedtls_x509_crt *crt, const unsigned char *
     if( crt == NULL || buf == NULL )
         return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
 
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
@@ -808,7 +808,7 @@ int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *bu
      */
     if( crt->version != 0 && crt->next == NULL )
     {
-        crt->next = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
diff --git a/library/x509_csr.c b/library/x509_csr.c
index ebf88974b..4347fbb79 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -113,7 +113,7 @@ int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr,
     /*
      * first copy the raw DER data
      */
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
 
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 7982ae9c9..78632a5be 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -31,7 +31,7 @@
 #else
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_fprintf    fprintf
 #define mbedtls_printf     printf
 #endif
@@ -493,7 +493,7 @@ sni_entry *sni_parse( char *sni_string )
 
     while( p <= end )
     {
-        if( ( new = mbedtls_malloc( sizeof( sni_entry ) ) ) == NULL )
+        if( ( new = mbedtls_calloc( 1, sizeof( sni_entry ) ) ) == NULL )
         {
             sni_free( cur );
             return( NULL );
@@ -501,8 +501,8 @@ sni_entry *sni_parse( char *sni_string )
 
         memset( new, 0, sizeof( sni_entry ) );
 
-        if( ( new->cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) ) ) == NULL ||
-            ( new->key = mbedtls_malloc( sizeof( mbedtls_pk_context ) ) ) == NULL )
+        if( ( new->cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL ||
+            ( new->key = mbedtls_calloc( 1, sizeof( mbedtls_pk_context ) ) ) == NULL )
         {
             mbedtls_free( new->cert );
             mbedtls_free( new );
@@ -643,7 +643,7 @@ psk_entry *psk_parse( char *psk_string )
 
     while( p <= end )
     {
-        if( ( new = mbedtls_malloc( sizeof( psk_entry ) ) ) == NULL )
+        if( ( new = mbedtls_calloc( 1, sizeof( psk_entry ) ) ) == NULL )
             goto error;
 
         memset( new, 0, sizeof( psk_entry ) );
@@ -2007,7 +2007,7 @@ data_exchange:
                 ori_len = ret;
                 extra_len = mbedtls_ssl_get_bytes_avail( &ssl );
 
-                larger_buf = mbedtls_malloc( ori_len + extra_len + 1 );
+                larger_buf = mbedtls_calloc( 1, ori_len + extra_len + 1 );
                 if( larger_buf == NULL )
                 {
                     mbedtls_printf( "  ! memory allocation failed\n" );
diff --git a/programs/test/benchmark.c b/programs/test/benchmark.c
index 0ec2b45ff..ca08f5425 100644
--- a/programs/test/benchmark.c
+++ b/programs/test/benchmark.c
@@ -45,6 +45,7 @@ int main( void )
 #else
 
 #include <string.h>
+#include <stdlib.h>
 
 #include "mbedtls/timing.h"
 
diff --git a/programs/util/pem2der.c b/programs/util/pem2der.c
index bedbcd99c..c9b511d19 100644
--- a/programs/util/pem2der.c
+++ b/programs/util/pem2der.c
@@ -31,7 +31,7 @@
 #else
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #endif
 
@@ -136,7 +136,7 @@ static int load_file( const char *path, unsigned char **buf, size_t *n )
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( -1 );
diff --git a/tests/suites/helpers.function b/tests/suites/helpers.function
index 6977cfab7..b9f01ade6 100644
--- a/tests/suites/helpers.function
+++ b/tests/suites/helpers.function
@@ -4,7 +4,7 @@
 #include <stdio.h>
 #define mbedtls_printf     printf
 #define mbedtls_fprintf    fprintf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #define mbedtls_exit       exit
 #define mbedtls_fprintf    fprintf
@@ -123,7 +123,7 @@ static unsigned char *zero_alloc( size_t len )
     void *p;
     size_t actual_len = ( len != 0 ) ? len : 1;
 
-    p = mbedtls_malloc( actual_len );
+    p = mbedtls_calloc( 1, actual_len );
     assert( p != NULL );
 
     memset( p, 0x00, actual_len );
@@ -150,7 +150,7 @@ static unsigned char *unhexify_alloc( const char *ibuf, size_t *olen )
     if( *olen == 0 )
         return( zero_alloc( *olen ) );
 
-    obuf = mbedtls_malloc( *olen );
+    obuf = mbedtls_calloc( 1, *olen );
     assert( obuf != NULL );
 
     (void) unhexify( obuf, ibuf );
diff --git a/tests/suites/main_test.function b/tests/suites/main_test.function
index c4ce5802b..ecd51824f 100644
--- a/tests/suites/main_test.function
+++ b/tests/suites/main_test.function
@@ -6,7 +6,7 @@
 #include <stdio.h>
 #define mbedtls_exit       exit
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_fprintf    fprintf
 #define mbedtls_printf     printf
 #endif
diff --git a/tests/suites/test_suite_pem.function b/tests/suites/test_suite_pem.function
index 303e4fc9c..6a62bfed9 100644
--- a/tests/suites/test_suite_pem.function
+++ b/tests/suites/test_suite_pem.function
@@ -23,7 +23,7 @@ void mbedtls_pem_write_buffer( char *start, char *end, char *buf_str, char *resu
     ret = mbedtls_pem_write_buffer( start, end, buf, buf_len, NULL, 0, &olen );
     TEST_ASSERT( ret == MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
 
-    check_buf = (unsigned char *) mbedtls_malloc( olen );
+    check_buf = (unsigned char *) mbedtls_calloc( 1, olen );
     TEST_ASSERT( check_buf != NULL );
 
     memset( check_buf, 0, olen );