diff --git a/ChangeLog b/ChangeLog
index 28ee5d1..5ed8025 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -64,6 +64,9 @@
      mbedtls_pk_parse_public_key() and mbedtls_dhm_parse_dhm() now expect the
      length parameter to include the terminating null byte for PEM input.
    * Signature of mpi_mul_mpi() changed to make the last argument unsigned
+   * calloc() is now used instead of malloc() everywhere. API of platform
+     layer and the memory_buffer_alloc module changed accordingly.
+     (Thanks to Mansour Moufid for helping with the replacement.)
    * Change SSL_DISABLE_RENEGOTIATION config.h flag to SSL_RENEGOTIATION
      (support for renegotiation now needs explicit enabling in config.h).
    * net_connect() and net_bind() have a new 'proto' argument to choose
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 466e337..6c841ae 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -78,17 +78,17 @@
  *
  * Enable the memory allocation layer.
  *
- * By default mbed TLS uses the system-provided malloc() and free().
+ * By default mbed TLS uses the system-provided calloc() and free().
  * This allows different allocators (self-implemented or provided) to be
  * provided to the platform abstraction layer.
  *
  * Enabling MBEDTLS_PLATFORM_MEMORY without the
- * MBEDTLS_PLATFORM_{FREE,MALLOC}_MACROs will provide
- * "mbedtls_platform_set_malloc_free()" allowing you to set an alternative malloc() and
+ * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
+ * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
  * free() function pointer at runtime.
  *
  * Enabling MBEDTLS_PLATFORM_MEMORY and specifying
- * MBEDTLS_PLATFORM_{MALLOC,FREE}_MACROs will allow you to specify the
+ * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
  * alternate function at compile time.
  *
  * Requires: MBEDTLS_PLATFORM_C
@@ -100,8 +100,8 @@
 /**
  * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
  *
- * Do not assign standard functions in the platform layer (e.g. malloc() to
- * MBEDTLS_PLATFORM_STD_MALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
+ * Do not assign standard functions in the platform layer (e.g. calloc() to
+ * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
  *
  * This makes sure there are no linking errors on platforms that do not support
  * these functions. You will HAVE to provide alternatives, either at runtime
@@ -1788,7 +1788,7 @@
  * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
  *
  * Enable the buffer allocator implementation that makes use of a (stack)
- * based buffer to 'allocate' dynamic memory. (replaces malloc() and free()
+ * based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
  * calls)
  *
  * Module:  library/memory_buffer_alloc.c
@@ -1975,7 +1975,7 @@
  * \def MBEDTLS_PLATFORM_C
  *
  * Enable the platform abstraction layer that allows you to re-assign
- * functions like malloc(), free(), snprintf(), printf(), fprintf(), exit()
+ * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit()
  *
  * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
  * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
@@ -2345,7 +2345,7 @@
 
 /* Platform options */
 //#define MBEDTLS_PLATFORM_STD_MEM_HDR   <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
-//#define MBEDTLS_PLATFORM_STD_MALLOC        malloc /**< Default allocator to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_CALLOC        calloc /**< Default allocator to use, can be undefined */
 //#define MBEDTLS_PLATFORM_STD_FREE            free /**< Default free to use, can be undefined */
 //#define MBEDTLS_PLATFORM_STD_EXIT            exit /**< Default exit to use, can be undefined */
 //#define MBEDTLS_PLATFORM_STD_FPRINTF      fprintf /**< Default fprintf to use, can be undefined */
@@ -2354,7 +2354,7 @@
 
 /* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */
 /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
-//#define MBEDTLS_PLATFORM_MALLOC_MACRO        malloc /**< Default allocator macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_CALLOC_MACRO        calloc /**< Default allocator macro to use, can be undefined */
 //#define MBEDTLS_PLATFORM_FREE_MACRO            free /**< Default free macro to use, can be undefined */
 //#define MBEDTLS_PLATFORM_EXIT_MACRO            exit /**< Default exit macro to use, can be undefined */
 //#define MBEDTLS_PLATFORM_FPRINTF_MACRO      fprintf /**< Default fprintf macro to use, can be undefined */
diff --git a/include/mbedtls/memory_buffer_alloc.h b/include/mbedtls/memory_buffer_alloc.h
index 8d9af00..3408f34 100644
--- a/include/mbedtls/memory_buffer_alloc.h
+++ b/include/mbedtls/memory_buffer_alloc.h
@@ -58,10 +58,10 @@
 /**
  * \brief   Initialize use of stack-based memory allocator.
  *          The stack-based allocator does memory management inside the
- *          presented buffer and does not call malloc() and free().
- *          It sets the global mbedtls_malloc() and mbedtls_free() pointers
+ *          presented buffer and does not call calloc() and free().
+ *          It sets the global mbedtls_calloc() and mbedtls_free() pointers
  *          to its own functions.
- *          (Provided mbedtls_malloc() and mbedtls_free() are thread-safe if
+ *          (Provided mbedtls_calloc() and mbedtls_free() are thread-safe if
  *           MBEDTLS_THREADING_C is defined)
  *
  * \note    This code is not optimized and provides a straight-forward
diff --git a/include/mbedtls/platform.h b/include/mbedtls/platform.h
index 765c18f..aa97d8d 100644
--- a/include/mbedtls/platform.h
+++ b/include/mbedtls/platform.h
@@ -54,8 +54,8 @@
 #if !defined(MBEDTLS_PLATFORM_STD_FPRINTF)
 #define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use */
 #endif
-#if !defined(MBEDTLS_PLATFORM_STD_MALLOC)
-#define MBEDTLS_PLATFORM_STD_MALLOC   malloc /**< Default allocator to use */
+#if !defined(MBEDTLS_PLATFORM_STD_CALLOC)
+#define MBEDTLS_PLATFORM_STD_CALLOC   calloc /**< Default allocator to use */
 #endif
 #if !defined(MBEDTLS_PLATFORM_STD_FREE)
 #define MBEDTLS_PLATFORM_STD_FREE       free /**< Default free to use */
@@ -72,32 +72,32 @@
 /* \} name SECTION: Module settings */
 
 /*
- * The function pointers for malloc and free
+ * The function pointers for calloc and free
  */
 #if defined(MBEDTLS_PLATFORM_MEMORY)
 #if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \
-    defined(MBEDTLS_PLATFORM_MALLOC_MACRO)
+    defined(MBEDTLS_PLATFORM_CALLOC_MACRO)
 #define mbedtls_free       MBEDTLS_PLATFORM_FREE_MACRO
-#define mbedtls_malloc     MBEDTLS_PLATFORM_MALLOC_MACRO
+#define mbedtls_calloc     MBEDTLS_PLATFORM_CALLOC_MACRO
 #else
-extern void * (*mbedtls_malloc)( size_t len );
+extern void * (*mbedtls_calloc)( size_t n, size_t size );
 extern void (*mbedtls_free)( void *ptr );
 
 /**
  * \brief   Set your own memory implementation function pointers
  *
- * \param malloc_func   the malloc function implementation
+ * \param calloc_func   the calloc function implementation
  * \param free_func     the free function implementation
  *
  * \return              0 if successful
  */
-int mbedtls_platform_set_malloc_free( void * (*malloc_func)( size_t ),
+int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ),
                               void (*free_func)( void * ) );
-#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_MALLOC_MACRO */
+#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_CALLOC_MACRO */
 #else /* !MBEDTLS_PLATFORM_MEMORY */
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
-#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,MALLOC}_MACRO */
+#define mbedtls_calloc     calloc
+#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,CALLOC}_MACRO */
 
 /*
  * The function pointers for fprintf
diff --git a/library/asn1parse.c b/library/asn1parse.c
index a399a7f..563e9a7 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -270,13 +270,11 @@
         /* Allocate and assign next pointer */
         if( *p < end )
         {
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_ASN1_MALLOC_FAILED );
 
-            memset( cur->next, 0, sizeof( mbedtls_asn1_sequence ) );
-
             cur = cur->next;
         }
     }
diff --git a/library/asn1write.c b/library/asn1write.c
index 5219fcf..f5b1849 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -313,13 +313,11 @@
     {
         // Add new entry if not present yet based on OID
         //
-        if( ( cur = mbedtls_malloc( sizeof(mbedtls_asn1_named_data) ) ) == NULL )
+        if( ( cur = mbedtls_calloc( 1, sizeof(mbedtls_asn1_named_data) ) ) == NULL )
             return( NULL );
 
-        memset( cur, 0, sizeof(mbedtls_asn1_named_data) );
-
         cur->oid.len = oid_len;
-        cur->oid.p = mbedtls_malloc( oid_len );
+        cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
         {
             mbedtls_free( cur );
@@ -329,7 +327,7 @@
         memcpy( cur->oid.p, oid, oid_len );
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
@@ -348,7 +346,7 @@
         cur->val.p = NULL;
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
diff --git a/library/bignum.c b/library/bignum.c
index 9776092..b65858d 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -46,7 +46,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -109,11 +109,9 @@
 
     if( X->n < nblimbs )
     {
-        if( ( p = mbedtls_malloc( nblimbs * ciL ) ) == NULL )
+        if( ( p = mbedtls_calloc( nblimbs, ciL ) ) == NULL )
             return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-        memset( p, 0, nblimbs * ciL );
-
         if( X->p != NULL )
         {
             memcpy( p, X->p, X->n * ciL );
@@ -149,11 +147,9 @@
     if( i < nblimbs )
         i = nblimbs;
 
-    if( ( p = mbedtls_malloc( i * ciL ) ) == NULL )
+    if( ( p = mbedtls_calloc( i, ciL ) ) == NULL )
         return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-    memset( p, 0, i * ciL );
-
     if( X->p != NULL )
     {
         memcpy( p, X->p, i * ciL );
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index 490f981..59d77df 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -70,7 +70,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -78,7 +78,7 @@
 /* shared by all GCM ciphers */
 static void *gcm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_gcm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_gcm_context ) );
 }
 
 static void gcm_ctx_free( void *ctx )
@@ -92,7 +92,7 @@
 /* shared by all CCM ciphers */
 static void *ccm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_ccm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_ccm_context ) );
 }
 
 static void ccm_ctx_free( void *ctx )
@@ -153,7 +153,7 @@
 
 static void * aes_ctx_alloc( void )
 {
-    mbedtls_aes_context *aes = mbedtls_malloc( sizeof( mbedtls_aes_context ) );
+    mbedtls_aes_context *aes = mbedtls_calloc( 1, sizeof( mbedtls_aes_context ) );
 
     if( aes == NULL )
         return( NULL );
@@ -510,7 +510,7 @@
 static void * camellia_ctx_alloc( void )
 {
     mbedtls_camellia_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_camellia_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_camellia_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -897,7 +897,7 @@
 
 static void * des_ctx_alloc( void )
 {
-    mbedtls_des_context *des = mbedtls_malloc( sizeof( mbedtls_des_context ) );
+    mbedtls_des_context *des = mbedtls_calloc( 1, sizeof( mbedtls_des_context ) );
 
     if( des == NULL )
         return( NULL );
@@ -916,7 +916,7 @@
 static void * des3_ctx_alloc( void )
 {
     mbedtls_des3_context *des3;
-    des3 = mbedtls_malloc( sizeof( mbedtls_des3_context ) );
+    des3 = mbedtls_calloc( 1, sizeof( mbedtls_des3_context ) );
 
     if( des3 == NULL )
         return( NULL );
@@ -1115,7 +1115,7 @@
 static void * blowfish_ctx_alloc( void )
 {
     mbedtls_blowfish_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_blowfish_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_blowfish_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -1225,7 +1225,7 @@
 static void * arc4_ctx_alloc( void )
 {
     mbedtls_arc4_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_arc4_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_arc4_context ) );
 
     if( ctx == NULL )
         return( NULL );
diff --git a/library/dhm.c b/library/dhm.c
index f09592a..af70885 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -51,7 +51,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -531,7 +531,7 @@
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_DHM_MALLOC_FAILED );
diff --git a/library/ecp.c b/library/ecp.c
index 003ed59..37c2472 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -59,7 +59,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -790,12 +790,10 @@
     if( t_len < 2 )
         return( ecp_normalize_jac( grp, *T ) );
 
-    if( ( c = mbedtls_malloc( t_len * sizeof( mbedtls_mpi ) ) ) == NULL )
+    if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
         return( MBEDTLS_ERR_ECP_MALLOC_FAILED );
 
     mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
-    for( i = 0; i < t_len; i++ )
-        mbedtls_mpi_init( &c[i] );
 
     /*
      * c[i] = Z_0 * ... * Z_i
@@ -1363,16 +1361,13 @@
 
     if( T == NULL )
     {
-        T = mbedtls_malloc( pre_len * sizeof( mbedtls_ecp_point ) );
+        T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
         if( T == NULL )
         {
             ret = MBEDTLS_ERR_ECP_MALLOC_FAILED;
             goto cleanup;
         }
 
-        for( i = 0; i < pre_len; i++ )
-            mbedtls_ecp_point_init( &T[i] );
-
         MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
 
         if( p_eq_g )
diff --git a/library/md.c b/library/md.c
index 8359d05..dfa4526 100644
--- a/library/md.c
+++ b/library/md.c
@@ -39,7 +39,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -216,7 +216,7 @@
 
     if( hmac != 0 )
     {
-        ctx->hmac_ctx = mbedtls_malloc( 2 * md_info->block_size );
+        ctx->hmac_ctx = mbedtls_calloc( 2, md_info->block_size );
         if( ctx->hmac_ctx == NULL )
         {
             md_info->ctx_free_func( ctx->md_ctx );
diff --git a/library/md_wrap.c b/library/md_wrap.c
index 9a9d191..4f12ed6 100644
--- a/library/md_wrap.c
+++ b/library/md_wrap.c
@@ -66,7 +66,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -106,7 +106,7 @@
 
 static void * md2_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md2_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md2_context ) );
 }
 
 static void md2_ctx_free( void *ctx )
@@ -170,7 +170,7 @@
 
 static void *md4_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md4_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md4_context ) );
 }
 
 static void md4_ctx_free( void *ctx )
@@ -232,7 +232,7 @@
 
 static void * md5_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md5_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md5_context ) );
 }
 
 static void md5_ctx_free( void *ctx )
@@ -295,7 +295,7 @@
 static void * ripemd160_ctx_alloc( void )
 {
     mbedtls_ripemd160_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_ripemd160_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_ripemd160_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -365,7 +365,7 @@
 static void * sha1_ctx_alloc( void )
 {
     mbedtls_sha1_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha1_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha1_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -443,7 +443,7 @@
 
 static void * sha224_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 }
 
 static void sha224_ctx_free( void *ctx )
@@ -508,7 +508,7 @@
 static void * sha256_ctx_alloc( void )
 {
     mbedtls_sha256_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -583,7 +583,7 @@
 
 static void * sha384_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 }
 
 static void sha384_ctx_free( void *ctx )
@@ -648,7 +648,7 @@
 static void * sha512_ctx_alloc( void )
 {
     mbedtls_sha512_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 
     if( ctx == NULL )
         return( NULL );
diff --git a/library/memory_buffer_alloc.c b/library/memory_buffer_alloc.c
index 8918c5c..67c8456 100644
--- a/library/memory_buffer_alloc.c
+++ b/library/memory_buffer_alloc.c
@@ -77,7 +77,7 @@
     memory_header   *first_free;
     int             verify;
 #if defined(MBEDTLS_MEMORY_DEBUG)
-    size_t          malloc_count;
+    size_t          alloc_count;
     size_t          free_count;
     size_t          total_used;
     size_t          maximum_used;
@@ -230,10 +230,12 @@
     return( 0 );
 }
 
-static void *buffer_alloc_malloc( size_t len )
+static void *buffer_alloc_calloc( size_t n, size_t size )
 {
     memory_header *new, *cur = heap.first_free;
     unsigned char *p;
+    void *ret;
+    size_t original_len, len;
 #if defined(MBEDTLS_MEMORY_BACKTRACE)
     void *trace_buffer[MAX_BT];
     size_t trace_cnt;
@@ -242,6 +244,11 @@
     if( heap.buf == NULL || heap.first == NULL )
         return( NULL );
 
+    original_len = len = n * size;
+
+    if( n != 0 && len / n != size )
+        return( NULL );
+
     if( len % MBEDTLS_MEMORY_ALIGN_MULTIPLE )
     {
         len -= len % MBEDTLS_MEMORY_ALIGN_MULTIPLE;
@@ -271,7 +278,7 @@
     }
 
 #if defined(MBEDTLS_MEMORY_DEBUG)
-    heap.malloc_count++;
+    heap.calloc_count++;
 #endif
 
     // Found location, split block if > memory_header + 4 room left
@@ -308,7 +315,10 @@
         if( ( heap.verify & MBEDTLS_MEMORY_VERIFY_ALLOC ) && verify_chain() != 0 )
             mbedtls_exit( 1 );
 
-        return( ( (unsigned char *) cur ) + sizeof(memory_header) );
+        ret = (unsigned char *) cur + sizeof( memory_header );
+        memset( ret, 0, original_len );
+
+        return( ret );
     }
 
     p = ( (unsigned char *) cur ) + sizeof(memory_header) + len;
@@ -363,7 +373,10 @@
     if( ( heap.verify & MBEDTLS_MEMORY_VERIFY_ALLOC ) && verify_chain() != 0 )
         mbedtls_exit( 1 );
 
-    return( ( (unsigned char *) cur ) + sizeof(memory_header) );
+    ret = (unsigned char *) cur + sizeof( memory_header );
+    memset( ret, 0, original_len );
+
+    return( ret );
 }
 
 static void buffer_alloc_free( void *ptr )
@@ -503,12 +516,12 @@
 {
     mbedtls_fprintf( stderr,
                       "Current use: %zu blocks / %zu bytes, max: %zu blocks / "
-                      "%zu bytes (total %zu bytes), malloc / free: %zu / %zu\n",
+                      "%zu bytes (total %zu bytes), alloc / free: %zu / %zu\n",
                       heap.header_count, heap.total_used,
                       heap.maximum_header_count, heap.maximum_used,
                       heap.maximum_header_count * sizeof( memory_header )
                       + heap.maximum_used,
-                      heap.malloc_count, heap.free_count );
+                      heap.alloc_count, heap.free_count );
 
     if( heap.first->next == NULL )
         mbedtls_fprintf( stderr, "All memory de-allocated in stack buffer\n" );
@@ -539,12 +552,12 @@
 #endif /* MBEDTLS_MEMORY_DEBUG */
 
 #if defined(MBEDTLS_THREADING_C)
-static void *buffer_alloc_malloc_mutexed( size_t len )
+static void *buffer_alloc_calloc_mutexed( size_t n, size_t size )
 {
     void *buf;
     if( mbedtls_mutex_lock( &heap.mutex ) != 0 )
         return( NULL );
-    buf = buffer_alloc_malloc( len );
+    buf = buffer_alloc_calloc( n, size );
     if( mbedtls_mutex_unlock( &heap.mutex ) )
         return( NULL );
     return( buf );
@@ -568,10 +581,10 @@
 
 #if defined(MBEDTLS_THREADING_C)
     mbedtls_mutex_init( &heap.mutex );
-    mbedtls_platform_set_malloc_free( buffer_alloc_malloc_mutexed,
+    mbedtls_platform_set_calloc_free( buffer_alloc_calloc_mutexed,
                               buffer_alloc_free_mutexed );
 #else
-    mbedtls_platform_set_malloc_free( buffer_alloc_malloc, buffer_alloc_free );
+    mbedtls_platform_set_calloc_free( buffer_alloc_calloc, buffer_alloc_free );
 #endif
 
     if( (size_t) buf % MBEDTLS_MEMORY_ALIGN_MULTIPLE )
@@ -649,9 +662,9 @@
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( 1 );
-    q = mbedtls_malloc( 128 );
-    r = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, 1 );
+    q = mbedtls_calloc( 1, 128 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -678,9 +691,9 @@
 
     TEST_ASSERT( heap.buf + heap.len == end );
 
-    p = mbedtls_malloc( 1 );
-    q = mbedtls_malloc( 128 );
-    r = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, 1 );
+    q = mbedtls_calloc( 1, 128 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -702,22 +715,22 @@
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( sizeof( buf ) - sizeof( memory_header ) );
+    p = mbedtls_calloc( 1, sizeof( buf ) - sizeof( memory_header ) );
 
     TEST_ASSERT( check_pointer( p ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( p );
 
-    p = mbedtls_malloc( sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
-    q = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
+    q = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 && check_pointer( q ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( q );
 
-    TEST_ASSERT( mbedtls_malloc( 17 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 17 ) == NULL );
 
     mbedtls_free( p );
 
diff --git a/library/pem.c b/library/pem.c
index c97e800..ed6747a 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -41,7 +41,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -321,7 +321,7 @@
     if( ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER )
         return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
 
-    if( ( buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_decode( buf, &len, s1, s2 - s1 ) ) != 0 )
@@ -407,7 +407,7 @@
         return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
     }
 
-    if( ( encode_buf = mbedtls_malloc( use_len ) ) == NULL )
+    if( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_encode( encode_buf, &use_len, der_data,
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index 7a47511..7012b12 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -46,7 +46,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -134,7 +134,7 @@
 
 static void *rsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_context ) );
 
     if( ctx != NULL )
         mbedtls_rsa_init( (mbedtls_rsa_context *) ctx, 0, 0 );
@@ -250,7 +250,7 @@
 
 static void *eckey_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecp_keypair ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
 
     if( ctx != NULL )
         mbedtls_ecp_keypair_init( ctx );
@@ -349,7 +349,7 @@
 
 static void *ecdsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecdsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_context ) );
 
     if( ctx != NULL )
         mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
@@ -458,7 +458,7 @@
 
 static void *rsa_alt_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_alt_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_alt_context ) );
 
     if( ctx != NULL )
         memset( ctx, 0, sizeof( mbedtls_rsa_alt_context ) );
diff --git a/library/pkcs11.c b/library/pkcs11.c
index e2ad989..b3a3be6 100644
--- a/library/pkcs11.c
+++ b/library/pkcs11.c
@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -64,7 +64,7 @@
         goto cleanup;
     }
 
-    cert_blob = mbedtls_malloc( cert_blob_size );
+    cert_blob = mbedtls_calloc( 1, cert_blob_size );
     if( NULL == cert_blob )
     {
         ret = 4;
diff --git a/library/pkparse.c b/library/pkparse.c
index f8800f8..254a04d 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -57,7 +57,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -93,7 +93,7 @@
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_PK_MALLOC_FAILED );
diff --git a/library/pkwrite.c b/library/pkwrite.c
index 6c982ee..a8cbd6b 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
diff --git a/library/platform.c b/library/platform.c
index 788cd1f..e9ab302 100644
--- a/library/platform.c
+++ b/library/platform.c
@@ -31,15 +31,16 @@
 #include "mbedtls/platform.h"
 
 #if defined(MBEDTLS_PLATFORM_MEMORY)
-#if !defined(MBEDTLS_PLATFORM_STD_MALLOC)
-static void *platform_malloc_uninit( size_t len )
+#if !defined(MBEDTLS_PLATFORM_STD_CALLOC)
+static void *platform_calloc_uninit( size_t n, size_t size )
 {
-    ((void) len);
+    ((void) n);
+    ((void) size);
     return( NULL );
 }
 
-#define MBEDTLS_PLATFORM_STD_MALLOC   platform_malloc_uninit
-#endif /* !MBEDTLS_PLATFORM_STD_MALLOC */
+#define MBEDTLS_PLATFORM_STD_CALLOC   platform_calloc_uninit
+#endif /* !MBEDTLS_PLATFORM_STD_CALLOC */
 
 #if !defined(MBEDTLS_PLATFORM_STD_FREE)
 static void platform_free_uninit( void *ptr )
@@ -50,13 +51,13 @@
 #define MBEDTLS_PLATFORM_STD_FREE     platform_free_uninit
 #endif /* !MBEDTLS_PLATFORM_STD_FREE */
 
-void * (*mbedtls_malloc)( size_t ) = MBEDTLS_PLATFORM_STD_MALLOC;
+void * (*mbedtls_calloc)( size_t, size_t ) = MBEDTLS_PLATFORM_STD_CALLOC;
 void (*mbedtls_free)( void * )     = MBEDTLS_PLATFORM_STD_FREE;
 
-int mbedtls_platform_set_malloc_free( void * (*malloc_func)( size_t ),
+int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ),
                               void (*free_func)( void * ) )
 {
-    mbedtls_malloc = malloc_func;
+    mbedtls_calloc = calloc_func;
     mbedtls_free = free_func;
     return( 0 );
 }
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index ca42b7a..e05bd88 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -103,7 +103,7 @@
          */
         if( entry->peer_cert.p != NULL )
         {
-            if( ( session->peer_cert = mbedtls_malloc(
+            if( ( session->peer_cert = mbedtls_calloc( 1,
                                  sizeof(mbedtls_x509_crt) ) ) == NULL )
             {
                 ret = 1;
@@ -222,15 +222,13 @@
             /*
              * max_entries not reached, create new entry
              */
-            cur = mbedtls_malloc( sizeof(mbedtls_ssl_cache_entry) );
+            cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
             if( cur == NULL )
             {
                 ret = 1;
                 goto exit;
             }
 
-            memset( cur, 0, sizeof(mbedtls_ssl_cache_entry) );
-
             if( prv == NULL )
                 cache->chain = cur;
             else
@@ -259,7 +257,7 @@
      */
     if( session->peer_cert != NULL )
     {
-        cur->peer_cert.p = mbedtls_malloc( session->peer_cert->raw.len );
+        cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
         if( cur->peer_cert.p == NULL )
         {
             ret = 1;
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index b935f59..ec2b346 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -38,7 +38,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -1151,10 +1151,10 @@
 
     mbedtls_free( ssl->handshake->verify_cookie );
 
-    ssl->handshake->verify_cookie = mbedtls_malloc( cookie_len );
+    ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
     if( ssl->handshake->verify_cookie  == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", cookie_len ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
@@ -2911,9 +2911,9 @@
     ssl->session_negotiate->ticket = NULL;
     ssl->session_negotiate->ticket_len = 0;
 
-    if( ( ticket = mbedtls_malloc( ticket_len ) ) == NULL )
+    if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket malloc failed" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
diff --git a/library/ssl_cookie.c b/library/ssl_cookie.c
index 7663e36..8b993ac 100644
--- a/library/ssl_cookie.c
+++ b/library/ssl_cookie.c
@@ -38,7 +38,7 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 08f228b..d2b585b 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -42,7 +42,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -67,7 +67,7 @@
 
     mbedtls_free( ssl->cli_id );
 
-    if( ( ssl->cli_id = mbedtls_malloc( ilen ) ) == NULL )
+    if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
     memcpy( ssl->cli_id, info, ilen );
@@ -263,11 +263,9 @@
     if( our_size > MBEDTLS_ECP_DP_MAX )
         our_size = MBEDTLS_ECP_DP_MAX;
 
-    if( ( curves = mbedtls_malloc( our_size * sizeof( *curves ) ) ) == NULL )
+    if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
-    /* explicit void pointer cast for buggy MS compiler */
-    memset( (void *) curves, 0, our_size * sizeof( *curves ) );
     ssl->handshake->curves = curves;
 
     p = buf + 2;
diff --git a/library/ssl_ticket.c b/library/ssl_ticket.c
index 80a0356..7b76218 100644
--- a/library/ssl_ticket.c
+++ b/library/ssl_ticket.c
@@ -33,7 +33,8 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#include <stdlib.h>
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -243,7 +244,7 @@
         if( p + cert_len > end )
             return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-        session->peer_cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( session->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index f22c561..76c644b 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -173,7 +173,7 @@
     {
         int ret;
 
-        dst->peer_cert = mbedtls_malloc( sizeof(mbedtls_x509_crt) );
+        dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
         if( dst->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -192,7 +192,7 @@
 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
     if( src->ticket != NULL )
     {
-        dst->ticket = mbedtls_malloc( src->ticket_len );
+        dst->ticket = mbedtls_calloc( 1, src->ticket_len );
         if( dst->ticket == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -929,10 +929,10 @@
         if( ssl->compress_buf == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
-            ssl->compress_buf = mbedtls_malloc( MBEDTLS_SSL_BUFFER_LEN );
+            ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
             if( ssl->compress_buf == NULL )
             {
-                MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
                                     MBEDTLS_SSL_BUFFER_LEN ) );
                 return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
             }
@@ -2454,16 +2454,16 @@
     mbedtls_ssl_flight_item *msg;
 
     /* Allocate space for current message */
-    if( ( msg = mbedtls_malloc( sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
+    if( ( msg = mbedtls_calloc( 1, sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed",
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
                             sizeof( mbedtls_ssl_flight_item ) ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
-    if( ( msg->p = mbedtls_malloc( ssl->out_msglen ) ) == NULL )
+    if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed", ssl->out_msglen ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
         mbedtls_free( msg );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
@@ -2924,15 +2924,13 @@
         /* The bitmask needs one bit per byte of message excluding header */
         alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
 
-        ssl->handshake->hs_msg = mbedtls_malloc( alloc_len );
+        ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len );
         if( ssl->handshake->hs_msg == NULL )
         {
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", alloc_len ) );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", alloc_len ) );
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
         }
 
-        memset( ssl->handshake->hs_msg, 0, alloc_len );
-
         /* Prepare final header: copy msg_type, length and message_seq,
          * then add standardised fragment_offset and fragment_length */
         memcpy( ssl->handshake->hs_msg, ssl->in_msg, 6 );
@@ -3975,10 +3973,10 @@
         mbedtls_free( ssl->session_negotiate->peer_cert );
     }
 
-    if( ( ssl->session_negotiate->peer_cert = mbedtls_malloc(
+    if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
                     sizeof( mbedtls_x509_crt ) ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
                        sizeof( mbedtls_x509_crt ) ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
@@ -4898,17 +4896,17 @@
      */
     if( ssl->transform_negotiate == NULL )
     {
-        ssl->transform_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_transform) );
+        ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
     }
 
     if( ssl->session_negotiate == NULL )
     {
-        ssl->session_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_session) );
+        ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
     }
 
     if( ssl->handshake == NULL )
     {
-        ssl->handshake = mbedtls_malloc( sizeof(mbedtls_ssl_handshake_params) );
+        ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
     }
 
     /* All pointers should exist and can be directly freed without issue */
@@ -4916,7 +4914,7 @@
         ssl->transform_negotiate == NULL ||
         ssl->session_negotiate == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc() of ssl sub-contexts failed" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
 
         mbedtls_free( ssl->handshake );
         mbedtls_free( ssl->transform_negotiate );
@@ -5002,18 +5000,15 @@
     /*
      * Prepare base structures
      */
-    if( ( ssl-> in_buf = mbedtls_malloc( len ) ) == NULL ||
-        ( ssl->out_buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
+        ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", len ) );
         mbedtls_free( ssl->in_buf );
         ssl->in_buf = NULL;
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
-    memset( ssl-> in_buf, 0, len );
-    memset( ssl->out_buf, 0, len );
-
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
@@ -5309,7 +5304,7 @@
 {
     mbedtls_ssl_key_cert *new;
 
-    new = mbedtls_malloc( sizeof( mbedtls_ssl_key_cert ) );
+    new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
     if( new == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -5384,8 +5379,8 @@
         mbedtls_free( conf->psk_identity );
     }
 
-    if( ( conf->psk = mbedtls_malloc( psk_len ) ) == NULL ||
-        ( conf->psk_identity = mbedtls_malloc( psk_identity_len ) ) == NULL )
+    if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
+        ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
     {
         mbedtls_free( conf->psk );
         conf->psk = NULL;
@@ -5413,7 +5408,7 @@
     if( ssl->handshake->psk != NULL )
         mbedtls_free( ssl->conf->psk );
 
-    if( ( ssl->handshake->psk = mbedtls_malloc( psk_len ) ) == NULL )
+    if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
     {
         mbedtls_free( ssl->handshake->psk );
         ssl->handshake->psk = NULL;
@@ -5492,7 +5487,7 @@
     if( hostname_len + 1 == 0 )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    ssl->hostname = mbedtls_malloc( hostname_len + 1 );
+    ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
 
     if( ssl->hostname == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/x509.c b/library/x509.c
index a3e288b..0e998fc 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -55,7 +55,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #define mbedtls_snprintf   snprintf
 #endif
@@ -452,13 +452,11 @@
             /* Mark this item as being no the only one in a set */
             cur->next_merged = 1;
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
-            memset( cur->next, 0, sizeof( mbedtls_x509_name ) );
-
             cur = cur->next;
         }
 
@@ -468,13 +466,11 @@
         if( *p == end )
             return( 0 );
 
-        cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+        cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
         if( cur->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
-        memset( cur->next, 0, sizeof( mbedtls_x509_name ) );
-
         cur = cur->next;
     }
 }
@@ -597,7 +593,7 @@
     {
         mbedtls_pk_rsassa_pss_options *pss_opts;
 
-        pss_opts = mbedtls_malloc( sizeof( mbedtls_pk_rsassa_pss_options ) );
+        pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
         if( pss_opts == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
diff --git a/library/x509_crl.c b/library/x509_crl.c
index e193919..62d0a30 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -238,12 +238,11 @@
 
         if( *p < end )
         {
-            cur_entry->next = mbedtls_malloc( sizeof( mbedtls_x509_crl_entry ) );
+            cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
-            memset( cur_entry->next, 0, sizeof( mbedtls_x509_crl_entry ) );
             cur_entry = cur_entry->next;
         }
     }
@@ -281,7 +280,7 @@
 
     if( crl->version != 0 && crl->next == NULL )
     {
-        crl->next = mbedtls_malloc( sizeof( mbedtls_x509_crl ) );
+        crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
 
         if( crl->next == NULL )
         {
@@ -296,7 +295,7 @@
     /*
      * Copy raw DER-encoded CRL
      */
-    if( ( p = mbedtls_malloc( buflen ) ) == NULL )
+    if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
     memcpy( p, buf, buflen );
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 11eb7cf..d1749b9 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -53,7 +53,7 @@
 #else
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -359,13 +359,12 @@
             if( cur->next != NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
                         MBEDTLS_ERR_ASN1_MALLOC_FAILED );
 
-            memset( cur->next, 0, sizeof( mbedtls_asn1_sequence ) );
             cur = cur->next;
         }
 
@@ -553,7 +552,7 @@
     if( crt == NULL || buf == NULL )
         return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
 
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
@@ -808,7 +807,7 @@
      */
     if( crt->version != 0 && crt->next == NULL )
     {
-        crt->next = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
diff --git a/library/x509_csr.c b/library/x509_csr.c
index ebf8897..4347fbb 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -113,7 +113,7 @@
     /*
      * first copy the raw DER data
      */
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
 
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 7982ae9..78632a5 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -31,7 +31,7 @@
 #else
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_fprintf    fprintf
 #define mbedtls_printf     printf
 #endif
@@ -493,7 +493,7 @@
 
     while( p <= end )
     {
-        if( ( new = mbedtls_malloc( sizeof( sni_entry ) ) ) == NULL )
+        if( ( new = mbedtls_calloc( 1, sizeof( sni_entry ) ) ) == NULL )
         {
             sni_free( cur );
             return( NULL );
@@ -501,8 +501,8 @@
 
         memset( new, 0, sizeof( sni_entry ) );
 
-        if( ( new->cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) ) ) == NULL ||
-            ( new->key = mbedtls_malloc( sizeof( mbedtls_pk_context ) ) ) == NULL )
+        if( ( new->cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL ||
+            ( new->key = mbedtls_calloc( 1, sizeof( mbedtls_pk_context ) ) ) == NULL )
         {
             mbedtls_free( new->cert );
             mbedtls_free( new );
@@ -643,7 +643,7 @@
 
     while( p <= end )
     {
-        if( ( new = mbedtls_malloc( sizeof( psk_entry ) ) ) == NULL )
+        if( ( new = mbedtls_calloc( 1, sizeof( psk_entry ) ) ) == NULL )
             goto error;
 
         memset( new, 0, sizeof( psk_entry ) );
@@ -2007,7 +2007,7 @@
                 ori_len = ret;
                 extra_len = mbedtls_ssl_get_bytes_avail( &ssl );
 
-                larger_buf = mbedtls_malloc( ori_len + extra_len + 1 );
+                larger_buf = mbedtls_calloc( 1, ori_len + extra_len + 1 );
                 if( larger_buf == NULL )
                 {
                     mbedtls_printf( "  ! memory allocation failed\n" );
diff --git a/programs/test/benchmark.c b/programs/test/benchmark.c
index 0ec2b45..6262d33 100644
--- a/programs/test/benchmark.c
+++ b/programs/test/benchmark.c
@@ -45,6 +45,7 @@
 #else
 
 #include <string.h>
+#include <stdlib.h>
 
 #include "mbedtls/timing.h"
 
@@ -86,7 +87,7 @@
 #define MEM_BLOCK_OVERHEAD  ( 2 * sizeof( size_t ) )
 
 /*
- * Size to use for the malloc buffer if MEMORY_BUFFER_ALLOC_C is defined.
+ * Size to use for the alloc buffer if MEMORY_BUFFER_ALLOC_C is defined.
  */
 #define HEAP_SIZE       (1u << 16)  // 64k
 
@@ -252,7 +253,7 @@
     char title[TITLE_LEN];
     todo_list todo;
 #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
-    unsigned char malloc_buf[HEAP_SIZE] = { 0 };
+    unsigned char alloc_buf[HEAP_SIZE] = { 0 };
 #endif
 
     if( argc <= 1 )
@@ -318,7 +319,7 @@
     mbedtls_printf( "\n" );
 
 #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
-    mbedtls_memory_buffer_alloc_init( malloc_buf, sizeof( malloc_buf ) );
+    mbedtls_memory_buffer_alloc_init( alloc_buf, sizeof( alloc_buf ) );
 #endif
     memset( buf, 0xAA, sizeof( buf ) );
     memset( tmp, 0xBB, sizeof( tmp ) );
diff --git a/programs/util/pem2der.c b/programs/util/pem2der.c
index bedbcd9..c9b511d 100644
--- a/programs/util/pem2der.c
+++ b/programs/util/pem2der.c
@@ -31,7 +31,7 @@
 #else
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #endif
 
@@ -136,7 +136,7 @@
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( -1 );
diff --git a/tests/suites/helpers.function b/tests/suites/helpers.function
index 6977cfa..b9f01ad 100644
--- a/tests/suites/helpers.function
+++ b/tests/suites/helpers.function
@@ -4,7 +4,7 @@
 #include <stdio.h>
 #define mbedtls_printf     printf
 #define mbedtls_fprintf    fprintf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #define mbedtls_exit       exit
 #define mbedtls_fprintf    fprintf
@@ -123,7 +123,7 @@
     void *p;
     size_t actual_len = ( len != 0 ) ? len : 1;
 
-    p = mbedtls_malloc( actual_len );
+    p = mbedtls_calloc( 1, actual_len );
     assert( p != NULL );
 
     memset( p, 0x00, actual_len );
@@ -150,7 +150,7 @@
     if( *olen == 0 )
         return( zero_alloc( *olen ) );
 
-    obuf = mbedtls_malloc( *olen );
+    obuf = mbedtls_calloc( 1, *olen );
     assert( obuf != NULL );
 
     (void) unhexify( obuf, ibuf );
diff --git a/tests/suites/main_test.function b/tests/suites/main_test.function
index c4ce580..ecd5182 100644
--- a/tests/suites/main_test.function
+++ b/tests/suites/main_test.function
@@ -6,7 +6,7 @@
 #include <stdio.h>
 #define mbedtls_exit       exit
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_fprintf    fprintf
 #define mbedtls_printf     printf
 #endif
diff --git a/tests/suites/test_suite_pem.function b/tests/suites/test_suite_pem.function
index 303e4fc..6a62bfe 100644
--- a/tests/suites/test_suite_pem.function
+++ b/tests/suites/test_suite_pem.function
@@ -23,7 +23,7 @@
     ret = mbedtls_pem_write_buffer( start, end, buf, buf_len, NULL, 0, &olen );
     TEST_ASSERT( ret == MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
 
-    check_buf = (unsigned char *) mbedtls_malloc( olen );
+    check_buf = (unsigned char *) mbedtls_calloc( 1, olen );
     TEST_ASSERT( check_buf != NULL );
 
     memset( check_buf, 0, olen );