diff --git a/tests/suites/helpers.function b/tests/suites/helpers.function
index 2be5dcc..d656519 100644
--- a/tests/suites/helpers.function
+++ b/tests/suites/helpers.function
@@ -102,11 +102,32 @@
 }
 
 /**
+ * Allocate and zeroize a buffer.
+ *
+ * If the size if zero, a pointer to a zeroized 1-byte buffer is returned.
+ *
+ * For convenience, dies if allocation fails.
+ */
+static unsigned char *zero_alloc( size_t len )
+{
+    void *p;
+    size_t actual_len = len != 0 ? len : 1;
+
+    assert( ( p = polarssl_malloc( actual_len ) ) != NULL );
+
+    memset( p, 0x00, actual_len );
+
+    return( p );
+}
+
+/**
  * Allocate and fill a buffer from hex data.
  *
  * The buffer is sized exactly as needed. This allows to detect buffer
  * overruns (including overreads) when running the test suite under valgrind.
  *
+ * If the size if zero, a pointer to a zeroized 1-byte buffer is returned.
+ *
  * For convenience, dies if allocation fails.
  */
 static unsigned char *unhexify_alloc( const char *ibuf, size_t *olen )
@@ -115,6 +136,9 @@
 
     *olen = strlen(ibuf) / 2;
 
+    if( *olen == 0 )
+        return( zero_alloc( *olen ) );
+
     assert( ( obuf = polarssl_malloc( *olen ) ) != NULL );
 
     (void) unhexify( obuf, ibuf );
diff --git a/tests/suites/test_suite_pkcs5.function b/tests/suites/test_suite_pkcs5.function
index 5408e67..c745571 100644
--- a/tests/suites/test_suite_pkcs5.function
+++ b/tests/suites/test_suite_pkcs5.function
@@ -59,9 +59,7 @@
     data = unhexify_alloc( data_hex, &data_len );
     pw = unhexify_alloc( pw_hex, &pw_len );
     ref_out = unhexify_alloc( ref_out_hex, &ref_out_len );
-    my_out = polarssl_malloc( ref_out_len != 0 ? ref_out_len : 1 );
-    TEST_ASSERT( my_out != NULL );
-    memset( my_out, 0, ref_out_len );
+    my_out = zero_alloc( ref_out_len );
 
     my_ret = pkcs5_pbes2( &params, PKCS5_DECRYPT,
                           pw, pw_len, data, data_len, my_out );