diff --git a/library/asn1parse.c b/library/asn1parse.c
index a399a7f..ae392bb 100644
--- a/library/asn1parse.c
+++ b/library/asn1parse.c
@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -270,7 +270,7 @@
         /* Allocate and assign next pointer */
         if( *p < end )
         {
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_ASN1_MALLOC_FAILED );
diff --git a/library/asn1write.c b/library/asn1write.c
index 5219fcf..7862961 100644
--- a/library/asn1write.c
+++ b/library/asn1write.c
@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -313,13 +313,13 @@
     {
         // Add new entry if not present yet based on OID
         //
-        if( ( cur = mbedtls_malloc( sizeof(mbedtls_asn1_named_data) ) ) == NULL )
+        if( ( cur = mbedtls_calloc( 1, sizeof(mbedtls_asn1_named_data) ) ) == NULL )
             return( NULL );
 
         memset( cur, 0, sizeof(mbedtls_asn1_named_data) );
 
         cur->oid.len = oid_len;
-        cur->oid.p = mbedtls_malloc( oid_len );
+        cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
         {
             mbedtls_free( cur );
@@ -329,7 +329,7 @@
         memcpy( cur->oid.p, oid, oid_len );
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
@@ -348,7 +348,7 @@
         cur->val.p = NULL;
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
diff --git a/library/bignum.c b/library/bignum.c
index 9776092..b65858d 100644
--- a/library/bignum.c
+++ b/library/bignum.c
@@ -46,7 +46,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -109,11 +109,9 @@
 
     if( X->n < nblimbs )
     {
-        if( ( p = mbedtls_malloc( nblimbs * ciL ) ) == NULL )
+        if( ( p = mbedtls_calloc( nblimbs, ciL ) ) == NULL )
             return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-        memset( p, 0, nblimbs * ciL );
-
         if( X->p != NULL )
         {
             memcpy( p, X->p, X->n * ciL );
@@ -149,11 +147,9 @@
     if( i < nblimbs )
         i = nblimbs;
 
-    if( ( p = mbedtls_malloc( i * ciL ) ) == NULL )
+    if( ( p = mbedtls_calloc( i, ciL ) ) == NULL )
         return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-    memset( p, 0, i * ciL );
-
     if( X->p != NULL )
     {
         memcpy( p, X->p, i * ciL );
diff --git a/library/cipher_wrap.c b/library/cipher_wrap.c
index 490f981..59d77df 100644
--- a/library/cipher_wrap.c
+++ b/library/cipher_wrap.c
@@ -70,7 +70,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -78,7 +78,7 @@
 /* shared by all GCM ciphers */
 static void *gcm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_gcm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_gcm_context ) );
 }
 
 static void gcm_ctx_free( void *ctx )
@@ -92,7 +92,7 @@
 /* shared by all CCM ciphers */
 static void *ccm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_ccm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_ccm_context ) );
 }
 
 static void ccm_ctx_free( void *ctx )
@@ -153,7 +153,7 @@
 
 static void * aes_ctx_alloc( void )
 {
-    mbedtls_aes_context *aes = mbedtls_malloc( sizeof( mbedtls_aes_context ) );
+    mbedtls_aes_context *aes = mbedtls_calloc( 1, sizeof( mbedtls_aes_context ) );
 
     if( aes == NULL )
         return( NULL );
@@ -510,7 +510,7 @@
 static void * camellia_ctx_alloc( void )
 {
     mbedtls_camellia_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_camellia_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_camellia_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -897,7 +897,7 @@
 
 static void * des_ctx_alloc( void )
 {
-    mbedtls_des_context *des = mbedtls_malloc( sizeof( mbedtls_des_context ) );
+    mbedtls_des_context *des = mbedtls_calloc( 1, sizeof( mbedtls_des_context ) );
 
     if( des == NULL )
         return( NULL );
@@ -916,7 +916,7 @@
 static void * des3_ctx_alloc( void )
 {
     mbedtls_des3_context *des3;
-    des3 = mbedtls_malloc( sizeof( mbedtls_des3_context ) );
+    des3 = mbedtls_calloc( 1, sizeof( mbedtls_des3_context ) );
 
     if( des3 == NULL )
         return( NULL );
@@ -1115,7 +1115,7 @@
 static void * blowfish_ctx_alloc( void )
 {
     mbedtls_blowfish_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_blowfish_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_blowfish_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -1225,7 +1225,7 @@
 static void * arc4_ctx_alloc( void )
 {
     mbedtls_arc4_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_arc4_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_arc4_context ) );
 
     if( ctx == NULL )
         return( NULL );
diff --git a/library/dhm.c b/library/dhm.c
index f09592a..af70885 100644
--- a/library/dhm.c
+++ b/library/dhm.c
@@ -51,7 +51,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -531,7 +531,7 @@
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_DHM_MALLOC_FAILED );
diff --git a/library/ecp.c b/library/ecp.c
index 003ed59..37c2472 100644
--- a/library/ecp.c
+++ b/library/ecp.c
@@ -59,7 +59,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -790,12 +790,10 @@
     if( t_len < 2 )
         return( ecp_normalize_jac( grp, *T ) );
 
-    if( ( c = mbedtls_malloc( t_len * sizeof( mbedtls_mpi ) ) ) == NULL )
+    if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
         return( MBEDTLS_ERR_ECP_MALLOC_FAILED );
 
     mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
-    for( i = 0; i < t_len; i++ )
-        mbedtls_mpi_init( &c[i] );
 
     /*
      * c[i] = Z_0 * ... * Z_i
@@ -1363,16 +1361,13 @@
 
     if( T == NULL )
     {
-        T = mbedtls_malloc( pre_len * sizeof( mbedtls_ecp_point ) );
+        T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
         if( T == NULL )
         {
             ret = MBEDTLS_ERR_ECP_MALLOC_FAILED;
             goto cleanup;
         }
 
-        for( i = 0; i < pre_len; i++ )
-            mbedtls_ecp_point_init( &T[i] );
-
         MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
 
         if( p_eq_g )
diff --git a/library/md.c b/library/md.c
index 8359d05..dfa4526 100644
--- a/library/md.c
+++ b/library/md.c
@@ -39,7 +39,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -216,7 +216,7 @@
 
     if( hmac != 0 )
     {
-        ctx->hmac_ctx = mbedtls_malloc( 2 * md_info->block_size );
+        ctx->hmac_ctx = mbedtls_calloc( 2, md_info->block_size );
         if( ctx->hmac_ctx == NULL )
         {
             md_info->ctx_free_func( ctx->md_ctx );
diff --git a/library/md_wrap.c b/library/md_wrap.c
index 9a9d191..4f12ed6 100644
--- a/library/md_wrap.c
+++ b/library/md_wrap.c
@@ -66,7 +66,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -106,7 +106,7 @@
 
 static void * md2_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md2_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md2_context ) );
 }
 
 static void md2_ctx_free( void *ctx )
@@ -170,7 +170,7 @@
 
 static void *md4_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md4_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md4_context ) );
 }
 
 static void md4_ctx_free( void *ctx )
@@ -232,7 +232,7 @@
 
 static void * md5_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md5_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md5_context ) );
 }
 
 static void md5_ctx_free( void *ctx )
@@ -295,7 +295,7 @@
 static void * ripemd160_ctx_alloc( void )
 {
     mbedtls_ripemd160_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_ripemd160_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_ripemd160_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -365,7 +365,7 @@
 static void * sha1_ctx_alloc( void )
 {
     mbedtls_sha1_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha1_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha1_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -443,7 +443,7 @@
 
 static void * sha224_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 }
 
 static void sha224_ctx_free( void *ctx )
@@ -508,7 +508,7 @@
 static void * sha256_ctx_alloc( void )
 {
     mbedtls_sha256_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -583,7 +583,7 @@
 
 static void * sha384_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 }
 
 static void sha384_ctx_free( void *ctx )
@@ -648,7 +648,7 @@
 static void * sha512_ctx_alloc( void )
 {
     mbedtls_sha512_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 
     if( ctx == NULL )
         return( NULL );
diff --git a/library/memory_buffer_alloc.c b/library/memory_buffer_alloc.c
index 8918c5c..38b1050 100644
--- a/library/memory_buffer_alloc.c
+++ b/library/memory_buffer_alloc.c
@@ -649,9 +649,9 @@
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( 1 );
-    q = mbedtls_malloc( 128 );
-    r = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, 1 );
+    q = mbedtls_calloc( 1, 128 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -678,9 +678,9 @@
 
     TEST_ASSERT( heap.buf + heap.len == end );
 
-    p = mbedtls_malloc( 1 );
-    q = mbedtls_malloc( 128 );
-    r = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, 1 );
+    q = mbedtls_calloc( 1, 128 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -702,22 +702,22 @@
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( sizeof( buf ) - sizeof( memory_header ) );
+    p = mbedtls_calloc( 1, sizeof( buf ) - sizeof( memory_header ) );
 
     TEST_ASSERT( check_pointer( p ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( p );
 
-    p = mbedtls_malloc( sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
-    q = mbedtls_malloc( 16 );
+    p = mbedtls_calloc( 1, sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
+    q = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 && check_pointer( q ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( q );
 
-    TEST_ASSERT( mbedtls_malloc( 17 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 17 ) == NULL );
 
     mbedtls_free( p );
 
diff --git a/library/pem.c b/library/pem.c
index c97e800..ed6747a 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -41,7 +41,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -321,7 +321,7 @@
     if( ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER )
         return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
 
-    if( ( buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_decode( buf, &len, s1, s2 - s1 ) ) != 0 )
@@ -407,7 +407,7 @@
         return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
     }
 
-    if( ( encode_buf = mbedtls_malloc( use_len ) ) == NULL )
+    if( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_encode( encode_buf, &use_len, der_data,
diff --git a/library/pk_wrap.c b/library/pk_wrap.c
index 7a47511..7012b12 100644
--- a/library/pk_wrap.c
+++ b/library/pk_wrap.c
@@ -46,7 +46,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -134,7 +134,7 @@
 
 static void *rsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_context ) );
 
     if( ctx != NULL )
         mbedtls_rsa_init( (mbedtls_rsa_context *) ctx, 0, 0 );
@@ -250,7 +250,7 @@
 
 static void *eckey_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecp_keypair ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
 
     if( ctx != NULL )
         mbedtls_ecp_keypair_init( ctx );
@@ -349,7 +349,7 @@
 
 static void *ecdsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecdsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_context ) );
 
     if( ctx != NULL )
         mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
@@ -458,7 +458,7 @@
 
 static void *rsa_alt_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_alt_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_alt_context ) );
 
     if( ctx != NULL )
         memset( ctx, 0, sizeof( mbedtls_rsa_alt_context ) );
diff --git a/library/pkcs11.c b/library/pkcs11.c
index e2ad989..b3a3be6 100644
--- a/library/pkcs11.c
+++ b/library/pkcs11.c
@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -64,7 +64,7 @@
         goto cleanup;
     }
 
-    cert_blob = mbedtls_malloc( cert_blob_size );
+    cert_blob = mbedtls_calloc( 1, cert_blob_size );
     if( NULL == cert_blob )
     {
         ret = 4;
diff --git a/library/pkparse.c b/library/pkparse.c
index f8800f8..254a04d 100644
--- a/library/pkparse.c
+++ b/library/pkparse.c
@@ -57,7 +57,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -93,7 +93,7 @@
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_PK_MALLOC_FAILED );
diff --git a/library/pkwrite.c b/library/pkwrite.c
index 6c982ee..a8cbd6b 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
diff --git a/library/ssl_cache.c b/library/ssl_cache.c
index ca42b7a..6a20cd3 100644
--- a/library/ssl_cache.c
+++ b/library/ssl_cache.c
@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -103,7 +103,7 @@
          */
         if( entry->peer_cert.p != NULL )
         {
-            if( ( session->peer_cert = mbedtls_malloc(
+            if( ( session->peer_cert = mbedtls_calloc( 1,
                                  sizeof(mbedtls_x509_crt) ) ) == NULL )
             {
                 ret = 1;
@@ -222,7 +222,7 @@
             /*
              * max_entries not reached, create new entry
              */
-            cur = mbedtls_malloc( sizeof(mbedtls_ssl_cache_entry) );
+            cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
             if( cur == NULL )
             {
                 ret = 1;
@@ -259,7 +259,7 @@
      */
     if( session->peer_cert != NULL )
     {
-        cur->peer_cert.p = mbedtls_malloc( session->peer_cert->raw.len );
+        cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
         if( cur->peer_cert.p == NULL )
         {
             ret = 1;
diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index b935f59..25a5d00 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -38,7 +38,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -1151,7 +1151,7 @@
 
     mbedtls_free( ssl->handshake->verify_cookie );
 
-    ssl->handshake->verify_cookie = mbedtls_malloc( cookie_len );
+    ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
     if( ssl->handshake->verify_cookie  == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", cookie_len ) );
@@ -2911,7 +2911,7 @@
     ssl->session_negotiate->ticket = NULL;
     ssl->session_negotiate->ticket_len = 0;
 
-    if( ( ticket = mbedtls_malloc( ticket_len ) ) == NULL )
+    if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket malloc failed" ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/ssl_cookie.c b/library/ssl_cookie.c
index 7663e36..8b993ac 100644
--- a/library/ssl_cookie.c
+++ b/library/ssl_cookie.c
@@ -38,7 +38,7 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index 08f228b..d2b585b 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -42,7 +42,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -67,7 +67,7 @@
 
     mbedtls_free( ssl->cli_id );
 
-    if( ( ssl->cli_id = mbedtls_malloc( ilen ) ) == NULL )
+    if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
     memcpy( ssl->cli_id, info, ilen );
@@ -263,11 +263,9 @@
     if( our_size > MBEDTLS_ECP_DP_MAX )
         our_size = MBEDTLS_ECP_DP_MAX;
 
-    if( ( curves = mbedtls_malloc( our_size * sizeof( *curves ) ) ) == NULL )
+    if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
-    /* explicit void pointer cast for buggy MS compiler */
-    memset( (void *) curves, 0, our_size * sizeof( *curves ) );
     ssl->handshake->curves = curves;
 
     p = buf + 2;
diff --git a/library/ssl_ticket.c b/library/ssl_ticket.c
index 80a0356..7b76218 100644
--- a/library/ssl_ticket.c
+++ b/library/ssl_ticket.c
@@ -33,7 +33,8 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#include <stdlib.h>
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -243,7 +244,7 @@
         if( p + cert_len > end )
             return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-        session->peer_cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( session->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index f22c561..e353829 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -173,7 +173,7 @@
     {
         int ret;
 
-        dst->peer_cert = mbedtls_malloc( sizeof(mbedtls_x509_crt) );
+        dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
         if( dst->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -192,7 +192,7 @@
 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
     if( src->ticket != NULL )
     {
-        dst->ticket = mbedtls_malloc( src->ticket_len );
+        dst->ticket = mbedtls_calloc( 1, src->ticket_len );
         if( dst->ticket == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -929,7 +929,7 @@
         if( ssl->compress_buf == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
-            ssl->compress_buf = mbedtls_malloc( MBEDTLS_SSL_BUFFER_LEN );
+            ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
             if( ssl->compress_buf == NULL )
             {
                 MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
@@ -2454,14 +2454,14 @@
     mbedtls_ssl_flight_item *msg;
 
     /* Allocate space for current message */
-    if( ( msg = mbedtls_malloc( sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
+    if( ( msg = mbedtls_calloc( 1, sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed",
                             sizeof( mbedtls_ssl_flight_item ) ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
-    if( ( msg->p = mbedtls_malloc( ssl->out_msglen ) ) == NULL )
+    if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed", ssl->out_msglen ) );
         mbedtls_free( msg );
@@ -2924,7 +2924,7 @@
         /* The bitmask needs one bit per byte of message excluding header */
         alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
 
-        ssl->handshake->hs_msg = mbedtls_malloc( alloc_len );
+        ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len );
         if( ssl->handshake->hs_msg == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", alloc_len ) );
@@ -3975,7 +3975,7 @@
         mbedtls_free( ssl->session_negotiate->peer_cert );
     }
 
-    if( ( ssl->session_negotiate->peer_cert = mbedtls_malloc(
+    if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
                     sizeof( mbedtls_x509_crt ) ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
@@ -4898,17 +4898,17 @@
      */
     if( ssl->transform_negotiate == NULL )
     {
-        ssl->transform_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_transform) );
+        ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
     }
 
     if( ssl->session_negotiate == NULL )
     {
-        ssl->session_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_session) );
+        ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
     }
 
     if( ssl->handshake == NULL )
     {
-        ssl->handshake = mbedtls_malloc( sizeof(mbedtls_ssl_handshake_params) );
+        ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
     }
 
     /* All pointers should exist and can be directly freed without issue */
@@ -5002,8 +5002,8 @@
     /*
      * Prepare base structures
      */
-    if( ( ssl-> in_buf = mbedtls_malloc( len ) ) == NULL ||
-        ( ssl->out_buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
+        ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
         mbedtls_free( ssl->in_buf );
@@ -5309,7 +5309,7 @@
 {
     mbedtls_ssl_key_cert *new;
 
-    new = mbedtls_malloc( sizeof( mbedtls_ssl_key_cert ) );
+    new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
     if( new == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -5384,8 +5384,8 @@
         mbedtls_free( conf->psk_identity );
     }
 
-    if( ( conf->psk = mbedtls_malloc( psk_len ) ) == NULL ||
-        ( conf->psk_identity = mbedtls_malloc( psk_identity_len ) ) == NULL )
+    if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
+        ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
     {
         mbedtls_free( conf->psk );
         conf->psk = NULL;
@@ -5413,7 +5413,7 @@
     if( ssl->handshake->psk != NULL )
         mbedtls_free( ssl->conf->psk );
 
-    if( ( ssl->handshake->psk = mbedtls_malloc( psk_len ) ) == NULL )
+    if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
     {
         mbedtls_free( ssl->handshake->psk );
         ssl->handshake->psk = NULL;
@@ -5492,7 +5492,7 @@
     if( hostname_len + 1 == 0 )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    ssl->hostname = mbedtls_malloc( hostname_len + 1 );
+    ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
 
     if( ssl->hostname == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
diff --git a/library/x509.c b/library/x509.c
index a3e288b..3cddc5f 100644
--- a/library/x509.c
+++ b/library/x509.c
@@ -55,7 +55,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #define mbedtls_snprintf   snprintf
 #endif
@@ -452,7 +452,7 @@
             /* Mark this item as being no the only one in a set */
             cur->next_merged = 1;
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
@@ -468,7 +468,7 @@
         if( *p == end )
             return( 0 );
 
-        cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+        cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
         if( cur->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
@@ -597,7 +597,7 @@
     {
         mbedtls_pk_rsassa_pss_options *pss_opts;
 
-        pss_opts = mbedtls_malloc( sizeof( mbedtls_pk_rsassa_pss_options ) );
+        pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
         if( pss_opts == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
diff --git a/library/x509_crl.c b/library/x509_crl.c
index e193919..5c2c7d5 100644
--- a/library/x509_crl.c
+++ b/library/x509_crl.c
@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -238,7 +238,7 @@
 
         if( *p < end )
         {
-            cur_entry->next = mbedtls_malloc( sizeof( mbedtls_x509_crl_entry ) );
+            cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
@@ -281,7 +281,7 @@
 
     if( crl->version != 0 && crl->next == NULL )
     {
-        crl->next = mbedtls_malloc( sizeof( mbedtls_x509_crl ) );
+        crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
 
         if( crl->next == NULL )
         {
@@ -296,7 +296,7 @@
     /*
      * Copy raw DER-encoded CRL
      */
-    if( ( p = mbedtls_malloc( buflen ) ) == NULL )
+    if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
     memcpy( p, buf, buflen );
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 11eb7cf..849ea7b 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -53,7 +53,7 @@
 #else
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -359,7 +359,7 @@
             if( cur->next != NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
@@ -553,7 +553,7 @@
     if( crt == NULL || buf == NULL )
         return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
 
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
@@ -808,7 +808,7 @@
      */
     if( crt->version != 0 && crt->next == NULL )
     {
-        crt->next = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
diff --git a/library/x509_csr.c b/library/x509_csr.c
index ebf8897..4347fbb 100644
--- a/library/x509_csr.c
+++ b/library/x509_csr.c
@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -113,7 +113,7 @@
     /*
      * first copy the raw DER data
      */
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
 
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );