Merge branch 'calloc' into development

* calloc:
  Remove a few redundant memset after calloc.
  Remove references to malloc in strings/names
  Update ChangeLog for s/malloc/calloc
  Adapt memory_buffer_alloc to calloc
  Adapt the platform layer from malloc to calloc
  Replace malloc with calloc

ChangeLog

@@ -64,6 +64,9 @@ API Changes
      mbedtls_pk_parse_public_key() and mbedtls_dhm_parse_dhm() now expect the
      length parameter to include the terminating null byte for PEM input.
    * Signature of mpi_mul_mpi() changed to make the last argument unsigned
+   * calloc() is now used instead of malloc() everywhere. API of platform
+     layer and the memory_buffer_alloc module changed accordingly.
+     (Thanks to Mansour Moufid for helping with the replacement.)
    * Change SSL_DISABLE_RENEGOTIATION config.h flag to SSL_RENEGOTIATION
      (support for renegotiation now needs explicit enabling in config.h).
    * net_connect() and net_bind() have a new 'proto' argument to choose

include/mbedtls/config.h

@@ -78,17 +78,17 @@
  *
  * Enable the memory allocation layer.
  *
- * By default mbed TLS uses the system-provided malloc() and free().
+ * By default mbed TLS uses the system-provided calloc() and free().
  * This allows different allocators (self-implemented or provided) to be
  * provided to the platform abstraction layer.
  *
  * Enabling MBEDTLS_PLATFORM_MEMORY without the
- * MBEDTLS_PLATFORM_{FREE,MALLOC}_MACROs will provide
+ * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide
- * "mbedtls_platform_set_malloc_free()" allowing you to set an alternative malloc() and
+ * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and
  * free() function pointer at runtime.
  *
  * Enabling MBEDTLS_PLATFORM_MEMORY and specifying
- * MBEDTLS_PLATFORM_{MALLOC,FREE}_MACROs will allow you to specify the
+ * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the
  * alternate function at compile time.
  *
  * Requires: MBEDTLS_PLATFORM_C
@@ -100,8 +100,8 @@
 /**
  * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS
  *
- * Do not assign standard functions in the platform layer (e.g. malloc() to
+ * Do not assign standard functions in the platform layer (e.g. calloc() to
- * MBEDTLS_PLATFORM_STD_MALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
+ * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF)
  *
  * This makes sure there are no linking errors on platforms that do not support
  * these functions. You will HAVE to provide alternatives, either at runtime
@@ -1788,7 +1788,7 @@
  * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C
  *
  * Enable the buffer allocator implementation that makes use of a (stack)
- * based buffer to 'allocate' dynamic memory. (replaces malloc() and free()
+ * based buffer to 'allocate' dynamic memory. (replaces calloc() and free()
  * calls)
  *
  * Module:  library/memory_buffer_alloc.c
@@ -1975,7 +1975,7 @@
  * \def MBEDTLS_PLATFORM_C
  *
  * Enable the platform abstraction layer that allows you to re-assign
- * functions like malloc(), free(), snprintf(), printf(), fprintf(), exit()
+ * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit()
  *
  * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT
  * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned
@@ -2345,7 +2345,7 @@
 
 /* Platform options */
 //#define MBEDTLS_PLATFORM_STD_MEM_HDR   <stdlib.h> /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */
-//#define MBEDTLS_PLATFORM_STD_MALLOC        malloc /**< Default allocator to use, can be undefined */
+//#define MBEDTLS_PLATFORM_STD_CALLOC        calloc /**< Default allocator to use, can be undefined */
 //#define MBEDTLS_PLATFORM_STD_FREE            free /**< Default free to use, can be undefined */
 //#define MBEDTLS_PLATFORM_STD_EXIT            exit /**< Default exit to use, can be undefined */
 //#define MBEDTLS_PLATFORM_STD_FPRINTF      fprintf /**< Default fprintf to use, can be undefined */
@@ -2354,7 +2354,7 @@
 
 /* To Use Function Macros MBEDTLS_PLATFORM_C must be enabled */
 /* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */
-//#define MBEDTLS_PLATFORM_MALLOC_MACRO        malloc /**< Default allocator macro to use, can be undefined */
+//#define MBEDTLS_PLATFORM_CALLOC_MACRO        calloc /**< Default allocator macro to use, can be undefined */
 //#define MBEDTLS_PLATFORM_FREE_MACRO            free /**< Default free macro to use, can be undefined */
 //#define MBEDTLS_PLATFORM_EXIT_MACRO            exit /**< Default exit macro to use, can be undefined */
 //#define MBEDTLS_PLATFORM_FPRINTF_MACRO      fprintf /**< Default fprintf macro to use, can be undefined */

include/mbedtls/memory_buffer_alloc.h

@@ -58,10 +58,10 @@ extern "C" {
 /**
  * \brief   Initialize use of stack-based memory allocator.
  *          The stack-based allocator does memory management inside the
- *          presented buffer and does not call malloc() and free().
+ *          presented buffer and does not call calloc() and free().
- *          It sets the global mbedtls_malloc() and mbedtls_free() pointers
+ *          It sets the global mbedtls_calloc() and mbedtls_free() pointers
  *          to its own functions.
- *          (Provided mbedtls_malloc() and mbedtls_free() are thread-safe if
+ *          (Provided mbedtls_calloc() and mbedtls_free() are thread-safe if
  *           MBEDTLS_THREADING_C is defined)
  *
  * \note    This code is not optimized and provides a straight-forward

include/mbedtls/platform.h

@@ -54,8 +54,8 @@ extern "C" {
 #if !defined(MBEDTLS_PLATFORM_STD_FPRINTF)
 #define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use */
 #endif
-#if !defined(MBEDTLS_PLATFORM_STD_MALLOC)
+#if !defined(MBEDTLS_PLATFORM_STD_CALLOC)
-#define MBEDTLS_PLATFORM_STD_MALLOC   malloc /**< Default allocator to use */
+#define MBEDTLS_PLATFORM_STD_CALLOC   calloc /**< Default allocator to use */
 #endif
 #if !defined(MBEDTLS_PLATFORM_STD_FREE)
 #define MBEDTLS_PLATFORM_STD_FREE       free /**< Default free to use */
@@ -72,32 +72,32 @@ extern "C" {
 /* \} name SECTION: Module settings */
 
 /*
- * The function pointers for malloc and free
+ * The function pointers for calloc and free
  */
 #if defined(MBEDTLS_PLATFORM_MEMORY)
 #if defined(MBEDTLS_PLATFORM_FREE_MACRO) && \
-    defined(MBEDTLS_PLATFORM_MALLOC_MACRO)
+    defined(MBEDTLS_PLATFORM_CALLOC_MACRO)
 #define mbedtls_free       MBEDTLS_PLATFORM_FREE_MACRO
-#define mbedtls_malloc     MBEDTLS_PLATFORM_MALLOC_MACRO
+#define mbedtls_calloc     MBEDTLS_PLATFORM_CALLOC_MACRO
 #else
-extern void * (*mbedtls_malloc)( size_t len );
+extern void * (*mbedtls_calloc)( size_t n, size_t size );
 extern void (*mbedtls_free)( void *ptr );
 
 /**
  * \brief   Set your own memory implementation function pointers
  *
- * \param malloc_func   the malloc function implementation
+ * \param calloc_func   the calloc function implementation
  * \param free_func     the free function implementation
  *
  * \return              0 if successful
  */
-int mbedtls_platform_set_malloc_free( void * (*malloc_func)( size_t ),
+int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ),
                               void (*free_func)( void * ) );
-#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_MALLOC_MACRO */
+#endif /* MBEDTLS_PLATFORM_FREE_MACRO && MBEDTLS_PLATFORM_CALLOC_MACRO */
 #else /* !MBEDTLS_PLATFORM_MEMORY */
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc     calloc
-#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,MALLOC}_MACRO */
+#endif /* MBEDTLS_PLATFORM_MEMORY && !MBEDTLS_PLATFORM_{FREE,CALLOC}_MACRO */
 
 /*
  * The function pointers for fprintf

library/asn1parse.c

@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -270,13 +270,11 @@ int mbedtls_asn1_get_sequence_of( unsigned char **p,
         /* Allocate and assign next pointer */
         if( *p < end )
         {
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_ASN1_MALLOC_FAILED );
 
-            memset( cur->next, 0, sizeof( mbedtls_asn1_sequence ) );
-
             cur = cur->next;
         }
     }

library/asn1write.c

@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -313,13 +313,11 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
     {
         // Add new entry if not present yet based on OID
         //
-        if( ( cur = mbedtls_malloc( sizeof(mbedtls_asn1_named_data) ) ) == NULL )
+        if( ( cur = mbedtls_calloc( 1, sizeof(mbedtls_asn1_named_data) ) ) == NULL )
             return( NULL );
 
-        memset( cur, 0, sizeof(mbedtls_asn1_named_data) );
-
         cur->oid.len = oid_len;
-        cur->oid.p = mbedtls_malloc( oid_len );
+        cur->oid.p = mbedtls_calloc( 1, oid_len );
         if( cur->oid.p == NULL )
         {
             mbedtls_free( cur );
@@ -329,7 +327,7 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
         memcpy( cur->oid.p, oid, oid_len );
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );
@@ -348,7 +346,7 @@ mbedtls_asn1_named_data *mbedtls_asn1_store_named_data( mbedtls_asn1_named_data
         cur->val.p = NULL;
 
         cur->val.len = val_len;
-        cur->val.p = mbedtls_malloc( val_len );
+        cur->val.p = mbedtls_calloc( 1, val_len );
         if( cur->val.p == NULL )
         {
             mbedtls_free( cur->oid.p );

library/bignum.c

@@ -46,7 +46,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -109,11 +109,9 @@ int mbedtls_mpi_grow( mbedtls_mpi *X, size_t nblimbs )
 
     if( X->n < nblimbs )
     {
-        if( ( p = mbedtls_malloc( nblimbs * ciL ) ) == NULL )
+        if( ( p = mbedtls_calloc( nblimbs, ciL ) ) == NULL )
             return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-        memset( p, 0, nblimbs * ciL );
-
         if( X->p != NULL )
         {
             memcpy( p, X->p, X->n * ciL );
@@ -149,11 +147,9 @@ int mbedtls_mpi_shrink( mbedtls_mpi *X, size_t nblimbs )
     if( i < nblimbs )
         i = nblimbs;
 
-    if( ( p = mbedtls_malloc( i * ciL ) ) == NULL )
+    if( ( p = mbedtls_calloc( i, ciL ) ) == NULL )
         return( MBEDTLS_ERR_MPI_MALLOC_FAILED );
 
-    memset( p, 0, i * ciL );
-
     if( X->p != NULL )
     {
         memcpy( p, X->p, i * ciL );

library/cipher_wrap.c

@@ -70,7 +70,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -78,7 +78,7 @@
 /* shared by all GCM ciphers */
 static void *gcm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_gcm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_gcm_context ) );
 }
 
 static void gcm_ctx_free( void *ctx )
@@ -92,7 +92,7 @@ static void gcm_ctx_free( void *ctx )
 /* shared by all CCM ciphers */
 static void *ccm_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_ccm_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_ccm_context ) );
 }
 
 static void ccm_ctx_free( void *ctx )
@@ -153,7 +153,7 @@ static int aes_setkey_enc_wrap( void *ctx, const unsigned char *key,
 
 static void * aes_ctx_alloc( void )
 {
-    mbedtls_aes_context *aes = mbedtls_malloc( sizeof( mbedtls_aes_context ) );
+    mbedtls_aes_context *aes = mbedtls_calloc( 1, sizeof( mbedtls_aes_context ) );
 
     if( aes == NULL )
         return( NULL );
@@ -510,7 +510,7 @@ static int camellia_setkey_enc_wrap( void *ctx, const unsigned char *key,
 static void * camellia_ctx_alloc( void )
 {
     mbedtls_camellia_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_camellia_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_camellia_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -897,7 +897,7 @@ static int des3_set3key_enc_wrap( void *ctx, const unsigned char *key,
 
 static void * des_ctx_alloc( void )
 {
-    mbedtls_des_context *des = mbedtls_malloc( sizeof( mbedtls_des_context ) );
+    mbedtls_des_context *des = mbedtls_calloc( 1, sizeof( mbedtls_des_context ) );
 
     if( des == NULL )
         return( NULL );
@@ -916,7 +916,7 @@ static void des_ctx_free( void *ctx )
 static void * des3_ctx_alloc( void )
 {
     mbedtls_des3_context *des3;
-    des3 = mbedtls_malloc( sizeof( mbedtls_des3_context ) );
+    des3 = mbedtls_calloc( 1, sizeof( mbedtls_des3_context ) );
 
     if( des3 == NULL )
         return( NULL );
@@ -1115,7 +1115,7 @@ static int blowfish_setkey_wrap( void *ctx, const unsigned char *key,
 static void * blowfish_ctx_alloc( void )
 {
     mbedtls_blowfish_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_blowfish_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_blowfish_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -1225,7 +1225,7 @@ static int arc4_setkey_wrap( void *ctx, const unsigned char *key,
 static void * arc4_ctx_alloc( void )
 {
     mbedtls_arc4_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_arc4_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_arc4_context ) );
 
     if( ctx == NULL )
         return( NULL );

library/dhm.c

@@ -51,7 +51,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -531,7 +531,7 @@ static int load_file( const char *path, unsigned char **buf, size_t *n )
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_DHM_MALLOC_FAILED );

library/ecp.c

@@ -59,7 +59,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_printf     printf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -790,12 +790,10 @@ static int ecp_normalize_jac_many( const mbedtls_ecp_group *grp,
     if( t_len < 2 )
         return( ecp_normalize_jac( grp, *T ) );
 
-    if( ( c = mbedtls_malloc( t_len * sizeof( mbedtls_mpi ) ) ) == NULL )
+    if( ( c = mbedtls_calloc( t_len, sizeof( mbedtls_mpi ) ) ) == NULL )
         return( MBEDTLS_ERR_ECP_MALLOC_FAILED );
 
     mbedtls_mpi_init( &u ); mbedtls_mpi_init( &Zi ); mbedtls_mpi_init( &ZZi );
-    for( i = 0; i < t_len; i++ )
-        mbedtls_mpi_init( &c[i] );
 
     /*
      * c[i] = Z_0 * ... * Z_i
@@ -1363,16 +1361,13 @@ static int ecp_mul_comb( mbedtls_ecp_group *grp, mbedtls_ecp_point *R,
 
     if( T == NULL )
     {
-        T = mbedtls_malloc( pre_len * sizeof( mbedtls_ecp_point ) );
+        T = mbedtls_calloc( pre_len, sizeof( mbedtls_ecp_point ) );
         if( T == NULL )
         {
             ret = MBEDTLS_ERR_ECP_MALLOC_FAILED;
             goto cleanup;
         }
 
-        for( i = 0; i < pre_len; i++ )
-            mbedtls_ecp_point_init( &T[i] );
-
         MBEDTLS_MPI_CHK( ecp_precompute_comb( grp, T, P, w, d ) );
 
         if( p_eq_g )

library/md.c

@@ -39,7 +39,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -216,7 +216,7 @@ int mbedtls_md_setup( mbedtls_md_context_t *ctx, const mbedtls_md_info_t *md_inf
 
     if( hmac != 0 )
     {
-        ctx->hmac_ctx = mbedtls_malloc( 2 * md_info->block_size );
+        ctx->hmac_ctx = mbedtls_calloc( 2, md_info->block_size );
         if( ctx->hmac_ctx == NULL )
         {
             md_info->ctx_free_func( ctx->md_ctx );

library/md_wrap.c

@@ -66,7 +66,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -106,7 +106,7 @@ static int md2_file_wrap( const char *path, unsigned char *output )
 
 static void * md2_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md2_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md2_context ) );
 }
 
 static void md2_ctx_free( void *ctx )
@@ -170,7 +170,7 @@ static int md4_file_wrap( const char *path, unsigned char *output )
 
 static void *md4_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md4_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md4_context ) );
 }
 
 static void md4_ctx_free( void *ctx )
@@ -232,7 +232,7 @@ static int md5_file_wrap( const char *path, unsigned char *output )
 
 static void * md5_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_md5_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_md5_context ) );
 }
 
 static void md5_ctx_free( void *ctx )
@@ -295,7 +295,7 @@ static int ripemd160_file_wrap( const char *path, unsigned char *output )
 static void * ripemd160_ctx_alloc( void )
 {
     mbedtls_ripemd160_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_ripemd160_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_ripemd160_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -365,7 +365,7 @@ static int sha1_file_wrap( const char *path, unsigned char *output )
 static void * sha1_ctx_alloc( void )
 {
     mbedtls_sha1_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha1_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha1_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -443,7 +443,7 @@ static int sha224_file_wrap( const char *path, unsigned char *output )
 
 static void * sha224_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 }
 
 static void sha224_ctx_free( void *ctx )
@@ -508,7 +508,7 @@ static int sha256_file_wrap( const char *path, unsigned char *output )
 static void * sha256_ctx_alloc( void )
 {
     mbedtls_sha256_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha256_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha256_context ) );
 
     if( ctx == NULL )
         return( NULL );
@@ -583,7 +583,7 @@ static int sha384_file_wrap( const char *path, unsigned char *output )
 
 static void * sha384_ctx_alloc( void )
 {
-    return mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    return mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 }
 
 static void sha384_ctx_free( void *ctx )
@@ -648,7 +648,7 @@ static int sha512_file_wrap( const char *path, unsigned char *output )
 static void * sha512_ctx_alloc( void )
 {
     mbedtls_sha512_context *ctx;
-    ctx = mbedtls_malloc( sizeof( mbedtls_sha512_context ) );
+    ctx = mbedtls_calloc( 1, sizeof( mbedtls_sha512_context ) );
 
     if( ctx == NULL )
         return( NULL );

library/memory_buffer_alloc.c

@@ -77,7 +77,7 @@ typedef struct
     memory_header   *first_free;
     int             verify;
 #if defined(MBEDTLS_MEMORY_DEBUG)
-    size_t          malloc_count;
+    size_t          alloc_count;
     size_t          free_count;
     size_t          total_used;
     size_t          maximum_used;
@@ -230,10 +230,12 @@ static int verify_chain()
     return( 0 );
 }
 
-static void *buffer_alloc_malloc( size_t len )
+static void *buffer_alloc_calloc( size_t n, size_t size )
 {
     memory_header *new, *cur = heap.first_free;
     unsigned char *p;
+    void *ret;
+    size_t original_len, len;
 #if defined(MBEDTLS_MEMORY_BACKTRACE)
     void *trace_buffer[MAX_BT];
     size_t trace_cnt;
@@ -242,6 +244,11 @@ static void *buffer_alloc_malloc( size_t len )
     if( heap.buf == NULL || heap.first == NULL )
         return( NULL );
 
+    original_len = len = n * size;
+
+    if( n != 0 && len / n != size )
+        return( NULL );
+
     if( len % MBEDTLS_MEMORY_ALIGN_MULTIPLE )
     {
         len -= len % MBEDTLS_MEMORY_ALIGN_MULTIPLE;
@@ -271,7 +278,7 @@ static void *buffer_alloc_malloc( size_t len )
     }
 
 #if defined(MBEDTLS_MEMORY_DEBUG)
-    heap.malloc_count++;
+    heap.calloc_count++;
 #endif
 
     // Found location, split block if > memory_header + 4 room left
@@ -308,7 +315,10 @@ static void *buffer_alloc_malloc( size_t len )
         if( ( heap.verify & MBEDTLS_MEMORY_VERIFY_ALLOC ) && verify_chain() != 0 )
             mbedtls_exit( 1 );
 
-        return( ( (unsigned char *) cur ) + sizeof(memory_header) );
+        ret = (unsigned char *) cur + sizeof( memory_header );
+        memset( ret, 0, original_len );
+
+        return( ret );
     }
 
     p = ( (unsigned char *) cur ) + sizeof(memory_header) + len;
@@ -363,7 +373,10 @@ static void *buffer_alloc_malloc( size_t len )
     if( ( heap.verify & MBEDTLS_MEMORY_VERIFY_ALLOC ) && verify_chain() != 0 )
         mbedtls_exit( 1 );
 
-    return( ( (unsigned char *) cur ) + sizeof(memory_header) );
+    ret = (unsigned char *) cur + sizeof( memory_header );
+    memset( ret, 0, original_len );
+
+    return( ret );
 }
 
 static void buffer_alloc_free( void *ptr )
@@ -503,12 +516,12 @@ void mbedtls_memory_buffer_alloc_status()
 {
     mbedtls_fprintf( stderr,
                       "Current use: %zu blocks / %zu bytes, max: %zu blocks / "
-                      "%zu bytes (total %zu bytes), malloc / free: %zu / %zu\n",
+                      "%zu bytes (total %zu bytes), alloc / free: %zu / %zu\n",
                       heap.header_count, heap.total_used,
                       heap.maximum_header_count, heap.maximum_used,
                       heap.maximum_header_count * sizeof( memory_header )
                       + heap.maximum_used,
-                      heap.malloc_count, heap.free_count );
+                      heap.alloc_count, heap.free_count );
 
     if( heap.first->next == NULL )
         mbedtls_fprintf( stderr, "All memory de-allocated in stack buffer\n" );
@@ -539,12 +552,12 @@ void mbedtls_memory_buffer_alloc_cur_get( size_t *cur_used, size_t *cur_blocks )
 #endif /* MBEDTLS_MEMORY_DEBUG */
 
 #if defined(MBEDTLS_THREADING_C)
-static void *buffer_alloc_malloc_mutexed( size_t len )
+static void *buffer_alloc_calloc_mutexed( size_t n, size_t size )
 {
     void *buf;
     if( mbedtls_mutex_lock( &heap.mutex ) != 0 )
         return( NULL );
-    buf = buffer_alloc_malloc( len );
+    buf = buffer_alloc_calloc( n, size );
     if( mbedtls_mutex_unlock( &heap.mutex ) )
         return( NULL );
     return( buf );
@@ -568,10 +581,10 @@ void mbedtls_memory_buffer_alloc_init( unsigned char *buf, size_t len )
 
 #if defined(MBEDTLS_THREADING_C)
     mbedtls_mutex_init( &heap.mutex );
-    mbedtls_platform_set_malloc_free( buffer_alloc_malloc_mutexed,
+    mbedtls_platform_set_calloc_free( buffer_alloc_calloc_mutexed,
                               buffer_alloc_free_mutexed );
 #else
-    mbedtls_platform_set_malloc_free( buffer_alloc_malloc, buffer_alloc_free );
+    mbedtls_platform_set_calloc_free( buffer_alloc_calloc, buffer_alloc_free );
 #endif
 
     if( (size_t) buf % MBEDTLS_MEMORY_ALIGN_MULTIPLE )
@@ -649,9 +662,9 @@ int mbedtls_memory_buffer_alloc_self_test( int verbose )
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( 1 );
+    p = mbedtls_calloc( 1, 1 );
-    q = mbedtls_malloc( 128 );
+    q = mbedtls_calloc( 1, 128 );
-    r = mbedtls_malloc( 16 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -678,9 +691,9 @@ int mbedtls_memory_buffer_alloc_self_test( int verbose )
 
     TEST_ASSERT( heap.buf + heap.len == end );
 
-    p = mbedtls_malloc( 1 );
+    p = mbedtls_calloc( 1, 1 );
-    q = mbedtls_malloc( 128 );
+    q = mbedtls_calloc( 1, 128 );
-    r = mbedtls_malloc( 16 );
+    r = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 &&
                  check_pointer( q ) == 0 &&
@@ -702,22 +715,22 @@ int mbedtls_memory_buffer_alloc_self_test( int verbose )
 
     mbedtls_memory_buffer_alloc_init( buf, sizeof( buf ) );
 
-    p = mbedtls_malloc( sizeof( buf ) - sizeof( memory_header ) );
+    p = mbedtls_calloc( 1, sizeof( buf ) - sizeof( memory_header ) );
 
     TEST_ASSERT( check_pointer( p ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( p );
 
-    p = mbedtls_malloc( sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
+    p = mbedtls_calloc( 1, sizeof( buf ) - 2 * sizeof( memory_header ) - 16 );
-    q = mbedtls_malloc( 16 );
+    q = mbedtls_calloc( 1, 16 );
 
     TEST_ASSERT( check_pointer( p ) == 0 && check_pointer( q ) == 0 );
-    TEST_ASSERT( mbedtls_malloc( 1 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 1 ) == NULL );
 
     mbedtls_free( q );
 
-    TEST_ASSERT( mbedtls_malloc( 17 ) == NULL );
+    TEST_ASSERT( mbedtls_calloc( 1, 17 ) == NULL );
 
     mbedtls_free( p );
 

library/pem.c

@@ -41,7 +41,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -321,7 +321,7 @@ int mbedtls_pem_read_buffer( mbedtls_pem_context *ctx, const char *header, const
     if( ret == MBEDTLS_ERR_BASE64_INVALID_CHARACTER )
         return( MBEDTLS_ERR_PEM_INVALID_DATA + ret );
 
-    if( ( buf = mbedtls_malloc( len ) ) == NULL )
+    if( ( buf = mbedtls_calloc( 1, len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_decode( buf, &len, s1, s2 - s1 ) ) != 0 )
@@ -407,7 +407,7 @@ int mbedtls_pem_write_buffer( const char *header, const char *footer,
         return( MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
     }
 
-    if( ( encode_buf = mbedtls_malloc( use_len ) ) == NULL )
+    if( ( encode_buf = mbedtls_calloc( 1, use_len ) ) == NULL )
         return( MBEDTLS_ERR_PEM_MALLOC_FAILED );
 
     if( ( ret = mbedtls_base64_encode( encode_buf, &use_len, der_data,

library/pk_wrap.c

@@ -46,7 +46,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -134,7 +134,7 @@ static int rsa_check_pair_wrap( const void *pub, const void *prv )
 
 static void *rsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_context ) );
 
     if( ctx != NULL )
         mbedtls_rsa_init( (mbedtls_rsa_context *) ctx, 0, 0 );
@@ -250,7 +250,7 @@ static int eckey_check_pair( const void *pub, const void *prv )
 
 static void *eckey_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecp_keypair ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
 
     if( ctx != NULL )
         mbedtls_ecp_keypair_init( ctx );
@@ -349,7 +349,7 @@ static int ecdsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
 
 static void *ecdsa_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_ecdsa_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_ecdsa_context ) );
 
     if( ctx != NULL )
         mbedtls_ecdsa_init( (mbedtls_ecdsa_context *) ctx );
@@ -458,7 +458,7 @@ static int rsa_alt_check_pair( const void *pub, const void *prv )
 
 static void *rsa_alt_alloc_wrap( void )
 {
-    void *ctx = mbedtls_malloc( sizeof( mbedtls_rsa_alt_context ) );
+    void *ctx = mbedtls_calloc( 1, sizeof( mbedtls_rsa_alt_context ) );
 
     if( ctx != NULL )
         memset( ctx, 0, sizeof( mbedtls_rsa_alt_context ) );

library/pkcs11.c

@@ -36,7 +36,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -64,7 +64,7 @@ int mbedtls_pkcs11_x509_cert_bind( mbedtls_x509_crt *cert, pkcs11h_certificate_t
         goto cleanup;
     }
 
-    cert_blob = mbedtls_malloc( cert_blob_size );
+    cert_blob = mbedtls_calloc( 1, cert_blob_size );
     if( NULL == cert_blob )
     {
         ret = 4;

library/pkparse.c

@@ -57,7 +57,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -93,7 +93,7 @@ int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n )
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( MBEDTLS_ERR_PK_MALLOC_FAILED );

library/pkwrite.c

@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 

library/platform.c

@@ -31,15 +31,16 @@
 #include "mbedtls/platform.h"
 
 #if defined(MBEDTLS_PLATFORM_MEMORY)
-#if !defined(MBEDTLS_PLATFORM_STD_MALLOC)
+#if !defined(MBEDTLS_PLATFORM_STD_CALLOC)
-static void *platform_malloc_uninit( size_t len )
+static void *platform_calloc_uninit( size_t n, size_t size )
 {
-    ((void) len);
+    ((void) n);
+    ((void) size);
     return( NULL );
 }
 
-#define MBEDTLS_PLATFORM_STD_MALLOC   platform_malloc_uninit
+#define MBEDTLS_PLATFORM_STD_CALLOC   platform_calloc_uninit
-#endif /* !MBEDTLS_PLATFORM_STD_MALLOC */
+#endif /* !MBEDTLS_PLATFORM_STD_CALLOC */
 
 #if !defined(MBEDTLS_PLATFORM_STD_FREE)
 static void platform_free_uninit( void *ptr )
@@ -50,13 +51,13 @@ static void platform_free_uninit( void *ptr )
 #define MBEDTLS_PLATFORM_STD_FREE     platform_free_uninit
 #endif /* !MBEDTLS_PLATFORM_STD_FREE */
 
-void * (*mbedtls_malloc)( size_t ) = MBEDTLS_PLATFORM_STD_MALLOC;
+void * (*mbedtls_calloc)( size_t, size_t ) = MBEDTLS_PLATFORM_STD_CALLOC;
 void (*mbedtls_free)( void * )     = MBEDTLS_PLATFORM_STD_FREE;
 
-int mbedtls_platform_set_malloc_free( void * (*malloc_func)( size_t ),
+int mbedtls_platform_set_calloc_free( void * (*calloc_func)( size_t, size_t ),
                               void (*free_func)( void * ) )
 {
-    mbedtls_malloc = malloc_func;
+    mbedtls_calloc = calloc_func;
     mbedtls_free = free_func;
     return( 0 );
 }

library/ssl_cache.c

@@ -40,7 +40,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -103,7 +103,7 @@ int mbedtls_ssl_cache_get( void *data, mbedtls_ssl_session *session )
          */
         if( entry->peer_cert.p != NULL )
         {
-            if( ( session->peer_cert = mbedtls_malloc(
+            if( ( session->peer_cert = mbedtls_calloc( 1,
                                  sizeof(mbedtls_x509_crt) ) ) == NULL )
             {
                 ret = 1;
@@ -222,15 +222,13 @@ int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
             /*
              * max_entries not reached, create new entry
              */
-            cur = mbedtls_malloc( sizeof(mbedtls_ssl_cache_entry) );
+            cur = mbedtls_calloc( 1, sizeof(mbedtls_ssl_cache_entry) );
             if( cur == NULL )
             {
                 ret = 1;
                 goto exit;
             }
 
-            memset( cur, 0, sizeof(mbedtls_ssl_cache_entry) );
-
             if( prv == NULL )
                 cache->chain = cur;
             else
@@ -259,7 +257,7 @@ int mbedtls_ssl_cache_set( void *data, const mbedtls_ssl_session *session )
      */
     if( session->peer_cert != NULL )
     {
-        cur->peer_cert.p = mbedtls_malloc( session->peer_cert->raw.len );
+        cur->peer_cert.p = mbedtls_calloc( 1, session->peer_cert->raw.len );
         if( cur->peer_cert.p == NULL )
         {
             ret = 1;

library/ssl_cli.c

@@ -38,7 +38,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -1151,10 +1151,10 @@ static int ssl_parse_hello_verify_request( mbedtls_ssl_context *ssl )
 
     mbedtls_free( ssl->handshake->verify_cookie );
 
-    ssl->handshake->verify_cookie = mbedtls_malloc( cookie_len );
+    ssl->handshake->verify_cookie = mbedtls_calloc( 1, cookie_len );
     if( ssl->handshake->verify_cookie  == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", cookie_len ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", cookie_len ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
@@ -2911,9 +2911,9 @@ static int ssl_parse_new_session_ticket( mbedtls_ssl_context *ssl )
     ssl->session_negotiate->ticket = NULL;
     ssl->session_negotiate->ticket_len = 0;
 
-    if( ( ticket = mbedtls_malloc( ticket_len ) ) == NULL )
+    if( ( ticket = mbedtls_calloc( 1, ticket_len ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket malloc failed" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "ticket alloc failed" ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 

library/ssl_cookie.c

@@ -38,7 +38,7 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 

library/ssl_srv.c

@@ -42,7 +42,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -67,7 +67,7 @@ int mbedtls_ssl_set_client_transport_id( mbedtls_ssl_context *ssl,
 
     mbedtls_free( ssl->cli_id );
 
-    if( ( ssl->cli_id = mbedtls_malloc( ilen ) ) == NULL )
+    if( ( ssl->cli_id = mbedtls_calloc( 1, ilen ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
     memcpy( ssl->cli_id, info, ilen );
@@ -263,11 +263,9 @@ static int ssl_parse_supported_elliptic_curves( mbedtls_ssl_context *ssl,
     if( our_size > MBEDTLS_ECP_DP_MAX )
         our_size = MBEDTLS_ECP_DP_MAX;
 
-    if( ( curves = mbedtls_malloc( our_size * sizeof( *curves ) ) ) == NULL )
+    if( ( curves = mbedtls_calloc( our_size, sizeof( *curves ) ) ) == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
-    /* explicit void pointer cast for buggy MS compiler */
-    memset( (void *) curves, 0, our_size * sizeof( *curves ) );
     ssl->handshake->curves = curves;
 
     p = buf + 2;

library/ssl_ticket.c

@@ -33,7 +33,8 @@
 #if defined(MBEDTLS_PLATFORM_C)
 #include "mbedtls/platform.h"
 #else
-#define mbedtls_malloc     malloc
+#include <stdlib.h>
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -243,7 +244,7 @@ static int ssl_load_session( mbedtls_ssl_session *session,
         if( p + cert_len > end )
             return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-        session->peer_cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        session->peer_cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( session->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );

library/ssl_tls.c

@@ -51,7 +51,7 @@
 #include "mbedtls/platform.h"
 #else
 #include <stdlib.h>
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #endif
 
@@ -173,7 +173,7 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
     {
         int ret;
 
-        dst->peer_cert = mbedtls_malloc( sizeof(mbedtls_x509_crt) );
+        dst->peer_cert = mbedtls_calloc( 1, sizeof(mbedtls_x509_crt) );
         if( dst->peer_cert == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -192,7 +192,7 @@ static int ssl_session_copy( mbedtls_ssl_session *dst, const mbedtls_ssl_session
 #if defined(MBEDTLS_SSL_SESSION_TICKETS) && defined(MBEDTLS_SSL_CLI_C)
     if( src->ticket != NULL )
     {
-        dst->ticket = mbedtls_malloc( src->ticket_len );
+        dst->ticket = mbedtls_calloc( 1, src->ticket_len );
         if( dst->ticket == NULL )
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -929,10 +929,10 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
         if( ssl->compress_buf == NULL )
         {
             MBEDTLS_SSL_DEBUG_MSG( 3, ( "Allocating compression buffer" ) );
-            ssl->compress_buf = mbedtls_malloc( MBEDTLS_SSL_BUFFER_LEN );
+            ssl->compress_buf = mbedtls_calloc( 1, MBEDTLS_SSL_BUFFER_LEN );
             if( ssl->compress_buf == NULL )
             {
-                MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
+                MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
                                     MBEDTLS_SSL_BUFFER_LEN ) );
                 return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
             }
@@ -2454,16 +2454,16 @@ static int ssl_flight_append( mbedtls_ssl_context *ssl )
     mbedtls_ssl_flight_item *msg;
 
     /* Allocate space for current message */
-    if( ( msg = mbedtls_malloc( sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
+    if( ( msg = mbedtls_calloc( 1, sizeof(  mbedtls_ssl_flight_item ) ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed",
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed",
                             sizeof( mbedtls_ssl_flight_item ) ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
-    if( ( msg->p = mbedtls_malloc( ssl->out_msglen ) ) == NULL )
+    if( ( msg->p = mbedtls_calloc( 1, ssl->out_msglen ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc %d bytes failed", ssl->out_msglen ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc %d bytes failed", ssl->out_msglen ) );
         mbedtls_free( msg );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
@@ -2924,15 +2924,13 @@ static int ssl_reassemble_dtls_handshake( mbedtls_ssl_context *ssl )
         /* The bitmask needs one bit per byte of message excluding header */
         alloc_len = 12 + msg_len + msg_len / 8 + ( msg_len % 8 != 0 );
 
-        ssl->handshake->hs_msg = mbedtls_malloc( alloc_len );
+        ssl->handshake->hs_msg = mbedtls_calloc( 1, alloc_len );
         if( ssl->handshake->hs_msg == NULL )
         {
-            MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc failed (%d bytes)", alloc_len ) );
+            MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc failed (%d bytes)", alloc_len ) );
             return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
         }
 
-        memset( ssl->handshake->hs_msg, 0, alloc_len );
-
         /* Prepare final header: copy msg_type, length and message_seq,
          * then add standardised fragment_offset and fragment_length */
         memcpy( ssl->handshake->hs_msg, ssl->in_msg, 6 );
@@ -3975,10 +3973,10 @@ int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl )
         mbedtls_free( ssl->session_negotiate->peer_cert );
     }
 
-    if( ( ssl->session_negotiate->peer_cert = mbedtls_malloc(
+    if( ( ssl->session_negotiate->peer_cert = mbedtls_calloc( 1,
                     sizeof( mbedtls_x509_crt ) ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed",
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed",
                        sizeof( mbedtls_x509_crt ) ) );
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
@@ -4898,17 +4896,17 @@ static int ssl_handshake_init( mbedtls_ssl_context *ssl )
      */
     if( ssl->transform_negotiate == NULL )
     {
-        ssl->transform_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_transform) );
+        ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
     }
 
     if( ssl->session_negotiate == NULL )
     {
-        ssl->session_negotiate = mbedtls_malloc( sizeof(mbedtls_ssl_session) );
+        ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
     }
 
     if( ssl->handshake == NULL )
     {
-        ssl->handshake = mbedtls_malloc( sizeof(mbedtls_ssl_handshake_params) );
+        ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
     }
 
     /* All pointers should exist and can be directly freed without issue */
@@ -4916,7 +4914,7 @@ static int ssl_handshake_init( mbedtls_ssl_context *ssl )
         ssl->transform_negotiate == NULL ||
         ssl->session_negotiate == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc() of ssl sub-contexts failed" ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc() of ssl sub-contexts failed" ) );
 
         mbedtls_free( ssl->handshake );
         mbedtls_free( ssl->transform_negotiate );
@@ -5002,18 +5000,15 @@ int mbedtls_ssl_setup( mbedtls_ssl_context *ssl,
     /*
      * Prepare base structures
      */
-    if( ( ssl-> in_buf = mbedtls_malloc( len ) ) == NULL ||
+    if( ( ssl-> in_buf = mbedtls_calloc( 1, len ) ) == NULL ||
-        ( ssl->out_buf = mbedtls_malloc( len ) ) == NULL )
+        ( ssl->out_buf = mbedtls_calloc( 1, len ) ) == NULL )
     {
-        MBEDTLS_SSL_DEBUG_MSG( 1, ( "malloc(%d bytes) failed", len ) );
+        MBEDTLS_SSL_DEBUG_MSG( 1, ( "alloc(%d bytes) failed", len ) );
         mbedtls_free( ssl->in_buf );
         ssl->in_buf = NULL;
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
     }
 
-    memset( ssl-> in_buf, 0, len );
-    memset( ssl->out_buf, 0, len );
-
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
     if( conf->transport == MBEDTLS_SSL_TRANSPORT_DATAGRAM )
     {
@@ -5309,7 +5304,7 @@ static int ssl_append_key_cert( mbedtls_ssl_key_cert **head,
 {
     mbedtls_ssl_key_cert *new;
 
-    new = mbedtls_malloc( sizeof( mbedtls_ssl_key_cert ) );
+    new = mbedtls_calloc( 1, sizeof( mbedtls_ssl_key_cert ) );
     if( new == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );
 
@@ -5384,8 +5379,8 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
         mbedtls_free( conf->psk_identity );
     }
 
-    if( ( conf->psk = mbedtls_malloc( psk_len ) ) == NULL ||
+    if( ( conf->psk = mbedtls_calloc( 1, psk_len ) ) == NULL ||
-        ( conf->psk_identity = mbedtls_malloc( psk_identity_len ) ) == NULL )
+        ( conf->psk_identity = mbedtls_calloc( 1, psk_identity_len ) ) == NULL )
     {
         mbedtls_free( conf->psk );
         conf->psk = NULL;
@@ -5413,7 +5408,7 @@ int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
     if( ssl->handshake->psk != NULL )
         mbedtls_free( ssl->conf->psk );
 
-    if( ( ssl->handshake->psk = mbedtls_malloc( psk_len ) ) == NULL )
+    if( ( ssl->handshake->psk = mbedtls_calloc( 1, psk_len ) ) == NULL )
     {
         mbedtls_free( ssl->handshake->psk );
         ssl->handshake->psk = NULL;
@@ -5492,7 +5487,7 @@ int mbedtls_ssl_set_hostname( mbedtls_ssl_context *ssl, const char *hostname )
     if( hostname_len + 1 == 0 )
         return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );
 
-    ssl->hostname = mbedtls_malloc( hostname_len + 1 );
+    ssl->hostname = mbedtls_calloc( 1, hostname_len + 1 );
 
     if( ssl->hostname == NULL )
         return( MBEDTLS_ERR_SSL_MALLOC_FAILED );

library/x509.c

@@ -55,7 +55,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #define mbedtls_snprintf   snprintf
 #endif
@@ -452,13 +452,11 @@ int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
             /* Mark this item as being no the only one in a set */
             cur->next_merged = 1;
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
-            memset( cur->next, 0, sizeof( mbedtls_x509_name ) );
-
             cur = cur->next;
         }
 
@@ -468,13 +466,11 @@ int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
         if( *p == end )
             return( 0 );
 
-        cur->next = mbedtls_malloc( sizeof( mbedtls_x509_name ) );
+        cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
 
         if( cur->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
-        memset( cur->next, 0, sizeof( mbedtls_x509_name ) );
-
         cur = cur->next;
     }
 }
@@ -597,7 +593,7 @@ int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x50
     {
         mbedtls_pk_rsassa_pss_options *pss_opts;
 
-        pss_opts = mbedtls_malloc( sizeof( mbedtls_pk_rsassa_pss_options ) );
+        pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
         if( pss_opts == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 

library/x509_crl.c

@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -238,12 +238,11 @@ static int x509_get_entries( unsigned char **p,
 
         if( *p < end )
         {
-            cur_entry->next = mbedtls_malloc( sizeof( mbedtls_x509_crl_entry ) );
+            cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
 
             if( cur_entry->next == NULL )
                 return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
-            memset( cur_entry->next, 0, sizeof( mbedtls_x509_crl_entry ) );
             cur_entry = cur_entry->next;
         }
     }
@@ -281,7 +280,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
 
     if( crl->version != 0 && crl->next == NULL )
     {
-        crl->next = mbedtls_malloc( sizeof( mbedtls_x509_crl ) );
+        crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
 
         if( crl->next == NULL )
         {
@@ -296,7 +295,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
     /*
      * Copy raw DER-encoded CRL
      */
-    if( ( p = mbedtls_malloc( buflen ) ) == NULL )
+    if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
     memcpy( p, buf, buflen );

library/x509_crt.c

@@ -53,7 +53,7 @@
 #else
 #include <stdlib.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -359,13 +359,12 @@ static int x509_get_subject_alt_name( unsigned char **p,
             if( cur->next != NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS );
 
-            cur->next = mbedtls_malloc( sizeof( mbedtls_asn1_sequence ) );
+            cur->next = mbedtls_calloc( 1, sizeof( mbedtls_asn1_sequence ) );
 
             if( cur->next == NULL )
                 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
                         MBEDTLS_ERR_ASN1_MALLOC_FAILED );
 
-            memset( cur->next, 0, sizeof( mbedtls_asn1_sequence ) );
             cur = cur->next;
         }
 
@@ -553,7 +552,7 @@ static int x509_crt_parse_der_core( mbedtls_x509_crt *crt, const unsigned char *
     if( crt == NULL || buf == NULL )
         return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
 
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );
 
@@ -808,7 +807,7 @@ int mbedtls_x509_crt_parse_der( mbedtls_x509_crt *chain, const unsigned char *bu
      */
     if( crt->version != 0 && crt->next == NULL )
     {
-        crt->next = mbedtls_malloc( sizeof( mbedtls_x509_crt ) );
+        crt->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) );
 
         if( crt->next == NULL )
             return( MBEDTLS_ERR_X509_MALLOC_FAILED );

library/x509_csr.c

@@ -53,7 +53,7 @@
 #include <stdlib.h>
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_snprintf   snprintf
 #endif
 
@@ -113,7 +113,7 @@ int mbedtls_x509_csr_parse_der( mbedtls_x509_csr *csr,
     /*
      * first copy the raw DER data
      */
-    p = mbedtls_malloc( len = buflen );
+    p = mbedtls_calloc( 1, len = buflen );
 
     if( p == NULL )
         return( MBEDTLS_ERR_X509_MALLOC_FAILED );

programs/ssl/ssl_server2.c

@@ -31,7 +31,7 @@
 #else
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_fprintf    fprintf
 #define mbedtls_printf     printf
 #endif
@@ -493,7 +493,7 @@ sni_entry *sni_parse( char *sni_string )
 
     while( p <= end )
     {
-        if( ( new = mbedtls_malloc( sizeof( sni_entry ) ) ) == NULL )
+        if( ( new = mbedtls_calloc( 1, sizeof( sni_entry ) ) ) == NULL )
         {
             sni_free( cur );
             return( NULL );
@@ -501,8 +501,8 @@ sni_entry *sni_parse( char *sni_string )
 
         memset( new, 0, sizeof( sni_entry ) );
 
-        if( ( new->cert = mbedtls_malloc( sizeof( mbedtls_x509_crt ) ) ) == NULL ||
+        if( ( new->cert = mbedtls_calloc( 1, sizeof( mbedtls_x509_crt ) ) ) == NULL ||
-            ( new->key = mbedtls_malloc( sizeof( mbedtls_pk_context ) ) ) == NULL )
+            ( new->key = mbedtls_calloc( 1, sizeof( mbedtls_pk_context ) ) ) == NULL )
         {
             mbedtls_free( new->cert );
             mbedtls_free( new );
@@ -643,7 +643,7 @@ psk_entry *psk_parse( char *psk_string )
 
     while( p <= end )
     {
-        if( ( new = mbedtls_malloc( sizeof( psk_entry ) ) ) == NULL )
+        if( ( new = mbedtls_calloc( 1, sizeof( psk_entry ) ) ) == NULL )
             goto error;
 
         memset( new, 0, sizeof( psk_entry ) );
@@ -2007,7 +2007,7 @@ data_exchange:
                 ori_len = ret;
                 extra_len = mbedtls_ssl_get_bytes_avail( &ssl );
 
-                larger_buf = mbedtls_malloc( ori_len + extra_len + 1 );
+                larger_buf = mbedtls_calloc( 1, ori_len + extra_len + 1 );
                 if( larger_buf == NULL )
                 {
                     mbedtls_printf( "  ! memory allocation failed\n" );

programs/test/benchmark.c

@@ -45,6 +45,7 @@ int main( void )
 #else
 
 #include <string.h>
+#include <stdlib.h>
 
 #include "mbedtls/timing.h"
 
@@ -86,7 +87,7 @@ int main( void )
 #define MEM_BLOCK_OVERHEAD  ( 2 * sizeof( size_t ) )
 
 /*
- * Size to use for the malloc buffer if MEMORY_BUFFER_ALLOC_C is defined.
+ * Size to use for the alloc buffer if MEMORY_BUFFER_ALLOC_C is defined.
  */
 #define HEAP_SIZE       (1u << 16)  // 64k
 
@@ -252,7 +253,7 @@ int main( int argc, char *argv[] )
     char title[TITLE_LEN];
     todo_list todo;
 #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
-    unsigned char malloc_buf[HEAP_SIZE] = { 0 };
+    unsigned char alloc_buf[HEAP_SIZE] = { 0 };
 #endif
 
     if( argc <= 1 )
@@ -318,7 +319,7 @@ int main( int argc, char *argv[] )
     mbedtls_printf( "\n" );
 
 #if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C)
-    mbedtls_memory_buffer_alloc_init( malloc_buf, sizeof( malloc_buf ) );
+    mbedtls_memory_buffer_alloc_init( alloc_buf, sizeof( alloc_buf ) );
 #endif
     memset( buf, 0xAA, sizeof( buf ) );
     memset( tmp, 0xBB, sizeof( tmp ) );

programs/util/pem2der.c

@@ -31,7 +31,7 @@
 #else
 #include <stdio.h>
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_printf     printf
 #endif
 
@@ -136,7 +136,7 @@ static int load_file( const char *path, unsigned char **buf, size_t *n )
     *n = (size_t) size;
 
     if( *n + 1 == 0 ||
-        ( *buf = mbedtls_malloc( *n + 1 ) ) == NULL )
+        ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL )
     {
         fclose( f );
         return( -1 );

tests/suites/helpers.function

@@ -4,7 +4,7 @@
 #include <stdio.h>
 #define mbedtls_printf     printf
 #define mbedtls_fprintf    fprintf
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_free       free
 #define mbedtls_exit       exit
 #define mbedtls_fprintf    fprintf
@@ -123,7 +123,7 @@ static unsigned char *zero_alloc( size_t len )
     void *p;
     size_t actual_len = ( len != 0 ) ? len : 1;
 
-    p = mbedtls_malloc( actual_len );
+    p = mbedtls_calloc( 1, actual_len );
     assert( p != NULL );
 
     memset( p, 0x00, actual_len );
@@ -150,7 +150,7 @@ static unsigned char *unhexify_alloc( const char *ibuf, size_t *olen )
     if( *olen == 0 )
         return( zero_alloc( *olen ) );
 
-    obuf = mbedtls_malloc( *olen );
+    obuf = mbedtls_calloc( 1, *olen );
     assert( obuf != NULL );
 
     (void) unhexify( obuf, ibuf );

tests/suites/main_test.function

@@ -6,7 +6,7 @@
 #include <stdio.h>
 #define mbedtls_exit       exit
 #define mbedtls_free       free
-#define mbedtls_malloc     malloc
+#define mbedtls_calloc    calloc
 #define mbedtls_fprintf    fprintf
 #define mbedtls_printf     printf
 #endif

tests/suites/test_suite_pem.function

@@ -23,7 +23,7 @@ void mbedtls_pem_write_buffer( char *start, char *end, char *buf_str, char *resu
     ret = mbedtls_pem_write_buffer( start, end, buf, buf_len, NULL, 0, &olen );
     TEST_ASSERT( ret == MBEDTLS_ERR_BASE64_BUFFER_TOO_SMALL );
 
-    check_buf = (unsigned char *) mbedtls_malloc( olen );
+    check_buf = (unsigned char *) mbedtls_calloc( 1, olen );
     TEST_ASSERT( check_buf != NULL );
 
     memset( check_buf, 0, olen );