27 files changed, 66 insertions, 96 deletions

diff --git a/src/lib/libssl/bio_ssl.c b/src/lib/libssl/bio_ssl.c
index e88137aeca..4c5c5ac3de 100644
--- a/src/lib/libssl/bio_ssl.c
+++ b/src/lib/libssl/bio_ssl.c
@@ -105,12 +105,11 @@ ssl_new(BIO *bi)
 {
         BIO_SSL *bs;
 
-        bs = (BIO_SSL *)malloc(sizeof(BIO_SSL));
+        bs = calloc(1, sizeof(BIO_SSL));
         if (bs == NULL) {
                 BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
                 return (0);
         }
-        memset(bs, 0, sizeof(BIO_SSL));
         bi->init = 0;
         bi->ptr = (char *)bs;
         bi->flags = 0;
diff --git a/src/lib/libssl/d1_both.c b/src/lib/libssl/d1_both.c
index 2f7dc283a0..ae7e7b457b 100644
--- a/src/lib/libssl/d1_both.c
+++ b/src/lib/libssl/d1_both.c
@@ -179,12 +179,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
         unsigned char *buf = NULL;
         unsigned char *bitmask = NULL;
 
-        frag = (hm_fragment *)malloc(sizeof(hm_fragment));
+        frag = malloc(sizeof(hm_fragment));
         if (frag == NULL)
                 return NULL;
 
         if (frag_len) {
-                buf = (unsigned char *)malloc(frag_len);
+                buf = malloc(frag_len);
                 if (buf == NULL) {
                         free(frag);
                         return NULL;
@@ -196,7 +196,7 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 
         /* Initialize reassembly bitmask if necessary */
         if (reassembly) {
-                bitmask = (unsigned char *)malloc(RSMBLY_BITMASK_SIZE(frag_len));
+                bitmask = malloc(RSMBLY_BITMASK_SIZE(frag_len));
                 if (bitmask == NULL) {
                         if (buf != NULL)
                                 free(buf);
diff --git a/src/lib/libssl/d1_clnt.c b/src/lib/libssl/d1_clnt.c
index 6bceeea55b..cf9bc2d33e 100644
--- a/src/lib/libssl/d1_clnt.c
+++ b/src/lib/libssl/d1_clnt.c
@@ -1308,9 +1308,7 @@ dtls1_send_client_key_exchange(SSL *s)
                                         POINT_CONVERSION_UNCOMPRESSED,
                                         NULL, 0, NULL);
 
-                                encodedPoint = (unsigned char *)
-                                    malloc(encoded_pt_len *
-                                        sizeof(unsigned char));
+                                encodedPoint = malloc(encoded_pt_len);
 
                                 bn_ctx = BN_CTX_new();
                                 if ((encodedPoint == NULL) ||
diff --git a/src/lib/libssl/d1_srvr.c b/src/lib/libssl/d1_srvr.c
index fc475485ba..8fa75819bb 100644
--- a/src/lib/libssl/d1_srvr.c
+++ b/src/lib/libssl/d1_srvr.c
@@ -1182,8 +1182,7 @@ dtls1_send_server_key_exchange(SSL *s)
                         POINT_CONVERSION_UNCOMPRESSED,
                         NULL, 0, NULL);
 
-                        encodedPoint = (unsigned char *)
-                        malloc(encodedlen*sizeof(unsigned char));
+                        encodedPoint = malloc(encodedlen);
 
                         bn_ctx = BN_CTX_new();
                         if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/src/lib/libssl/s3_clnt.c b/src/lib/libssl/s3_clnt.c
index 10546ee848..ac1812d857 100644
--- a/src/lib/libssl/s3_clnt.c
+++ b/src/lib/libssl/s3_clnt.c
@@ -2390,9 +2390,7 @@ ssl3_send_client_key_exchange(SSL *s)
                                        POINT_CONVERSION_UNCOMPRESSED,
                                        NULL, 0, NULL);
 
-                                encodedPoint =
-                                    (unsigned char *)malloc(
-                                        encoded_pt_len * sizeof(unsigned char));
+                                encodedPoint = malloc(encoded_pt_len);
 
                                 bn_ctx = BN_CTX_new();
                                 if ((encodedPoint == NULL) ||
diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 95e5c903ec..c79464da55 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -2777,9 +2777,8 @@ ssl3_new(SSL *s)
 {
         SSL3_STATE *s3;
 
-        if ((s3 = malloc(sizeof *s3)) == NULL)
+        if ((s3 = calloc(1, sizeof *s3)) == NULL)
                 goto err;
-        memset(s3, 0, sizeof *s3);
         memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num));
         memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num));
 
diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 8416eb7042..ea3137c074 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -1736,8 +1736,7 @@ ssl3_send_server_key_exchange(SSL *s)
                             POINT_CONVERSION_UNCOMPRESSED,
                             NULL, 0, NULL);
 
-                        encodedPoint = (unsigned char *)
-                        malloc(encodedlen*sizeof(unsigned char));
+                        encodedPoint = malloc(encodedlen);
 
                         bn_ctx = BN_CTX_new();
                         if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/src/lib/libssl/src/ssl/bio_ssl.c b/src/lib/libssl/src/ssl/bio_ssl.c
index e88137aeca..4c5c5ac3de 100644
--- a/src/lib/libssl/src/ssl/bio_ssl.c
+++ b/src/lib/libssl/src/ssl/bio_ssl.c
@@ -105,12 +105,11 @@ ssl_new(BIO *bi)
 {
         BIO_SSL *bs;
 
-        bs = (BIO_SSL *)malloc(sizeof(BIO_SSL));
+        bs = calloc(1, sizeof(BIO_SSL));
         if (bs == NULL) {
                 BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
                 return (0);
         }
-        memset(bs, 0, sizeof(BIO_SSL));
         bi->init = 0;
         bi->ptr = (char *)bs;
         bi->flags = 0;
diff --git a/src/lib/libssl/src/ssl/d1_both.c b/src/lib/libssl/src/ssl/d1_both.c
index 2f7dc283a0..ae7e7b457b 100644
--- a/src/lib/libssl/src/ssl/d1_both.c
+++ b/src/lib/libssl/src/ssl/d1_both.c
@@ -179,12 +179,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
         unsigned char *buf = NULL;
         unsigned char *bitmask = NULL;
 
-        frag = (hm_fragment *)malloc(sizeof(hm_fragment));
+        frag = malloc(sizeof(hm_fragment));
         if (frag == NULL)
                 return NULL;
 
         if (frag_len) {
-                buf = (unsigned char *)malloc(frag_len);
+                buf = malloc(frag_len);
                 if (buf == NULL) {
                         free(frag);
                         return NULL;
@@ -196,7 +196,7 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 
         /* Initialize reassembly bitmask if necessary */
         if (reassembly) {
-                bitmask = (unsigned char *)malloc(RSMBLY_BITMASK_SIZE(frag_len));
+                bitmask = malloc(RSMBLY_BITMASK_SIZE(frag_len));
                 if (bitmask == NULL) {
                         if (buf != NULL)
                                 free(buf);
diff --git a/src/lib/libssl/src/ssl/d1_clnt.c b/src/lib/libssl/src/ssl/d1_clnt.c
index 6bceeea55b..cf9bc2d33e 100644
--- a/src/lib/libssl/src/ssl/d1_clnt.c
+++ b/src/lib/libssl/src/ssl/d1_clnt.c
@@ -1308,9 +1308,7 @@ dtls1_send_client_key_exchange(SSL *s)
                                         POINT_CONVERSION_UNCOMPRESSED,
                                         NULL, 0, NULL);
 
-                                encodedPoint = (unsigned char *)
-                                    malloc(encoded_pt_len *
-                                        sizeof(unsigned char));
+                                encodedPoint = malloc(encoded_pt_len);
 
                                 bn_ctx = BN_CTX_new();
                                 if ((encodedPoint == NULL) ||
diff --git a/src/lib/libssl/src/ssl/d1_srvr.c b/src/lib/libssl/src/ssl/d1_srvr.c
index fc475485ba..8fa75819bb 100644
--- a/src/lib/libssl/src/ssl/d1_srvr.c
+++ b/src/lib/libssl/src/ssl/d1_srvr.c
@@ -1182,8 +1182,7 @@ dtls1_send_server_key_exchange(SSL *s)
                         POINT_CONVERSION_UNCOMPRESSED,
                         NULL, 0, NULL);
 
-                        encodedPoint = (unsigned char *)
-                        malloc(encodedlen*sizeof(unsigned char));
+                        encodedPoint = malloc(encodedlen);
 
                         bn_ctx = BN_CTX_new();
                         if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/src/lib/libssl/src/ssl/s3_clnt.c b/src/lib/libssl/src/ssl/s3_clnt.c
index 10546ee848..ac1812d857 100644
--- a/src/lib/libssl/src/ssl/s3_clnt.c
+++ b/src/lib/libssl/src/ssl/s3_clnt.c
@@ -2390,9 +2390,7 @@ ssl3_send_client_key_exchange(SSL *s)
                                        POINT_CONVERSION_UNCOMPRESSED,
                                        NULL, 0, NULL);
 
-                                encodedPoint =
-                                    (unsigned char *)malloc(
-                                        encoded_pt_len * sizeof(unsigned char));
+                                encodedPoint = malloc(encoded_pt_len);
 
                                 bn_ctx = BN_CTX_new();
                                 if ((encodedPoint == NULL) ||
diff --git a/src/lib/libssl/src/ssl/s3_enc.c b/src/lib/libssl/src/ssl/s3_enc.c
index 2b02c5ba06..5a45cec1c1 100644
--- a/src/lib/libssl/src/ssl/s3_enc.c
+++ b/src/lib/libssl/src/ssl/s3_enc.c
@@ -245,9 +245,10 @@ ssl3_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_read_ctx = malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
-                else
+                else {
                         /* make sure it's intialized in case we exit later with an error */
-                EVP_CIPHER_CTX_init(s->enc_read_ctx);
+                        EVP_CIPHER_CTX_init(s->enc_read_ctx);
+                }
                 dd = s->enc_read_ctx;
 
                 ssl_replace_hash(&s->read_hash, m);
@@ -264,8 +265,7 @@ ssl3_change_cipher_state(SSL *s, int which)
                                 goto err2;
                         }
                         if (s->s3->rrec.comp == NULL)
-                                s->s3->rrec.comp = (unsigned char *)
-                        malloc(SSL3_RT_MAX_PLAIN_LENGTH);
+                                s->s3->rrec.comp = malloc(SSL3_RT_MAX_PLAIN_LENGTH);
                         if (s->s3->rrec.comp == NULL)
                                 goto err;
                 }
@@ -277,9 +277,10 @@ ssl3_change_cipher_state(SSL *s, int which)
                         reuse_dd = 1;
                 else if ((s->enc_write_ctx = malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
                         goto err;
-                else
+                else {
                         /* make sure it's intialized in case we exit later with an error */
-                EVP_CIPHER_CTX_init(s->enc_write_ctx);
+                        EVP_CIPHER_CTX_init(s->enc_write_ctx);
+                }
                 dd = s->enc_write_ctx;
                 ssl_replace_hash(&s->write_hash, m);
 #ifndef OPENSSL_NO_COMP
@@ -577,8 +578,7 @@ ssl3_digest_cached_records(SSL *s)
 
         /* Allocate handshake_dgst array */
         ssl3_free_digest_list(s);
-        s->s3->handshake_dgst = malloc(SSL_MAX_DIGEST * sizeof(EVP_MD_CTX *));
-        memset(s->s3->handshake_dgst, 0, SSL_MAX_DIGEST *sizeof(EVP_MD_CTX *));
+        s->s3->handshake_dgst = calloc(SSL_MAX_DIGEST, sizeof(EVP_MD_CTX *));
         hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
         if (hdatalen <= 0) {
                 SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, SSL_R_BAD_HANDSHAKE_LENGTH);
diff --git a/src/lib/libssl/src/ssl/s3_lib.c b/src/lib/libssl/src/ssl/s3_lib.c
index 95e5c903ec..c79464da55 100644
--- a/src/lib/libssl/src/ssl/s3_lib.c
+++ b/src/lib/libssl/src/ssl/s3_lib.c
@@ -2777,9 +2777,8 @@ ssl3_new(SSL *s)
 {
         SSL3_STATE *s3;
 
-        if ((s3 = malloc(sizeof *s3)) == NULL)
+        if ((s3 = calloc(1, sizeof *s3)) == NULL)
                 goto err;
-        memset(s3, 0, sizeof *s3);
         memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num));
         memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num));
 
diff --git a/src/lib/libssl/src/ssl/s3_srvr.c b/src/lib/libssl/src/ssl/s3_srvr.c
index 8416eb7042..ea3137c074 100644
--- a/src/lib/libssl/src/ssl/s3_srvr.c
+++ b/src/lib/libssl/src/ssl/s3_srvr.c
@@ -1736,8 +1736,7 @@ ssl3_send_server_key_exchange(SSL *s)
                             POINT_CONVERSION_UNCOMPRESSED,
                             NULL, 0, NULL);
 
-                        encodedPoint = (unsigned char *)
-                        malloc(encodedlen*sizeof(unsigned char));
+                        encodedPoint = malloc(encodedlen);
 
                         bn_ctx = BN_CTX_new();
                         if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/src/lib/libssl/src/ssl/ssl_cert.c b/src/lib/libssl/src/ssl/ssl_cert.c
index 389d47408c..b493585c58 100644
--- a/src/lib/libssl/src/ssl/ssl_cert.c
+++ b/src/lib/libssl/src/ssl/ssl_cert.c
@@ -176,13 +176,11 @@ ssl_cert_new(void)
 {
         CERT *ret;
 
-        ret = (CERT *)malloc(sizeof(CERT));
+        ret = calloc(1, sizeof(CERT));
         if (ret == NULL) {
                 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
                 return (NULL);
         }
-        memset(ret, 0, sizeof(CERT));
-
         ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
         ret->references = 1;
         ssl_cert_set_default_md(ret);
@@ -195,14 +193,12 @@ ssl_cert_dup(CERT *cert)
         CERT *ret;
         int i;
 
-        ret = (CERT *)malloc(sizeof(CERT));
+        ret = calloc(1, sizeof(CERT));
         if (ret == NULL) {
                 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
                 return (NULL);
         }
 
-        memset(ret, 0, sizeof(CERT));
-
         ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];
         /* or ret->key = ret->pkeys + (cert->key - cert->pkeys),
          * if you find that more readable */
@@ -403,13 +399,11 @@ ssl_sess_cert_new(void)
 {
         SESS_CERT *ret;
 
-        ret = malloc(sizeof *ret);
+        ret = calloc(1, sizeof *ret);
         if (ret == NULL) {
                 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-
-        memset(ret, 0 , sizeof *ret);
         ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
         ret->references = 1;
 
diff --git a/src/lib/libssl/src/ssl/ssl_ciph.c b/src/lib/libssl/src/ssl/ssl_ciph.c
index 87b3f7a3cc..41632720be 100644
--- a/src/lib/libssl/src/ssl/ssl_ciph.c
+++ b/src/lib/libssl/src/ssl/ssl_ciph.c
@@ -456,7 +456,7 @@ load_builtin_compressions(void)
                         MemCheck_off();
                         ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
                         if (ssl_comp_methods != NULL) {
-                                comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+                                comp = malloc(sizeof(SSL_COMP));
                                 if (comp != NULL) {
                                         comp->method = COMP_zlib();
                                         if (comp->method &&
@@ -1759,7 +1759,7 @@ SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
         }
 
         MemCheck_off();
-        comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+        comp = malloc(sizeof(SSL_COMP));
         comp->id = id;
         comp->method = cm;
         load_builtin_compressions();
diff --git a/src/lib/libssl/src/ssl/ssl_lib.c b/src/lib/libssl/src/ssl/ssl_lib.c
index 21d6835b98..cde564cade 100644
--- a/src/lib/libssl/src/ssl/ssl_lib.c
+++ b/src/lib/libssl/src/ssl/ssl_lib.c
@@ -270,10 +270,9 @@ SSL_new(SSL_CTX *ctx)
                 return (NULL);
         }
 
-        s = (SSL *)malloc(sizeof(SSL));
+        s = calloc(1, sizeof(SSL));
         if (s == NULL)
                 goto err;
-        memset(s, 0, sizeof(SSL));
 
 #ifndef OPENSSL_NO_KRB5
         s->kssl_ctx = kssl_ctx_new();
@@ -1685,12 +1684,10 @@ SSL_CTX_new(const SSL_METHOD *meth)
                 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
                 goto err;
         }
-        ret = (SSL_CTX *)malloc(sizeof(SSL_CTX));
+        ret = calloc(1, sizeof(SSL_CTX));
         if (ret == NULL)
                 goto err;
 
-        memset(ret, 0, sizeof(SSL_CTX));
-
         ret->method = meth;
 
         ret->cert_store = NULL;
diff --git a/src/lib/libssl/src/ssl/ssl_sess.c b/src/lib/libssl/src/ssl/ssl_sess.c
index c032154d48..cc8e66b49d 100644
--- a/src/lib/libssl/src/ssl/ssl_sess.c
+++ b/src/lib/libssl/src/ssl/ssl_sess.c
@@ -195,12 +195,11 @@ SSL_SESSION_new(void)
 {
         SSL_SESSION *ss;
 
-        ss = (SSL_SESSION *)malloc(sizeof(SSL_SESSION));
+        ss = calloc(1, sizeof(SSL_SESSION));
         if (ss == NULL) {
                 SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
                 return (0);
         }
-        memset(ss, 0, sizeof(SSL_SESSION));
 
         ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
         ss->references = 1;
@@ -758,7 +757,7 @@ SSL_set_session(SSL *s, SSL_SESSION *session)
 #ifndef OPENSSL_NO_KRB5
                 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
                         session->krb5_client_princ_len > 0) {
-                        s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
+                        s->kssl_ctx->client_princ = malloc(session->krb5_client_princ_len + 1);
                         memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
                         session->krb5_client_princ_len);
                         s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
diff --git a/src/lib/libssl/src/ssl/t1_enc.c b/src/lib/libssl/src/ssl/t1_enc.c
index 3f5df9ad7a..ac503f53ee 100644
--- a/src/lib/libssl/src/ssl/t1_enc.c
+++ b/src/lib/libssl/src/ssl/t1_enc.c
@@ -593,7 +593,7 @@ tls1_setup_key_block(SSL *s)
 
         ssl3_cleanup_key_block(s);
 
-        if ((p1 = (unsigned char *)malloc(num)) == NULL) {
+        if ((p1 = malloc(num)) == NULL) {
                 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
@@ -601,7 +601,7 @@ tls1_setup_key_block(SSL *s)
         s->s3->tmp.key_block_length = num;
         s->s3->tmp.key_block = p1;
 
-        if ((p2 = (unsigned char *)malloc(num)) == NULL) {
+        if ((p2 = malloc(num)) == NULL) {
                 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
diff --git a/src/lib/libssl/src/ssl/t1_lib.c b/src/lib/libssl/src/ssl/t1_lib.c
index 85d0fa4970..01ecf9479d 100644
--- a/src/lib/libssl/src/ssl/t1_lib.c
+++ b/src/lib/libssl/src/ssl/t1_lib.c
@@ -506,8 +506,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
                         if (!s->session->tlsext_tick)
                                 return NULL;
                         memcpy(s->session->tlsext_tick,
-                        s->tlsext_session_ticket->data,
-                        ticklen);
+                            s->tlsext_session_ticket->data, ticklen);
                         s->session->tlsext_ticklen = ticklen;
                 } else
                         ticklen = 0;
@@ -1029,7 +1028,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
                                                         return 0;
                                                 }
-                                                if ((s->session->tlsext_hostname = malloc(len + 1)) == NULL) {
+                                                if ((s->session->tlsext_hostname =
+                                                    malloc(len + 1)) == NULL) {
                                                         *al = TLS1_AD_INTERNAL_ERROR;
                                                         return 0;
                                                 }
@@ -1101,7 +1101,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                                         s->session->tlsext_ecpointformatlist = NULL;
                                 }
                                 s->session->tlsext_ecpointformatlist_length = 0;
-                                if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+                                if ((s->session->tlsext_ecpointformatlist =
+                                    malloc(ecpointformatlist_length)) == NULL) {
                                         *al = TLS1_AD_INTERNAL_ERROR;
                                         return 0;
                                 }
@@ -1132,7 +1133,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                                         return 0;
                                 }
                                 s->session->tlsext_ellipticcurvelist_length = 0;
-                                if ((s->session->tlsext_ellipticcurvelist = malloc(ellipticcurvelist_length)) == NULL) {
+                                if ((s->session->tlsext_ellipticcurvelist =
+                                    malloc(ellipticcurvelist_length)) == NULL) {
                                         *al = TLS1_AD_INTERNAL_ERROR;
                                         return 0;
                                 }
@@ -1423,7 +1425,8 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n,
                         s->session->tlsext_ecpointformatlist_length = 0;
                         if (s->session->tlsext_ecpointformatlist != NULL)
                                 free(s->session->tlsext_ecpointformatlist);
-                        if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+                        if ((s->session->tlsext_ecpointformatlist =
+                            malloc(ecpointformatlist_length)) == NULL) {
                                 *al = TLS1_AD_INTERNAL_ERROR;
                                 return 0;
                         }
diff --git a/src/lib/libssl/ssl_cert.c b/src/lib/libssl/ssl_cert.c
index 389d47408c..b493585c58 100644
--- a/src/lib/libssl/ssl_cert.c
+++ b/src/lib/libssl/ssl_cert.c
@@ -176,13 +176,11 @@ ssl_cert_new(void)
 {
         CERT *ret;
 
-        ret = (CERT *)malloc(sizeof(CERT));
+        ret = calloc(1, sizeof(CERT));
         if (ret == NULL) {
                 SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
                 return (NULL);
         }
-        memset(ret, 0, sizeof(CERT));
-
         ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
         ret->references = 1;
         ssl_cert_set_default_md(ret);
@@ -195,14 +193,12 @@ ssl_cert_dup(CERT *cert)
         CERT *ret;
         int i;
 
-        ret = (CERT *)malloc(sizeof(CERT));
+        ret = calloc(1, sizeof(CERT));
         if (ret == NULL) {
                 SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
                 return (NULL);
         }
 
-        memset(ret, 0, sizeof(CERT));
-
         ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];
         /* or ret->key = ret->pkeys + (cert->key - cert->pkeys),
          * if you find that more readable */
@@ -403,13 +399,11 @@ ssl_sess_cert_new(void)
 {
         SESS_CERT *ret;
 
-        ret = malloc(sizeof *ret);
+        ret = calloc(1, sizeof *ret);
         if (ret == NULL) {
                 SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
-
-        memset(ret, 0 , sizeof *ret);
         ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
         ret->references = 1;
 
diff --git a/src/lib/libssl/ssl_ciph.c b/src/lib/libssl/ssl_ciph.c
index 87b3f7a3cc..41632720be 100644
--- a/src/lib/libssl/ssl_ciph.c
+++ b/src/lib/libssl/ssl_ciph.c
@@ -456,7 +456,7 @@ load_builtin_compressions(void)
                         MemCheck_off();
                         ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
                         if (ssl_comp_methods != NULL) {
-                                comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+                                comp = malloc(sizeof(SSL_COMP));
                                 if (comp != NULL) {
                                         comp->method = COMP_zlib();
                                         if (comp->method &&
@@ -1759,7 +1759,7 @@ SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
         }
 
         MemCheck_off();
-        comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+        comp = malloc(sizeof(SSL_COMP));
         comp->id = id;
         comp->method = cm;
         load_builtin_compressions();
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index 21d6835b98..cde564cade 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -270,10 +270,9 @@ SSL_new(SSL_CTX *ctx)
                 return (NULL);
         }
 
-        s = (SSL *)malloc(sizeof(SSL));
+        s = calloc(1, sizeof(SSL));
         if (s == NULL)
                 goto err;
-        memset(s, 0, sizeof(SSL));
 
 #ifndef OPENSSL_NO_KRB5
         s->kssl_ctx = kssl_ctx_new();
@@ -1685,12 +1684,10 @@ SSL_CTX_new(const SSL_METHOD *meth)
                 SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
                 goto err;
         }
-        ret = (SSL_CTX *)malloc(sizeof(SSL_CTX));
+        ret = calloc(1, sizeof(SSL_CTX));
         if (ret == NULL)
                 goto err;
 
-        memset(ret, 0, sizeof(SSL_CTX));
-
         ret->method = meth;
 
         ret->cert_store = NULL;
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index c032154d48..cc8e66b49d 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -195,12 +195,11 @@ SSL_SESSION_new(void)
 {
         SSL_SESSION *ss;
 
-        ss = (SSL_SESSION *)malloc(sizeof(SSL_SESSION));
+        ss = calloc(1, sizeof(SSL_SESSION));
         if (ss == NULL) {
                 SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
                 return (0);
         }
-        memset(ss, 0, sizeof(SSL_SESSION));
 
         ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
         ss->references = 1;
@@ -758,7 +757,7 @@ SSL_set_session(SSL *s, SSL_SESSION *session)
 #ifndef OPENSSL_NO_KRB5
                 if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
                         session->krb5_client_princ_len > 0) {
-                        s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
+                        s->kssl_ctx->client_princ = malloc(session->krb5_client_princ_len + 1);
                         memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
                         session->krb5_client_princ_len);
                         s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
diff --git a/src/lib/libssl/t1_enc.c b/src/lib/libssl/t1_enc.c
index 3f5df9ad7a..ac503f53ee 100644
--- a/src/lib/libssl/t1_enc.c
+++ b/src/lib/libssl/t1_enc.c
@@ -593,7 +593,7 @@ tls1_setup_key_block(SSL *s)
 
         ssl3_cleanup_key_block(s);
 
-        if ((p1 = (unsigned char *)malloc(num)) == NULL) {
+        if ((p1 = malloc(num)) == NULL) {
                 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
@@ -601,7 +601,7 @@ tls1_setup_key_block(SSL *s)
         s->s3->tmp.key_block_length = num;
         s->s3->tmp.key_block = p1;
 
-        if ((p2 = (unsigned char *)malloc(num)) == NULL) {
+        if ((p2 = malloc(num)) == NULL) {
                 SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
                 goto err;
         }
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 85d0fa4970..01ecf9479d 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -506,8 +506,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
                         if (!s->session->tlsext_tick)
                                 return NULL;
                         memcpy(s->session->tlsext_tick,
-                        s->tlsext_session_ticket->data,
-                        ticklen);
+                            s->tlsext_session_ticket->data, ticklen);
                         s->session->tlsext_ticklen = ticklen;
                 } else
                         ticklen = 0;
@@ -1029,7 +1028,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                                                         *al = TLS1_AD_UNRECOGNIZED_NAME;
                                                         return 0;
                                                 }
-                                                if ((s->session->tlsext_hostname = malloc(len + 1)) == NULL) {
+                                                if ((s->session->tlsext_hostname =
+                                                    malloc(len + 1)) == NULL) {
                                                         *al = TLS1_AD_INTERNAL_ERROR;
                                                         return 0;
                                                 }
@@ -1101,7 +1101,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                                         s->session->tlsext_ecpointformatlist = NULL;
                                 }
                                 s->session->tlsext_ecpointformatlist_length = 0;
-                                if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+                                if ((s->session->tlsext_ecpointformatlist =
+                                    malloc(ecpointformatlist_length)) == NULL) {
                                         *al = TLS1_AD_INTERNAL_ERROR;
                                         return 0;
                                 }
@@ -1132,7 +1133,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
                                         return 0;
                                 }
                                 s->session->tlsext_ellipticcurvelist_length = 0;
-                                if ((s->session->tlsext_ellipticcurvelist = malloc(ellipticcurvelist_length)) == NULL) {
+                                if ((s->session->tlsext_ellipticcurvelist =
+                                    malloc(ellipticcurvelist_length)) == NULL) {
                                         *al = TLS1_AD_INTERNAL_ERROR;
                                         return 0;
                                 }
@@ -1423,7 +1425,8 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n,
                         s->session->tlsext_ecpointformatlist_length = 0;
                         if (s->session->tlsext_ecpointformatlist != NULL)
                                 free(s->session->tlsext_ecpointformatlist);
-                        if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+                        if ((s->session->tlsext_ecpointformatlist =
+                            malloc(ecpointformatlist_length)) == NULL) {
                                 *al = TLS1_AD_INTERNAL_ERROR;
                                 return 0;
                         }