From: deraadt <deraadt@openbsd.org>
Date: Mon, 21 Apr 2014 16:34:43 +0000 (+0000)
Subject: more malloc/realloc/calloc cleanups; ok beck kettenis
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=7c5c1828b5ea9a4d3c2f261136ee2d59ee5e9cfe;p=openbsd

more malloc/realloc/calloc cleanups; ok beck kettenis
---

diff --git a/lib/libssl/bio_ssl.c b/lib/libssl/bio_ssl.c
index e88137aeca6..4c5c5ac3de9 100644
--- a/lib/libssl/bio_ssl.c
+++ b/lib/libssl/bio_ssl.c
@@ -105,12 +105,11 @@ ssl_new(BIO *bi)
 {
 	BIO_SSL *bs;
 
-	bs = (BIO_SSL *)malloc(sizeof(BIO_SSL));
+	bs = calloc(1, sizeof(BIO_SSL));
 	if (bs == NULL) {
 		BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
 		return (0);
 	}
-	memset(bs, 0, sizeof(BIO_SSL));
 	bi->init = 0;
 	bi->ptr = (char *)bs;
 	bi->flags = 0;
diff --git a/lib/libssl/d1_both.c b/lib/libssl/d1_both.c
index 2f7dc283a03..ae7e7b457b1 100644
--- a/lib/libssl/d1_both.c
+++ b/lib/libssl/d1_both.c
@@ -179,12 +179,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 	unsigned char *buf = NULL;
 	unsigned char *bitmask = NULL;
 
-	frag = (hm_fragment *)malloc(sizeof(hm_fragment));
+	frag = malloc(sizeof(hm_fragment));
 	if (frag == NULL)
 		return NULL;
 
 	if (frag_len) {
-		buf = (unsigned char *)malloc(frag_len);
+		buf = malloc(frag_len);
 		if (buf == NULL) {
 			free(frag);
 			return NULL;
@@ -196,7 +196,7 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 
 	/* Initialize reassembly bitmask if necessary */
 	if (reassembly) {
-		bitmask = (unsigned char *)malloc(RSMBLY_BITMASK_SIZE(frag_len));
+		bitmask = malloc(RSMBLY_BITMASK_SIZE(frag_len));
 		if (bitmask == NULL) {
 			if (buf != NULL)
 				free(buf);
diff --git a/lib/libssl/d1_clnt.c b/lib/libssl/d1_clnt.c
index 6bceeea55b1..cf9bc2d33ed 100644
--- a/lib/libssl/d1_clnt.c
+++ b/lib/libssl/d1_clnt.c
@@ -1308,9 +1308,7 @@ dtls1_send_client_key_exchange(SSL *s)
 				        POINT_CONVERSION_UNCOMPRESSED,
 				        NULL, 0, NULL);
 
-				encodedPoint = (unsigned char *)
-				    malloc(encoded_pt_len *
-				        sizeof(unsigned char));
+				encodedPoint = malloc(encoded_pt_len);
 
 				bn_ctx = BN_CTX_new();
 				if ((encodedPoint == NULL) ||
diff --git a/lib/libssl/d1_srvr.c b/lib/libssl/d1_srvr.c
index fc475485baa..8fa75819bb1 100644
--- a/lib/libssl/d1_srvr.c
+++ b/lib/libssl/d1_srvr.c
@@ -1182,8 +1182,7 @@ dtls1_send_server_key_exchange(SSL *s)
 			POINT_CONVERSION_UNCOMPRESSED,
 			NULL, 0, NULL);
 
-			encodedPoint = (unsigned char *)
-			malloc(encodedlen*sizeof(unsigned char));
+			encodedPoint = malloc(encodedlen);
 
 			bn_ctx = BN_CTX_new();
 			if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/lib/libssl/s3_clnt.c b/lib/libssl/s3_clnt.c
index 10546ee8481..ac1812d857b 100644
--- a/lib/libssl/s3_clnt.c
+++ b/lib/libssl/s3_clnt.c
@@ -2390,9 +2390,7 @@ ssl3_send_client_key_exchange(SSL *s)
 				       POINT_CONVERSION_UNCOMPRESSED,
 				       NULL, 0, NULL);
 
-				encodedPoint =
-				    (unsigned char *)malloc(
-				        encoded_pt_len * sizeof(unsigned char));
+				encodedPoint = malloc(encoded_pt_len);
 
 				bn_ctx = BN_CTX_new();
 				if ((encodedPoint == NULL) ||
diff --git a/lib/libssl/s3_lib.c b/lib/libssl/s3_lib.c
index 95e5c903ec8..c79464da55a 100644
--- a/lib/libssl/s3_lib.c
+++ b/lib/libssl/s3_lib.c
@@ -2777,9 +2777,8 @@ ssl3_new(SSL *s)
 {
 	SSL3_STATE *s3;
 
-	if ((s3 = malloc(sizeof *s3)) == NULL)
+	if ((s3 = calloc(1, sizeof *s3)) == NULL)
 		goto err;
-	memset(s3, 0, sizeof *s3);
 	memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num));
 	memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num));
 
diff --git a/lib/libssl/s3_srvr.c b/lib/libssl/s3_srvr.c
index 8416eb7042c..ea3137c0743 100644
--- a/lib/libssl/s3_srvr.c
+++ b/lib/libssl/s3_srvr.c
@@ -1736,8 +1736,7 @@ ssl3_send_server_key_exchange(SSL *s)
 			    POINT_CONVERSION_UNCOMPRESSED,
 			    NULL, 0, NULL);
 
-			encodedPoint = (unsigned char *)
-			malloc(encodedlen*sizeof(unsigned char));
+			encodedPoint = malloc(encodedlen);
 
 			bn_ctx = BN_CTX_new();
 			if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/lib/libssl/src/ssl/bio_ssl.c b/lib/libssl/src/ssl/bio_ssl.c
index e88137aeca6..4c5c5ac3de9 100644
--- a/lib/libssl/src/ssl/bio_ssl.c
+++ b/lib/libssl/src/ssl/bio_ssl.c
@@ -105,12 +105,11 @@ ssl_new(BIO *bi)
 {
 	BIO_SSL *bs;
 
-	bs = (BIO_SSL *)malloc(sizeof(BIO_SSL));
+	bs = calloc(1, sizeof(BIO_SSL));
 	if (bs == NULL) {
 		BIOerr(BIO_F_SSL_NEW, ERR_R_MALLOC_FAILURE);
 		return (0);
 	}
-	memset(bs, 0, sizeof(BIO_SSL));
 	bi->init = 0;
 	bi->ptr = (char *)bs;
 	bi->flags = 0;
diff --git a/lib/libssl/src/ssl/d1_both.c b/lib/libssl/src/ssl/d1_both.c
index 2f7dc283a03..ae7e7b457b1 100644
--- a/lib/libssl/src/ssl/d1_both.c
+++ b/lib/libssl/src/ssl/d1_both.c
@@ -179,12 +179,12 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 	unsigned char *buf = NULL;
 	unsigned char *bitmask = NULL;
 
-	frag = (hm_fragment *)malloc(sizeof(hm_fragment));
+	frag = malloc(sizeof(hm_fragment));
 	if (frag == NULL)
 		return NULL;
 
 	if (frag_len) {
-		buf = (unsigned char *)malloc(frag_len);
+		buf = malloc(frag_len);
 		if (buf == NULL) {
 			free(frag);
 			return NULL;
@@ -196,7 +196,7 @@ dtls1_hm_fragment_new(unsigned long frag_len, int reassembly)
 
 	/* Initialize reassembly bitmask if necessary */
 	if (reassembly) {
-		bitmask = (unsigned char *)malloc(RSMBLY_BITMASK_SIZE(frag_len));
+		bitmask = malloc(RSMBLY_BITMASK_SIZE(frag_len));
 		if (bitmask == NULL) {
 			if (buf != NULL)
 				free(buf);
diff --git a/lib/libssl/src/ssl/d1_clnt.c b/lib/libssl/src/ssl/d1_clnt.c
index 6bceeea55b1..cf9bc2d33ed 100644
--- a/lib/libssl/src/ssl/d1_clnt.c
+++ b/lib/libssl/src/ssl/d1_clnt.c
@@ -1308,9 +1308,7 @@ dtls1_send_client_key_exchange(SSL *s)
 				        POINT_CONVERSION_UNCOMPRESSED,
 				        NULL, 0, NULL);
 
-				encodedPoint = (unsigned char *)
-				    malloc(encoded_pt_len *
-				        sizeof(unsigned char));
+				encodedPoint = malloc(encoded_pt_len);
 
 				bn_ctx = BN_CTX_new();
 				if ((encodedPoint == NULL) ||
diff --git a/lib/libssl/src/ssl/d1_srvr.c b/lib/libssl/src/ssl/d1_srvr.c
index fc475485baa..8fa75819bb1 100644
--- a/lib/libssl/src/ssl/d1_srvr.c
+++ b/lib/libssl/src/ssl/d1_srvr.c
@@ -1182,8 +1182,7 @@ dtls1_send_server_key_exchange(SSL *s)
 			POINT_CONVERSION_UNCOMPRESSED,
 			NULL, 0, NULL);
 
-			encodedPoint = (unsigned char *)
-			malloc(encodedlen*sizeof(unsigned char));
+			encodedPoint = malloc(encodedlen);
 
 			bn_ctx = BN_CTX_new();
 			if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/lib/libssl/src/ssl/s3_clnt.c b/lib/libssl/src/ssl/s3_clnt.c
index 10546ee8481..ac1812d857b 100644
--- a/lib/libssl/src/ssl/s3_clnt.c
+++ b/lib/libssl/src/ssl/s3_clnt.c
@@ -2390,9 +2390,7 @@ ssl3_send_client_key_exchange(SSL *s)
 				       POINT_CONVERSION_UNCOMPRESSED,
 				       NULL, 0, NULL);
 
-				encodedPoint =
-				    (unsigned char *)malloc(
-				        encoded_pt_len * sizeof(unsigned char));
+				encodedPoint = malloc(encoded_pt_len);
 
 				bn_ctx = BN_CTX_new();
 				if ((encodedPoint == NULL) ||
diff --git a/lib/libssl/src/ssl/s3_enc.c b/lib/libssl/src/ssl/s3_enc.c
index 2b02c5ba06b..5a45cec1c11 100644
--- a/lib/libssl/src/ssl/s3_enc.c
+++ b/lib/libssl/src/ssl/s3_enc.c
@@ -245,9 +245,10 @@ ssl3_change_cipher_state(SSL *s, int which)
 			reuse_dd = 1;
 		else if ((s->enc_read_ctx = malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
 			goto err;
-		else
+		else {
 			/* make sure it's intialized in case we exit later with an error */
-		EVP_CIPHER_CTX_init(s->enc_read_ctx);
+			EVP_CIPHER_CTX_init(s->enc_read_ctx);
+		}
 		dd = s->enc_read_ctx;
 
 		ssl_replace_hash(&s->read_hash, m);
@@ -264,8 +265,7 @@ ssl3_change_cipher_state(SSL *s, int which)
 				goto err2;
 			}
 			if (s->s3->rrec.comp == NULL)
-				s->s3->rrec.comp = (unsigned char *)
-			malloc(SSL3_RT_MAX_PLAIN_LENGTH);
+				s->s3->rrec.comp = malloc(SSL3_RT_MAX_PLAIN_LENGTH);
 			if (s->s3->rrec.comp == NULL)
 				goto err;
 		}
@@ -277,9 +277,10 @@ ssl3_change_cipher_state(SSL *s, int which)
 			reuse_dd = 1;
 		else if ((s->enc_write_ctx = malloc(sizeof(EVP_CIPHER_CTX))) == NULL)
 			goto err;
-		else
+		else {
 			/* make sure it's intialized in case we exit later with an error */
-		EVP_CIPHER_CTX_init(s->enc_write_ctx);
+			EVP_CIPHER_CTX_init(s->enc_write_ctx);
+		}
 		dd = s->enc_write_ctx;
 		ssl_replace_hash(&s->write_hash, m);
 #ifndef OPENSSL_NO_COMP
@@ -577,8 +578,7 @@ ssl3_digest_cached_records(SSL *s)
 
 	/* Allocate handshake_dgst array */
 	ssl3_free_digest_list(s);
-	s->s3->handshake_dgst = malloc(SSL_MAX_DIGEST * sizeof(EVP_MD_CTX *));
-	memset(s->s3->handshake_dgst, 0, SSL_MAX_DIGEST *sizeof(EVP_MD_CTX *));
+	s->s3->handshake_dgst = calloc(SSL_MAX_DIGEST, sizeof(EVP_MD_CTX *));
 	hdatalen = BIO_get_mem_data(s->s3->handshake_buffer, &hdata);
 	if (hdatalen <= 0) {
 		SSLerr(SSL_F_SSL3_DIGEST_CACHED_RECORDS, SSL_R_BAD_HANDSHAKE_LENGTH);
diff --git a/lib/libssl/src/ssl/s3_lib.c b/lib/libssl/src/ssl/s3_lib.c
index 95e5c903ec8..c79464da55a 100644
--- a/lib/libssl/src/ssl/s3_lib.c
+++ b/lib/libssl/src/ssl/s3_lib.c
@@ -2777,9 +2777,8 @@ ssl3_new(SSL *s)
 {
 	SSL3_STATE *s3;
 
-	if ((s3 = malloc(sizeof *s3)) == NULL)
+	if ((s3 = calloc(1, sizeof *s3)) == NULL)
 		goto err;
-	memset(s3, 0, sizeof *s3);
 	memset(s3->rrec.seq_num, 0, sizeof(s3->rrec.seq_num));
 	memset(s3->wrec.seq_num, 0, sizeof(s3->wrec.seq_num));
 
diff --git a/lib/libssl/src/ssl/s3_srvr.c b/lib/libssl/src/ssl/s3_srvr.c
index 8416eb7042c..ea3137c0743 100644
--- a/lib/libssl/src/ssl/s3_srvr.c
+++ b/lib/libssl/src/ssl/s3_srvr.c
@@ -1736,8 +1736,7 @@ ssl3_send_server_key_exchange(SSL *s)
 			    POINT_CONVERSION_UNCOMPRESSED,
 			    NULL, 0, NULL);
 
-			encodedPoint = (unsigned char *)
-			malloc(encodedlen*sizeof(unsigned char));
+			encodedPoint = malloc(encodedlen);
 
 			bn_ctx = BN_CTX_new();
 			if ((encodedPoint == NULL) || (bn_ctx == NULL)) {
diff --git a/lib/libssl/src/ssl/ssl_cert.c b/lib/libssl/src/ssl/ssl_cert.c
index 389d47408c2..b493585c58e 100644
--- a/lib/libssl/src/ssl/ssl_cert.c
+++ b/lib/libssl/src/ssl/ssl_cert.c
@@ -176,13 +176,11 @@ ssl_cert_new(void)
 {
 	CERT *ret;
 
-	ret = (CERT *)malloc(sizeof(CERT));
+	ret = calloc(1, sizeof(CERT));
 	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
 		return (NULL);
 	}
-	memset(ret, 0, sizeof(CERT));
-
 	ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
 	ret->references = 1;
 	ssl_cert_set_default_md(ret);
@@ -195,14 +193,12 @@ ssl_cert_dup(CERT *cert)
 	CERT *ret;
 	int i;
 
-	ret = (CERT *)malloc(sizeof(CERT));
+	ret = calloc(1, sizeof(CERT));
 	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
 		return (NULL);
 	}
 
-	memset(ret, 0, sizeof(CERT));
-
 	ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];
 	/* or ret->key = ret->pkeys + (cert->key - cert->pkeys),
 	 * if you find that more readable */
@@ -403,13 +399,11 @@ ssl_sess_cert_new(void)
 {
 	SESS_CERT *ret;
 
-	ret = malloc(sizeof *ret);
+	ret = calloc(1, sizeof *ret);
 	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
 		return NULL;
 	}
-
-	memset(ret, 0 , sizeof *ret);
 	ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
 	ret->references = 1;
 
diff --git a/lib/libssl/src/ssl/ssl_ciph.c b/lib/libssl/src/ssl/ssl_ciph.c
index 87b3f7a3ccd..41632720be3 100644
--- a/lib/libssl/src/ssl/ssl_ciph.c
+++ b/lib/libssl/src/ssl/ssl_ciph.c
@@ -456,7 +456,7 @@ load_builtin_compressions(void)
 			MemCheck_off();
 			ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
 			if (ssl_comp_methods != NULL) {
-				comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+				comp = malloc(sizeof(SSL_COMP));
 				if (comp != NULL) {
 					comp->method = COMP_zlib();
 					if (comp->method &&
@@ -1759,7 +1759,7 @@ SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
 	}
 
 	MemCheck_off();
-	comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+	comp = malloc(sizeof(SSL_COMP));
 	comp->id = id;
 	comp->method = cm;
 	load_builtin_compressions();
diff --git a/lib/libssl/src/ssl/ssl_lib.c b/lib/libssl/src/ssl/ssl_lib.c
index 21d6835b98e..cde564cade1 100644
--- a/lib/libssl/src/ssl/ssl_lib.c
+++ b/lib/libssl/src/ssl/ssl_lib.c
@@ -270,10 +270,9 @@ SSL_new(SSL_CTX *ctx)
 		return (NULL);
 	}
 
-	s = (SSL *)malloc(sizeof(SSL));
+	s = calloc(1, sizeof(SSL));
 	if (s == NULL)
 		goto err;
-	memset(s, 0, sizeof(SSL));
 
 #ifndef	OPENSSL_NO_KRB5
 	s->kssl_ctx = kssl_ctx_new();
@@ -1685,12 +1684,10 @@ SSL_CTX_new(const SSL_METHOD *meth)
 		SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
 		goto err;
 	}
-	ret = (SSL_CTX *)malloc(sizeof(SSL_CTX));
+	ret = calloc(1, sizeof(SSL_CTX));
 	if (ret == NULL)
 		goto err;
 
-	memset(ret, 0, sizeof(SSL_CTX));
-
 	ret->method = meth;
 
 	ret->cert_store = NULL;
diff --git a/lib/libssl/src/ssl/ssl_sess.c b/lib/libssl/src/ssl/ssl_sess.c
index c032154d48f..cc8e66b49d2 100644
--- a/lib/libssl/src/ssl/ssl_sess.c
+++ b/lib/libssl/src/ssl/ssl_sess.c
@@ -195,12 +195,11 @@ SSL_SESSION_new(void)
 {
 	SSL_SESSION *ss;
 
-	ss = (SSL_SESSION *)malloc(sizeof(SSL_SESSION));
+	ss = calloc(1, sizeof(SSL_SESSION));
 	if (ss == NULL) {
 		SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
 		return (0);
 	}
-	memset(ss, 0, sizeof(SSL_SESSION));
 
 	ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
 	ss->references = 1;
@@ -758,7 +757,7 @@ SSL_set_session(SSL *s, SSL_SESSION *session)
 #ifndef OPENSSL_NO_KRB5
 		if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
 			session->krb5_client_princ_len > 0) {
-			s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
+			s->kssl_ctx->client_princ = malloc(session->krb5_client_princ_len + 1);
 			memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
 			session->krb5_client_princ_len);
 			s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
diff --git a/lib/libssl/src/ssl/t1_enc.c b/lib/libssl/src/ssl/t1_enc.c
index 3f5df9ad7a6..ac503f53eeb 100644
--- a/lib/libssl/src/ssl/t1_enc.c
+++ b/lib/libssl/src/ssl/t1_enc.c
@@ -593,7 +593,7 @@ tls1_setup_key_block(SSL *s)
 
 	ssl3_cleanup_key_block(s);
 
-	if ((p1 = (unsigned char *)malloc(num)) == NULL) {
+	if ((p1 = malloc(num)) == NULL) {
 		SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
@@ -601,7 +601,7 @@ tls1_setup_key_block(SSL *s)
 	s->s3->tmp.key_block_length = num;
 	s->s3->tmp.key_block = p1;
 
-	if ((p2 = (unsigned char *)malloc(num)) == NULL) {
+	if ((p2 = malloc(num)) == NULL) {
 		SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
diff --git a/lib/libssl/src/ssl/t1_lib.c b/lib/libssl/src/ssl/t1_lib.c
index 85d0fa49705..01ecf9479d0 100644
--- a/lib/libssl/src/ssl/t1_lib.c
+++ b/lib/libssl/src/ssl/t1_lib.c
@@ -506,8 +506,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 			if (!s->session->tlsext_tick)
 				return NULL;
 			memcpy(s->session->tlsext_tick,
-			s->tlsext_session_ticket->data,
-			ticklen);
+			    s->tlsext_session_ticket->data, ticklen);
 			s->session->tlsext_ticklen = ticklen;
 		} else
 			ticklen = 0;
@@ -1029,7 +1028,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 							*al = TLS1_AD_UNRECOGNIZED_NAME;
 							return 0;
 						}
-						if ((s->session->tlsext_hostname = malloc(len + 1)) == NULL) {
+						if ((s->session->tlsext_hostname =
+						    malloc(len + 1)) == NULL) {
 							*al = TLS1_AD_INTERNAL_ERROR;
 							return 0;
 						}
@@ -1101,7 +1101,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 					s->session->tlsext_ecpointformatlist = NULL;
 				}
 				s->session->tlsext_ecpointformatlist_length = 0;
-				if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+				if ((s->session->tlsext_ecpointformatlist =
+				    malloc(ecpointformatlist_length)) == NULL) {
 					*al = TLS1_AD_INTERNAL_ERROR;
 					return 0;
 				}
@@ -1132,7 +1133,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 					return 0;
 				}
 				s->session->tlsext_ellipticcurvelist_length = 0;
-				if ((s->session->tlsext_ellipticcurvelist = malloc(ellipticcurvelist_length)) == NULL) {
+				if ((s->session->tlsext_ellipticcurvelist =
+				    malloc(ellipticcurvelist_length)) == NULL) {
 					*al = TLS1_AD_INTERNAL_ERROR;
 					return 0;
 				}
@@ -1423,7 +1425,8 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n,
 			s->session->tlsext_ecpointformatlist_length = 0;
 			if (s->session->tlsext_ecpointformatlist != NULL)
 				free(s->session->tlsext_ecpointformatlist);
-			if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+			if ((s->session->tlsext_ecpointformatlist =
+			    malloc(ecpointformatlist_length)) == NULL) {
 				*al = TLS1_AD_INTERNAL_ERROR;
 				return 0;
 			}
diff --git a/lib/libssl/ssl_cert.c b/lib/libssl/ssl_cert.c
index 389d47408c2..b493585c58e 100644
--- a/lib/libssl/ssl_cert.c
+++ b/lib/libssl/ssl_cert.c
@@ -176,13 +176,11 @@ ssl_cert_new(void)
 {
 	CERT *ret;
 
-	ret = (CERT *)malloc(sizeof(CERT));
+	ret = calloc(1, sizeof(CERT));
 	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_CERT_NEW, ERR_R_MALLOC_FAILURE);
 		return (NULL);
 	}
-	memset(ret, 0, sizeof(CERT));
-
 	ret->key = &(ret->pkeys[SSL_PKEY_RSA_ENC]);
 	ret->references = 1;
 	ssl_cert_set_default_md(ret);
@@ -195,14 +193,12 @@ ssl_cert_dup(CERT *cert)
 	CERT *ret;
 	int i;
 
-	ret = (CERT *)malloc(sizeof(CERT));
+	ret = calloc(1, sizeof(CERT));
 	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_CERT_DUP, ERR_R_MALLOC_FAILURE);
 		return (NULL);
 	}
 
-	memset(ret, 0, sizeof(CERT));
-
 	ret->key = &ret->pkeys[cert->key - &cert->pkeys[0]];
 	/* or ret->key = ret->pkeys + (cert->key - cert->pkeys),
 	 * if you find that more readable */
@@ -403,13 +399,11 @@ ssl_sess_cert_new(void)
 {
 	SESS_CERT *ret;
 
-	ret = malloc(sizeof *ret);
+	ret = calloc(1, sizeof *ret);
 	if (ret == NULL) {
 		SSLerr(SSL_F_SSL_SESS_CERT_NEW, ERR_R_MALLOC_FAILURE);
 		return NULL;
 	}
-
-	memset(ret, 0 , sizeof *ret);
 	ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
 	ret->references = 1;
 
diff --git a/lib/libssl/ssl_ciph.c b/lib/libssl/ssl_ciph.c
index 87b3f7a3ccd..41632720be3 100644
--- a/lib/libssl/ssl_ciph.c
+++ b/lib/libssl/ssl_ciph.c
@@ -456,7 +456,7 @@ load_builtin_compressions(void)
 			MemCheck_off();
 			ssl_comp_methods = sk_SSL_COMP_new(sk_comp_cmp);
 			if (ssl_comp_methods != NULL) {
-				comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+				comp = malloc(sizeof(SSL_COMP));
 				if (comp != NULL) {
 					comp->method = COMP_zlib();
 					if (comp->method &&
@@ -1759,7 +1759,7 @@ SSL_COMP_add_compression_method(int id, COMP_METHOD *cm)
 	}
 
 	MemCheck_off();
-	comp = (SSL_COMP *)malloc(sizeof(SSL_COMP));
+	comp = malloc(sizeof(SSL_COMP));
 	comp->id = id;
 	comp->method = cm;
 	load_builtin_compressions();
diff --git a/lib/libssl/ssl_lib.c b/lib/libssl/ssl_lib.c
index 21d6835b98e..cde564cade1 100644
--- a/lib/libssl/ssl_lib.c
+++ b/lib/libssl/ssl_lib.c
@@ -270,10 +270,9 @@ SSL_new(SSL_CTX *ctx)
 		return (NULL);
 	}
 
-	s = (SSL *)malloc(sizeof(SSL));
+	s = calloc(1, sizeof(SSL));
 	if (s == NULL)
 		goto err;
-	memset(s, 0, sizeof(SSL));
 
 #ifndef	OPENSSL_NO_KRB5
 	s->kssl_ctx = kssl_ctx_new();
@@ -1685,12 +1684,10 @@ SSL_CTX_new(const SSL_METHOD *meth)
 		SSLerr(SSL_F_SSL_CTX_NEW, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS);
 		goto err;
 	}
-	ret = (SSL_CTX *)malloc(sizeof(SSL_CTX));
+	ret = calloc(1, sizeof(SSL_CTX));
 	if (ret == NULL)
 		goto err;
 
-	memset(ret, 0, sizeof(SSL_CTX));
-
 	ret->method = meth;
 
 	ret->cert_store = NULL;
diff --git a/lib/libssl/ssl_sess.c b/lib/libssl/ssl_sess.c
index c032154d48f..cc8e66b49d2 100644
--- a/lib/libssl/ssl_sess.c
+++ b/lib/libssl/ssl_sess.c
@@ -195,12 +195,11 @@ SSL_SESSION_new(void)
 {
 	SSL_SESSION *ss;
 
-	ss = (SSL_SESSION *)malloc(sizeof(SSL_SESSION));
+	ss = calloc(1, sizeof(SSL_SESSION));
 	if (ss == NULL) {
 		SSLerr(SSL_F_SSL_SESSION_NEW, ERR_R_MALLOC_FAILURE);
 		return (0);
 	}
-	memset(ss, 0, sizeof(SSL_SESSION));
 
 	ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
 	ss->references = 1;
@@ -758,7 +757,7 @@ SSL_set_session(SSL *s, SSL_SESSION *session)
 #ifndef OPENSSL_NO_KRB5
 		if (s->kssl_ctx && !s->kssl_ctx->client_princ &&
 			session->krb5_client_princ_len > 0) {
-			s->kssl_ctx->client_princ = (char *)malloc(session->krb5_client_princ_len + 1);
+			s->kssl_ctx->client_princ = malloc(session->krb5_client_princ_len + 1);
 			memcpy(s->kssl_ctx->client_princ, session->krb5_client_princ,
 			session->krb5_client_princ_len);
 			s->kssl_ctx->client_princ[session->krb5_client_princ_len] = '\0';
diff --git a/lib/libssl/t1_enc.c b/lib/libssl/t1_enc.c
index 3f5df9ad7a6..ac503f53eeb 100644
--- a/lib/libssl/t1_enc.c
+++ b/lib/libssl/t1_enc.c
@@ -593,7 +593,7 @@ tls1_setup_key_block(SSL *s)
 
 	ssl3_cleanup_key_block(s);
 
-	if ((p1 = (unsigned char *)malloc(num)) == NULL) {
+	if ((p1 = malloc(num)) == NULL) {
 		SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
@@ -601,7 +601,7 @@ tls1_setup_key_block(SSL *s)
 	s->s3->tmp.key_block_length = num;
 	s->s3->tmp.key_block = p1;
 
-	if ((p2 = (unsigned char *)malloc(num)) == NULL) {
+	if ((p2 = malloc(num)) == NULL) {
 		SSLerr(SSL_F_TLS1_SETUP_KEY_BLOCK, ERR_R_MALLOC_FAILURE);
 		goto err;
 	}
diff --git a/lib/libssl/t1_lib.c b/lib/libssl/t1_lib.c
index 85d0fa49705..01ecf9479d0 100644
--- a/lib/libssl/t1_lib.c
+++ b/lib/libssl/t1_lib.c
@@ -506,8 +506,7 @@ ssl_add_clienthello_tlsext(SSL *s, unsigned char *p, unsigned char *limit)
 			if (!s->session->tlsext_tick)
 				return NULL;
 			memcpy(s->session->tlsext_tick,
-			s->tlsext_session_ticket->data,
-			ticklen);
+			    s->tlsext_session_ticket->data, ticklen);
 			s->session->tlsext_ticklen = ticklen;
 		} else
 			ticklen = 0;
@@ -1029,7 +1028,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 							*al = TLS1_AD_UNRECOGNIZED_NAME;
 							return 0;
 						}
-						if ((s->session->tlsext_hostname = malloc(len + 1)) == NULL) {
+						if ((s->session->tlsext_hostname =
+						    malloc(len + 1)) == NULL) {
 							*al = TLS1_AD_INTERNAL_ERROR;
 							return 0;
 						}
@@ -1101,7 +1101,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 					s->session->tlsext_ecpointformatlist = NULL;
 				}
 				s->session->tlsext_ecpointformatlist_length = 0;
-				if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+				if ((s->session->tlsext_ecpointformatlist =
+				    malloc(ecpointformatlist_length)) == NULL) {
 					*al = TLS1_AD_INTERNAL_ERROR;
 					return 0;
 				}
@@ -1132,7 +1133,8 @@ ssl_parse_clienthello_tlsext(SSL *s, unsigned char **p, unsigned char *d,
 					return 0;
 				}
 				s->session->tlsext_ellipticcurvelist_length = 0;
-				if ((s->session->tlsext_ellipticcurvelist = malloc(ellipticcurvelist_length)) == NULL) {
+				if ((s->session->tlsext_ellipticcurvelist =
+				    malloc(ellipticcurvelist_length)) == NULL) {
 					*al = TLS1_AD_INTERNAL_ERROR;
 					return 0;
 				}
@@ -1423,7 +1425,8 @@ ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, int n,
 			s->session->tlsext_ecpointformatlist_length = 0;
 			if (s->session->tlsext_ecpointformatlist != NULL)
 				free(s->session->tlsext_ecpointformatlist);
-			if ((s->session->tlsext_ecpointformatlist = malloc(ecpointformatlist_length)) == NULL) {
+			if ((s->session->tlsext_ecpointformatlist =
+			    malloc(ecpointformatlist_length)) == NULL) {
 				*al = TLS1_AD_INTERNAL_ERROR;
 				return 0;
 			}