diff --git a/lib/client-handshake.c b/lib/client-handshake.c
index 17d77a5d..ca550bfc 100644
--- a/lib/client-handshake.c
+++ b/lib/client-handshake.c
@@ -262,8 +262,8 @@ struct libwebsocket *libwebsocket_client_connect_2(
 	return wsi;
 
 oom4:
-	free(wsi->u.hdr.ah);
-	free(wsi);
+	lws_free(wsi->u.hdr.ah);
+	lws_free(wsi);
 	return NULL;
 
 failed:
@@ -305,11 +305,10 @@ libwebsocket_client_connect(struct libwebsocket_context *context,
 {
 	struct libwebsocket *wsi;
 
-	wsi = (struct libwebsocket *) malloc(sizeof(struct libwebsocket));
+	wsi = lws_zalloc(sizeof(struct libwebsocket));
 	if (wsi == NULL)
 		goto bail;
 
-	memset(wsi, 0, sizeof(*wsi));
 	wsi->sock = -1;
 
 	/* -1 means just use latest supported */
@@ -390,9 +389,9 @@ libwebsocket_client_connect(struct libwebsocket_context *context,
        return libwebsocket_client_connect_2(context, wsi);
 
 bail1:
-	free(wsi->u.hdr.ah);
+	lws_free(wsi->u.hdr.ah);
 bail:
-	free(wsi);
+	lws_free(wsi);
 
 	return NULL;
 }
diff --git a/lib/client.c b/lib/client.c
index 97d68fcc..4cf6a55d 100755
--- a/lib/client.c
+++ b/lib/client.c
@@ -656,15 +656,12 @@ check_extensions:
 
 			wsi->active_extensions_user[
 				wsi->count_active_extensions] =
-					 malloc(ext->per_session_data_size);
+					 lws_zalloc(ext->per_session_data_size);
 			if (wsi->active_extensions_user[
 				wsi->count_active_extensions] == NULL) {
 				lwsl_err("Out of mem\n");
 				goto bail2;
 			}
-			memset(wsi->active_extensions_user[
-				wsi->count_active_extensions], 0,
-						    ext->per_session_data_size);
 			wsi->active_extensions[
 				  wsi->count_active_extensions] = ext;
 
@@ -725,8 +722,7 @@ check_accept:
 
 	/* free up his parsing allocations */
 
-	if (wsi->u.hdr.ah)
-		free(wsi->u.hdr.ah);
+	lws_free(wsi->u.hdr.ah);
 
 	lws_union_transition(wsi, LWS_CONNMODE_WS_CLIENT);
 	wsi->state = WSI_STATE_ESTABLISHED;
@@ -743,7 +739,7 @@ check_accept:
 	if (!n)
 		n = LWS_MAX_SOCKET_IO_BUF;
 	n += LWS_SEND_BUFFER_PRE_PADDING + LWS_SEND_BUFFER_POST_PADDING;
-	wsi->u.ws.rx_user_buffer = malloc(n);
+	wsi->u.ws.rx_user_buffer = lws_malloc(n);
 	if (!wsi->u.ws.rx_user_buffer) {
 		lwsl_err("Out of Mem allocating rx buffer %d\n", n);
 		goto bail2;
@@ -785,7 +781,7 @@ check_accept:
 	return 0;
 
 bail3:
-	free(wsi->u.ws.rx_user_buffer);
+	lws_free(wsi->u.ws.rx_user_buffer);
 	wsi->u.ws.rx_user_buffer = NULL;
 	close_reason = LWS_CLOSE_STATUS_NOSTATUS;
 
@@ -799,8 +795,7 @@ bail2:
 
 	/* free up his parsing allocations */
 
-	if (wsi->u.hdr.ah)
-		free(wsi->u.hdr.ah);
+	lws_free(wsi->u.hdr.ah);
 
 	libwebsocket_close_and_free_session(context, wsi, close_reason);
 
diff --git a/lib/context.c b/lib/context.c
index 635bb137..2ea9c60d 100644
--- a/lib/context.c
+++ b/lib/context.c
@@ -101,13 +101,11 @@ libwebsocket_create_context(struct lws_context_creation_info *info)
 	if (lws_plat_context_early_init())
 		return NULL;
 
-	context = (struct libwebsocket_context *)
-				malloc(sizeof(struct libwebsocket_context));
+	context = lws_zalloc(sizeof(struct libwebsocket_context));
 	if (!context) {
 		lwsl_err("No memory for websocket context\n");
 		return NULL;
 	}
-	memset(context, 0, sizeof(*context));
 
 	if (pid_daemon) {
 		context->started_with_parent = pid_daemon;
@@ -138,33 +136,29 @@ libwebsocket_create_context(struct lws_context_creation_info *info)
 					sizeof(struct libwebsocket *)) *
 							     context->max_fds));
 
-	context->fds = (struct libwebsocket_pollfd *)
-				malloc(sizeof(struct libwebsocket_pollfd) *
-							      context->max_fds);
+	context->fds = lws_zalloc(sizeof(struct libwebsocket_pollfd) *
+				  context->max_fds);
 	if (context->fds == NULL) {
 		lwsl_err("Unable to allocate fds array for %d connections\n",
 							      context->max_fds);
-		free(context);
+		lws_free(context);
 		return NULL;
 	}
 
-	context->lws_lookup = (struct libwebsocket **)
-		      malloc(sizeof(struct libwebsocket *) * context->max_fds);
+	context->lws_lookup = lws_zalloc(sizeof(struct libwebsocket *) * context->max_fds);
 	if (context->lws_lookup == NULL) {
 		lwsl_err(
 		  "Unable to allocate lws_lookup array for %d connections\n",
 							      context->max_fds);
-		free(context->fds);
-		free(context);
+		lws_free(context->fds);
+		lws_free(context);
 		return NULL;
 	}
-	memset(context->lws_lookup, 0, sizeof(struct libwebsocket *) *
-							context->max_fds);
 
 	if (lws_plat_init_fd_tables(context)) {
-		free(context->lws_lookup);
-		free(context->fds);
-		free(context);
+		lws_free(context->lws_lookup);
+		lws_free(context->fds);
+		lws_free(context);
 		return NULL;
 	}
 
@@ -334,12 +328,10 @@ libwebsocket_context_destroy(struct libwebsocket_context *context)
 
 	lws_ssl_context_destroy(context);
 
-	if (context->fds)
-		free(context->fds);
-	if (context->lws_lookup)
-		free(context->lws_lookup);
+	lws_free(context->fds);
+	lws_free(context->lws_lookup);
 
 	lws_plat_context_late_destroy(context);
 
-	free(context);
+	lws_free(context);
 }
diff --git a/lib/daemonize.c b/lib/daemonize.c
index 9e613101..413d3fea 100644
--- a/lib/daemonize.c
+++ b/lib/daemonize.c
@@ -76,7 +76,7 @@ static void lws_daemon_closing(int sigact)
 	if (getpid() == pid_daemon)
 		if (lock_path) {
 			unlink(lock_path);
-			free(lock_path);
+			lws_free(lock_path);
 			lock_path = NULL;
 		}
 
@@ -124,7 +124,7 @@ lws_daemonize(const char *_lock_path)
 	}
 
 	n = strlen(_lock_path) + 1;
-	lock_path = malloc(n);
+	lock_path = lws_malloc(n);
 	if (!lock_path) {
 		fprintf(stderr, "Out of mem in lws_daemonize\n");
 		return 1;
diff --git a/lib/extension-deflate-frame.c b/lib/extension-deflate-frame.c
index 6cf6ac01..13b2b8de 100644
--- a/lib/extension-deflate-frame.c
+++ b/lib/extension-deflate-frame.c
@@ -54,16 +54,14 @@ int lws_extension_callback_deflate_frame(
 		conn->buf_out_length = sizeof(conn->buf_out);
 		conn->compressed_out = 0;
 		conn->buf_pre = NULL;
-		conn->buf_in = (unsigned char *)
-				malloc(LWS_SEND_BUFFER_PRE_PADDING +
-					       conn->buf_in_length +
-					       LWS_SEND_BUFFER_POST_PADDING);
+		conn->buf_in = lws_malloc(LWS_SEND_BUFFER_PRE_PADDING +
+					  conn->buf_in_length +
+					  LWS_SEND_BUFFER_POST_PADDING);
 		if (!conn->buf_in)
 			goto bail;
-		conn->buf_out = (unsigned char *)
-				malloc(LWS_SEND_BUFFER_PRE_PADDING +
-						conn->buf_out_length +
-						LWS_SEND_BUFFER_POST_PADDING);
+		conn->buf_out = lws_malloc(LWS_SEND_BUFFER_PRE_PADDING +
+					   conn->buf_out_length +
+					   LWS_SEND_BUFFER_POST_PADDING);
 		if (!conn->buf_out)
 			goto bail;
 		lwsl_ext("zlibs constructed\n");
@@ -75,10 +73,9 @@ bail:
 		return -1;
 
 	case LWS_EXT_CALLBACK_DESTROY:
-		if (conn->buf_pre)
-			free(conn->buf_pre);
-		free(conn->buf_in);
-		free(conn->buf_out);
+		lws_free(conn->buf_pre);
+		lws_free(conn->buf_in);
+		lws_free(conn->buf_out);
 		conn->buf_pre_used = 0;
 		conn->buf_pre_length = 0;
 		conn->buf_in_length = 0;
@@ -106,10 +103,8 @@ bail:
 
 			if (conn->buf_pre_length < total_payload) {
 				conn->buf_pre_length = total_payload;
-				if (conn->buf_pre)
-					free(conn->buf_pre);
-				conn->buf_pre =
-				    (unsigned char *)malloc(total_payload + 4);
+				lws_free(conn->buf_pre);
+				conn->buf_pre = lws_malloc(total_payload + 4);
 				if (!conn->buf_pre) {
 					lwsl_err("Out of memory\n");
 					return -1;
@@ -180,10 +175,10 @@ bail:
 						LWS_MAX_ZLIB_CONN_BUFFER);
 				return -1;
 			}
-			conn->buf_in = (unsigned char *)realloc(conn->buf_in,
-					LWS_SEND_BUFFER_PRE_PADDING +
-						conn->buf_in_length +
-						 LWS_SEND_BUFFER_POST_PADDING);
+			conn->buf_in = lws_realloc(conn->buf_in,
+						   LWS_SEND_BUFFER_PRE_PADDING +
+						   conn->buf_in_length +
+						   LWS_SEND_BUFFER_POST_PADDING);
 			if (!conn->buf_in) {
 				lwsl_err("Out of memory\n");
 				return -1;
@@ -243,11 +238,10 @@ bail:
 						LWS_MAX_ZLIB_CONN_BUFFER);
 				return -1;
 			}
-			conn->buf_out = (unsigned char *)realloc(
-					conn->buf_out,
-					LWS_SEND_BUFFER_PRE_PADDING +
-						  conn->buf_out_length +
-						  LWS_SEND_BUFFER_POST_PADDING);
+			conn->buf_out = lws_realloc(conn->buf_out,
+						    LWS_SEND_BUFFER_PRE_PADDING +
+						    conn->buf_out_length +
+						    LWS_SEND_BUFFER_POST_PADDING);
 			if (!conn->buf_out) {
 				lwsl_err("Out of memory\n");
 				return -1;
diff --git a/lib/getifaddrs.c b/lib/getifaddrs.c
index 1fa47cea..5823c06f 100644
--- a/lib/getifaddrs.c
+++ b/lib/getifaddrs.c
@@ -85,7 +85,7 @@ getifaddrs2(struct ifaddrs **ifap,
 
 	buf_size = 8192;
 	for (;;) {
-		buf = calloc(1, buf_size);
+		buf = lws_zalloc(buf_size);
 		if (buf == NULL) {
 			ret = ENOMEM;
 			goto error_out;
@@ -107,7 +107,7 @@ getifaddrs2(struct ifaddrs **ifap,
 
 		if (ifconf.ifc_len < (int)buf_size)
 			break;
-		free(buf);
+		lws_free(buf);
 		buf_size *= 2;
 	}
 
@@ -137,12 +137,12 @@ getifaddrs2(struct ifaddrs **ifap,
 			goto error_out;
 		}
 
-		*end = malloc(sizeof(**end));
+		*end = lws_malloc(sizeof(**end));
 
 		(*end)->ifa_next = NULL;
 		(*end)->ifa_name = strdup(ifr->ifr_name);
 		(*end)->ifa_flags = ifreq.ifr_flags;
-		(*end)->ifa_addr = malloc(salen);
+		(*end)->ifa_addr = lws_malloc(salen);
 		memcpy((*end)->ifa_addr, sa, salen);
 		(*end)->ifa_netmask = NULL;
 
@@ -150,11 +150,12 @@ getifaddrs2(struct ifaddrs **ifap,
 		/* fix these when we actually need them */
 		if (ifreq.ifr_flags & IFF_BROADCAST) {
 			(*end)->ifa_broadaddr =
-				malloc(sizeof(ifr->ifr_broadaddr));
+				lws_malloc(sizeof(ifr->ifr_broadaddr));
 			memcpy((*end)->ifa_broadaddr, &ifr->ifr_broadaddr,
 						    sizeof(ifr->ifr_broadaddr));
 		} else if (ifreq.ifr_flags & IFF_POINTOPOINT) {
-			(*end)->ifa_dstaddr = malloc(sizeof(ifr->ifr_dstaddr));
+			(*end)->ifa_dstaddr =
+				lws_malloc(sizeof(ifr->ifr_dstaddr));
 			memcpy((*end)->ifa_dstaddr, &ifr->ifr_dstaddr,
 						      sizeof(ifr->ifr_dstaddr));
 		} else
@@ -169,12 +170,12 @@ getifaddrs2(struct ifaddrs **ifap,
 	}
 	*ifap = start;
 	close(fd);
-	free(buf);
+	lws_free(buf);
 	return 0;
 
 error_out:
 	close(fd);
-	free(buf);
+	lws_free(buf);
 	errno = ret;
 
 	return -1;
@@ -209,18 +210,14 @@ freeifaddrs(struct ifaddrs *ifp)
 	struct ifaddrs *p, *q;
 
 	for (p = ifp; p; ) {
-		free(p->ifa_name);
-		if (p->ifa_addr)
-			free(p->ifa_addr);
-		if (p->ifa_dstaddr)
-			free(p->ifa_dstaddr);
-		if (p->ifa_netmask)
-			free(p->ifa_netmask);
-		if (p->ifa_data)
-			free(p->ifa_data);
+		lws_free(p->ifa_name);
+		lws_free(p->ifa_addr);
+		lws_free(p->ifa_dstaddr);
+		lws_free(p->ifa_netmask);
+		lws_free(p->ifa_data);
 		q = p;
 		p = p->ifa_next;
-		free(q);
+		lws_free(q);
 	}
 }
 
diff --git a/lib/hpack.c b/lib/hpack.c
index 58d84b70..3ac01b03 100644
--- a/lib/hpack.c
+++ b/lib/hpack.c
@@ -278,17 +278,16 @@ static int lws_hpack_add_dynamic_header(struct libwebsocket *wsi, int token, cha
 	dyn = wsi->u.http2.hpack_dyn_table;
 
 	if (!dyn) {
-		dyn = malloc(sizeof(*dyn));
+		dyn = lws_zalloc(sizeof(*dyn));
 		if (!dyn)
 			return 1;
-		memset(dyn, 0, sizeof(*dyn));
 		wsi->u.http2.hpack_dyn_table = dyn;
 		
-		dyn->args = malloc(1024);
+		dyn->args = lws_malloc(1024);
 		if (!dyn->args)
 			goto bail1;
 		dyn->args_length = 1024;
-		dyn->entries = malloc(sizeof(dyn->entries[0]) * 20);
+		dyn->entries = lws_malloc(sizeof(dyn->entries[0]) * 20);
 		if (!dyn->entries)
 			goto bail2;
 		dyn->num_entries = 20;
@@ -312,13 +311,13 @@ static int lws_hpack_add_dynamic_header(struct libwebsocket *wsi, int token, cha
 	dyn->next++;
 	
 	return 0;
-	
+
 bail2:
-	free(dyn->args);
+	lws_free(dyn->args);
 bail1:
-	free(dyn);
+	lws_free(dyn);
 	wsi->u.http2.hpack_dyn_table = NULL;
-		
+
 	return ret;
 }
 
@@ -681,4 +680,4 @@ int lws_add_http2_header_status(struct libwebsocket_context *context,
 		return 1;
 
 	return 0;
-}
\ No newline at end of file
+}
diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index 6a9f466b..63709c33 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -210,12 +210,12 @@ just_kill_connection:
 	wsi->state = WSI_STATE_DEAD_SOCKET;
 	
 	if (wsi->rxflow_buffer) {
-		free(wsi->rxflow_buffer);
+		lws_free(wsi->rxflow_buffer);
 		wsi->rxflow_buffer = NULL;
 	}
 
 	if (wsi->mode == LWS_CONNMODE_HTTP2_SERVING && wsi->u.hdr.ah) {
-		free(wsi->u.hdr.ah);
+		lws_free(wsi->u.hdr.ah);
 		wsi->u.hdr.ah = NULL;
 	}
 	
@@ -224,18 +224,18 @@ just_kill_connection:
 	     wsi->mode == LWS_CONNMODE_WS_CLIENT)) {
 
 		if (wsi->u.ws.rx_user_buffer) {
-			free(wsi->u.ws.rx_user_buffer);
+			lws_free(wsi->u.ws.rx_user_buffer);
 			wsi->u.ws.rx_user_buffer = NULL;
 		}
 
 		if (wsi->truncated_send_malloc) {
 			/* not going to be completed... nuke it */
-			free(wsi->truncated_send_malloc);
+			lws_free(wsi->truncated_send_malloc);
 			wsi->truncated_send_malloc = NULL;
 			wsi->truncated_send_len = 0;
 		}
 		if (wsi->u.ws.ping_payload_buf) {
-			free(wsi->u.ws.ping_payload_buf);
+			lws_free(wsi->u.ws.ping_payload_buf);
 			wsi->u.ws.ping_payload_buf = NULL;
 			wsi->u.ws.ping_payload_alloc = 0;
 			wsi->u.ws.ping_payload_len = 0;
@@ -265,7 +265,7 @@ just_kill_connection:
 		lwsl_warn("extension destruction failed\n");
 #ifndef LWS_NO_EXTENSIONS
 	for (n = 0; n < wsi->count_active_extensions; n++)
-		free(wsi->active_extensions_user[n]);
+		lws_free(wsi->active_extensions_user[n]);
 #endif
 	/*
 	 * inform all extensions in case they tracked this guy out of band
@@ -293,11 +293,11 @@ just_kill_connection:
 
 	if (wsi->protocol && wsi->protocol->per_session_data_size &&
 	    wsi->user_space && !wsi->user_space_externally_allocated)
-		free(wsi->user_space);
+		lws_free(wsi->user_space);
 
 	/* As a precaution, free the header table in case it lingered: */
 	lws_free_header_table(wsi);
-	free(wsi);
+	lws_free(wsi);
 }
 
 /**
@@ -710,14 +710,11 @@ libwebsocket_ensure_user_space(struct libwebsocket *wsi)
 	/* allocate the per-connection user memory (if any) */
 
 	if (wsi->protocol->per_session_data_size && !wsi->user_space) {
-		wsi->user_space = malloc(
-				  wsi->protocol->per_session_data_size);
+		wsi->user_space = lws_zalloc(wsi->protocol->per_session_data_size);
 		if (wsi->user_space  == NULL) {
 			lwsl_err("Out of memory for conn user space\n");
 			return 1;
 		}
-		memset(wsi->user_space, 0,
-					 wsi->protocol->per_session_data_size);
 	} else
 		lwsl_info("%s: %p protocol pss %u, user_space=%d\n", __func__, wsi, wsi->protocol->per_session_data_size, wsi->user_space);
 	return 0;
diff --git a/lib/lws-plat-win.c b/lib/lws-plat-win.c
index 2c9c97f4..2503fc00 100644
--- a/lib/lws-plat-win.c
+++ b/lib/lws-plat-win.c
@@ -193,17 +193,16 @@ lws_plat_drop_app_privileges(struct lws_context_creation_info *info)
 LWS_VISIBLE int
 lws_plat_init_fd_tables(struct libwebsocket_context *context)
 {
-	context->events = (WSAEVENT *)malloc(sizeof(WSAEVENT) *
-							(context->max_fds + 1));
+	context->events = lws_malloc(sizeof(WSAEVENT) * (context->max_fds + 1));
 	if (context->events == NULL) {
 		lwsl_err("Unable to allocate events array for %d connections\n",
 			context->max_fds);
 		return 1;
 	}
-	
+
 	context->fds_count = 0;
 	context->events[0] = WSACreateEvent();
-	
+
 	context->fd_random = 0;
 
 	return 0;
@@ -236,7 +235,7 @@ lws_plat_context_early_destroy(struct libwebsocket_context *context)
 {
 	if (context->events) {
 		WSACloseEvent(context->events[0]);
-		free(context->events);
+		lws_free(context->events);
 	}
 }
 
@@ -331,7 +330,7 @@ lws_plat_inet_ntop(int af, const void *src, char *dst, int cnt)
 	DWORD bufferlen = cnt;
 	BOOL ok = FALSE;
 
-	buffer = malloc(bufferlen);
+	buffer = lws_malloc(bufferlen);
 	if (!buffer) {
 		lwsl_err("Out of memory\n");
 		return NULL;
@@ -366,6 +365,6 @@ lws_plat_inet_ntop(int af, const void *src, char *dst, int cnt)
 			ok = FALSE;
 	}
 
-	free(buffer);
+	lws_free(buffer);
 	return ok ? dst : NULL;
 }
diff --git a/lib/output.c b/lib/output.c
index 846e3022..b914f281 100644
--- a/lib/output.c
+++ b/lib/output.c
@@ -195,11 +195,10 @@ handle_truncated_send:
 	 */
 	if (!wsi->truncated_send_malloc ||
 			real_len - n > wsi->truncated_send_allocation) {
-		if (wsi->truncated_send_malloc)
-			free(wsi->truncated_send_malloc);
+		lws_free(wsi->truncated_send_malloc);
 
 		wsi->truncated_send_allocation = real_len - n;
-		wsi->truncated_send_malloc = malloc(real_len - n);
+		wsi->truncated_send_malloc = lws_malloc(real_len - n);
 		if (!wsi->truncated_send_malloc) {
 			lwsl_err("truncated send: unable to malloc %d\n",
 							  real_len - n);
diff --git a/lib/parsers.c b/lib/parsers.c
index 0f099272..def5c3be 100644
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -63,7 +63,7 @@ int lws_allocate_header_table(struct libwebsocket *wsi)
 {
 	/* Be sure to free any existing header data to avoid mem leak: */
 	lws_free_header_table(wsi);
-	wsi->u.hdr.ah = malloc(sizeof(*wsi->u.hdr.ah));
+	wsi->u.hdr.ah = lws_malloc(sizeof(*wsi->u.hdr.ah));
 	if (wsi->u.hdr.ah == NULL) {
 		lwsl_err("Out of memory\n");
 		return -1;
@@ -77,11 +77,11 @@ int lws_allocate_header_table(struct libwebsocket *wsi)
 
 int lws_free_header_table(struct libwebsocket *wsi)
 {
-    if (wsi->u.hdr.ah) {
-        free(wsi->u.hdr.ah);
-        wsi->u.hdr.ah = NULL;
-    }
-    return 0;
+	if (wsi->u.hdr.ah) {
+		lws_free(wsi->u.hdr.ah);
+		wsi->u.hdr.ah = NULL;
+	}
+	return 0;
 };
 
 LWS_VISIBLE int lws_hdr_total_length(struct libwebsocket *wsi, enum lws_token_indexes h)
@@ -894,13 +894,14 @@ spill:
 			/* if existing buffer is too small, drop it */
 			if (wsi->u.ws.ping_payload_buf &&
 			    wsi->u.ws.ping_payload_alloc < wsi->u.ws.rx_user_buffer_head) {
-				free(wsi->u.ws.ping_payload_buf);
+				lws_free(wsi->u.ws.ping_payload_buf);
 				wsi->u.ws.ping_payload_buf = NULL;
 			}
 
 			/* if no buffer, allocate it */
 			if (!wsi->u.ws.ping_payload_buf) {
-				wsi->u.ws.ping_payload_buf = malloc(wsi->u.ws.rx_user_buffer_head + LWS_SEND_BUFFER_PRE_PADDING);
+				wsi->u.ws.ping_payload_buf = lws_malloc(wsi->u.ws.rx_user_buffer_head
+									+ LWS_SEND_BUFFER_PRE_PADDING);
 				wsi->u.ws.ping_payload_alloc = wsi->u.ws.rx_user_buffer_head;
 			}
 			
diff --git a/lib/server-handshake.c b/lib/server-handshake.c
index 9b6c8193..b4641d1b 100644
--- a/lib/server-handshake.c
+++ b/lib/server-handshake.c
@@ -124,15 +124,12 @@ lws_extension_server_handshake(struct libwebsocket_context *context,
 
 			wsi->active_extensions_user[
 				wsi->count_active_extensions] =
-				     malloc(ext->per_session_data_size);
+				     lws_zalloc(ext->per_session_data_size);
 			if (wsi->active_extensions_user[
 			     wsi->count_active_extensions] == NULL) {
 				lwsl_err("Out of mem\n");
 				return 1;
 			}
-			memset(wsi->active_extensions_user[
-				wsi->count_active_extensions], 0,
-					    ext->per_session_data_size);
 
 			wsi->active_extensions[
 				  wsi->count_active_extensions] = ext;
@@ -154,7 +151,7 @@ lws_extension_server_handshake(struct libwebsocket_context *context,
 
 		n = 0;
 	}
-	
+
 	return 0;
 }
 #endif
diff --git a/lib/server.c b/lib/server.c
index 4ed7f30f..c75d6135 100644
--- a/lib/server.c
+++ b/lib/server.c
@@ -102,7 +102,7 @@ int lws_context_init_server(struct lws_context_creation_info *info,
 		compatible_close(sockfd);
 		return 1;
 	}
-	
+
 	if (getsockname(sockfd, (struct sockaddr *)&sin, &len) == -1)
 		lwsl_warn("getsockname: %s\n", strerror(LWS_ERRNO));
 	else
@@ -110,13 +110,12 @@ int lws_context_init_server(struct lws_context_creation_info *info,
 
 	context->listen_port = info->port;
 
-	wsi = (struct libwebsocket *)malloc(sizeof(struct libwebsocket));
+	wsi = lws_zalloc(sizeof(struct libwebsocket));
 	if (wsi == NULL) {
 		lwsl_err("Out of mem\n");
 		compatible_close(sockfd);
 		return 1;
 	}
-	memset(wsi, 0, sizeof(struct libwebsocket));
 	wsi->sock = sockfd;
 	wsi->mode = LWS_CONNMODE_SERVER_LISTENER;
 
@@ -128,7 +127,7 @@ int lws_context_init_server(struct lws_context_creation_info *info,
 
 	listen(sockfd, LWS_SOMAXCONN);
 	lwsl_notice(" Listening on port %d\n", info->port);
-	
+
 	return 0;
 }
 
@@ -296,8 +295,7 @@ got_uri:
 	}
 
 	/* now drop the header info we kept a pointer to */
-	if (wsi->u.http.ah)
-		free(wsi->u.http.ah);
+	lws_free(wsi->u.http.ah);
 	/* not possible to continue to use past here */
 	wsi->u.http.ah = NULL;
 
@@ -323,7 +321,7 @@ got_uri:
 bail_nuke_ah:
 	/* drop the header info */
 	if (wsi->u.hdr.ah) {
-		free(wsi->u.hdr.ah);
+		lws_free(wsi->u.hdr.ah);
 		wsi->u.hdr.ah = NULL;
 	}
 	
@@ -560,7 +558,7 @@ upgrade_ws:
 		if (!n)
 			n = LWS_MAX_SOCKET_IO_BUF;
 		n += LWS_SEND_BUFFER_PRE_PADDING + LWS_SEND_BUFFER_POST_PADDING;
-		wsi->u.ws.rx_user_buffer = malloc(n);
+		wsi->u.ws.rx_user_buffer = lws_malloc(n);
 		if (!wsi->u.ws.rx_user_buffer) {
 			lwsl_err("Out of Mem allocating rx buffer %d\n", n);
 			return 1;
@@ -589,13 +587,12 @@ libwebsocket_create_new_server_wsi(struct libwebsocket_context *context)
 {
 	struct libwebsocket *new_wsi;
 
-	new_wsi = (struct libwebsocket *)malloc(sizeof(struct libwebsocket));
+	new_wsi = lws_zalloc(sizeof(struct libwebsocket));
 	if (new_wsi == NULL) {
 		lwsl_err("Out of memory for new connection\n");
 		return NULL;
 	}
 
-	memset(new_wsi, 0, sizeof(struct libwebsocket));
 	new_wsi->pending_timeout = NO_PENDING_TIMEOUT;
 	new_wsi->rxflow_change_to = LWS_RXFLOW_ALLOW;
 
@@ -606,7 +603,7 @@ libwebsocket_create_new_server_wsi(struct libwebsocket_context *context)
 	new_wsi->hdr_parsing_completed = 0;
 
 	if (lws_allocate_header_table(new_wsi)) {
-		free(new_wsi);
+		lws_free(new_wsi);
 		return NULL;
 	}
 
diff --git a/lib/service.c b/lib/service.c
index ec3681b9..c3e9dc52 100644
--- a/lib/service.c
+++ b/lib/service.c
@@ -302,7 +302,7 @@ int lws_rxflow_cache(struct libwebsocket *wsi, unsigned char *buf, int n, int le
 
 	/* a new rxflow, buffer it and warn caller */
 	lwsl_info("new rxflow input buffer len %d\n", len - n);
-	wsi->rxflow_buffer = (unsigned char *)malloc(len - n);
+	wsi->rxflow_buffer = lws_malloc(len - n);
 	wsi->rxflow_len = len - n;
 	wsi->rxflow_pos = 0;
 	memcpy(wsi->rxflow_buffer, buf + n, len - n);
@@ -564,7 +564,7 @@ drain:
 		if (draining_flow && wsi->rxflow_buffer &&
 				 wsi->rxflow_pos == wsi->rxflow_len) {
 			lwsl_info("flow buffer: drained\n");
-			free(wsi->rxflow_buffer);
+			lws_free(wsi->rxflow_buffer);
 			wsi->rxflow_buffer = NULL;
 			/* having drained the rxflow buffer, can rearm POLLIN */
 			_libwebsocket_rx_flow_control(wsi); /* n ignored, needed for NO_SERVER case */
diff --git a/lib/ssl.c b/lib/ssl.c
index 7cc565bc..f9e88483 100644
--- a/lib/ssl.c
+++ b/lib/ssl.c
@@ -480,7 +480,7 @@ lws_server_socket_service_ssl(struct libwebsocket_context *context,
 			    ERR_error_string(SSL_get_error(
 			    new_wsi->ssl, 0), NULL));
 			    libwebsockets_decode_ssl_error();
-			free(new_wsi);
+			lws_free(new_wsi);
 			compatible_close(accept_fd);
 			break;
 		}