diff --git a/configure.ac b/configure.ac
index 8813814b..3c336249 100644
--- a/configure.ac
+++ b/configure.ac
@@ -243,7 +243,7 @@ AC_HEADER_STDC
 AC_HEADER_SYS_WAIT
 AC_HEADER_ASSERT
 AC_CHECK_HEADERS([ \
-	errno.h fcntl.h malloc.h stdlib.h \
+	errno.h fcntl.h stdlib.h \
 	inttypes.h string.h strings.h \
 	sys/time.h unistd.h getopt.h sys/mman.h
 ])
diff --git a/src/pkcs11/framework-pkcs15.c b/src/pkcs11/framework-pkcs15.c
index dac44d4e..d8b3ca77 100644
--- a/src/pkcs11/framework-pkcs15.c
+++ b/src/pkcs11/framework-pkcs15.c
@@ -4052,13 +4052,12 @@ static int pkcs15_skey_get_value(struct sc_pkcs11_session *session,
 	 * but for now we only work with session objects
 	 * derived from other keys
 	 */
-	skey_data= malloc(sizeof(struct sc_pkcs15_skey));
+	skey_data= calloc(1, sizeof(struct sc_pkcs15_skey));
 	if (skey_data == NULL)
 		return SC_ERROR_OUT_OF_MEMORY;
-	memset(skey_data, 0, sizeof(struct sc_pkcs15_skey));
 
 	if (skey->value && skey->value->data_len) {
-		skey_data->data = malloc(skey_data->data_len);
+		skey_data->data = calloc(1, skey_data->data_len);
 		if (skey_data->data == NULL) {
 			free(skey_data);
 			return SC_ERROR_OUT_OF_MEMORY;
diff --git a/src/pkcs11/mechanism.c b/src/pkcs11/mechanism.c
index e848baf1..0dbcf394 100644
--- a/src/pkcs11/mechanism.c
+++ b/src/pkcs11/mechanism.c
@@ -673,7 +673,7 @@ sc_pkcs11_verify_final(sc_pkcs11_operation_t *operation,
 	rv = key->ops->get_attribute(operation->session, key, &attr);
 	if (rv != CKR_OK)
 		return rv;
-	pubkey_value = malloc(attr.ulValueLen);
+	pubkey_value = calloc(1, attr.ulValueLen);
 	attr.pValue = pubkey_value;
 	rv = key->ops->get_attribute(operation->session, key, &attr);
 	if (rv != CKR_OK)
diff --git a/src/pkcs11/openssl.c b/src/pkcs11/openssl.c
index d6e61d83..88023d76 100644
--- a/src/pkcs11/openssl.c
+++ b/src/pkcs11/openssl.c
@@ -420,7 +420,7 @@ CK_RV sc_pkcs11_verify_data(const unsigned char *pubkey, int pubkey_len,
 		if (rsa == NULL)
 			return CKR_DEVICE_MEMORY;
 
-		rsa_out = malloc(RSA_size(rsa));
+		rsa_out = calloc(1, RSA_size(rsa));
 		if (rsa_out == NULL) {
 			RSA_free(rsa);
 			return CKR_DEVICE_MEMORY;
diff --git a/src/pkcs11/pkcs11-global.c b/src/pkcs11/pkcs11-global.c
index d192ee35..4c4f7275 100644
--- a/src/pkcs11/pkcs11-global.c
+++ b/src/pkcs11/pkcs11-global.c
@@ -42,7 +42,7 @@ extern CK_FUNCTION_LIST pkcs11_function_list;
 #include <pthread.h>
 CK_RV mutex_create(void **mutex)
 {
-	pthread_mutex_t *m = malloc(sizeof(*mutex));
+	pthread_mutex_t *m = calloc(1, sizeof(*mutex));
 	if (m == NULL)
 		return CKR_GENERAL_ERROR;;
 	pthread_mutex_init(m, NULL);
@@ -80,7 +80,7 @@ CK_RV mutex_create(void **mutex)
 {
 	CRITICAL_SECTION *m;
 
-	m = malloc(sizeof(*m));
+	m = calloc(1, sizeof(*m));
 	if (m == NULL)
 		return CKR_GENERAL_ERROR;
 	InitializeCriticalSection(m);
@@ -385,7 +385,7 @@ CK_RV C_GetSlotList(CK_BBOOL       tokenPresent,  /* only slots with token prese
 
 	card_detect_all();
 
-	found = malloc(list_size(&virtual_slots) * sizeof(CK_SLOT_ID));
+	found = calloc(list_size(&virtual_slots), sizeof(CK_SLOT_ID));
 
 	if (found == NULL) {
 		rv = CKR_HOST_MEMORY;
diff --git a/src/pkcs11/pkcs11-object.c b/src/pkcs11/pkcs11-object.c
index d89c8111..d1c43803 100644
--- a/src/pkcs11/pkcs11-object.c
+++ b/src/pkcs11/pkcs11-object.c
@@ -1352,7 +1352,7 @@ int sc_pkcs11_any_cmp_attribute(struct sc_pkcs11_session *session, void *ptr, CK
 	if (temp_attr.ulValueLen <= sizeof(temp1))
 		temp_attr.pValue = temp1;
 	else {
-		temp2 = malloc(temp_attr.ulValueLen);
+		temp2 = calloc(1, temp_attr.ulValueLen);
 		if (temp2 == NULL)
 			return 0;
 		temp_attr.pValue = temp2;
diff --git a/src/pkcs11/sc-pkcs11.h b/src/pkcs11/sc-pkcs11.h
index ae7d41b7..48c74e4a 100644
--- a/src/pkcs11/sc-pkcs11.h
+++ b/src/pkcs11/sc-pkcs11.h
@@ -23,10 +23,6 @@
 
 #include "config.h"
 
-#ifdef HAVE_MALLOC_H
-#include <malloc.h>
-#endif
-
 #include "libopensc/opensc.h"
 #include "libopensc/pkcs15.h"
 #include "libopensc/log.h"