From ba00ceef5b9c4de7cf7004d4911870d717585a9a Mon Sep 17 00:00:00 2001
From: Kristian Larsson <kristian@spritelink.net>
Date: Fri, 2 Feb 2024 11:14:01 +0100
Subject: [PATCH] Support custom memory allocators

This makes it possible to use custom allocators, for example GC_malloc()
when used in a garbage collected project.

The code is an adaptation from libuv itself, which supports custom
allocators.
---
 src/bio.c             | 19 +++++++------
 src/common.c          | 62 +++++++++++++++++++++++++++++++++++++++++
 src/common.h          | 18 ++++++++++++
 src/http.c            | 55 ++++++++++++++++++------------------
 src/http_req.c        | 36 ++++++++++++------------
 src/mbedtls/engine.c  | 65 ++++++++++++++++++++++---------------------
 src/mbedtls/keys.c    | 21 +++++++-------
 src/mbedtls/p11_rsa.c | 14 ++++++----
 src/openssl/engine.c  | 27 +++++++++---------
 src/tls_link.c        | 17 +++++------
 src/tlsuv.c           | 17 +++++------
 src/websocket.c       | 41 ++++++++++++++-------------
 src/win32_compat.h    |  3 +-
 13 files changed, 243 insertions(+), 152 deletions(-)
 create mode 100644 src/common.c
 create mode 100644 src/common.h

diff --git a/src/bio.c b/src/bio.c
index 947e3b36..52e6b0ae 100644
--- a/src/bio.c
+++ b/src/bio.c
@@ -20,6 +20,7 @@
 #else
 #include <sys/param.h>
 #endif
+#include "common.h"
 #include "bio.h"
 
 struct msg {
@@ -30,7 +31,7 @@ struct msg {
 };
 
 tlsuv_BIO *tlsuv_BIO_new(void) {
-    tlsuv_BIO * bio = calloc(1, sizeof(tlsuv_BIO));
+    tlsuv_BIO * bio = tlsuv_calloc(1, sizeof(tlsuv_BIO));
     bio->available = 0;
     bio->headoffset = 0;
     bio->qlen = 0;
@@ -43,11 +44,11 @@ void tlsuv_BIO_free(tlsuv_BIO *bio) {
     while(!STAILQ_EMPTY(&bio->message_q)) {
         struct msg *m = STAILQ_FIRST(&bio->message_q);
         STAILQ_REMOVE_HEAD(&bio->message_q, next);
-        free(m->buf);
-        free(m);
+        tlsuv_free(m->buf);
+        tlsuv_free(m);
     }
 
-    free(bio);
+    tlsuv_free(bio);
 }
 
 size_t tlsuv_BIO_available(tlsuv_BIO *bio) {
@@ -55,14 +56,14 @@ size_t tlsuv_BIO_available(tlsuv_BIO *bio) {
 }
 
 int tlsuv_BIO_put(tlsuv_BIO *bio, const uint8_t *buf, size_t len) {
-    struct msg *m = malloc(sizeof(struct msg));
+    struct msg *m = tlsuv_malloc(sizeof(struct msg));
     if (m == NULL) {
         return -1;
     }
 
-    m->buf = malloc(len);
+    m->buf = tlsuv_malloc(len);
     if (m->buf == NULL) {
-        free(m);
+        tlsuv_free(m);
         return -1;
     }
     memcpy(m->buf, buf, len);
@@ -94,8 +95,8 @@ int tlsuv_BIO_read(tlsuv_BIO *bio, uint8_t *buf, size_t len) {
             bio->headoffset = 0;
             bio->qlen -= 1;
 
-            free(m->buf);
-            free(m);
+            tlsuv_free(m->buf);
+            tlsuv_free(m);
         }
     }
 
diff --git a/src/common.c b/src/common.c
new file mode 100644
index 00000000..f20ef2aa
--- /dev/null
+++ b/src/common.c
@@ -0,0 +1,62 @@
+#include <uv.h>
+#include "common.h"
+
+typedef struct {
+  tlsuv_malloc_func malloc;
+  tlsuv_realloc_func realloc;
+  tlsuv_calloc_func calloc;
+  tlsuv_free_func free;
+} tlsuv__allocator_t;
+
+static tlsuv__allocator_t tlsuv__allocator = {
+  malloc,
+  realloc,
+  calloc,
+  free,
+};
+
+int tlsuv_replace_allocator(tlsuv_malloc_func malloc_func,
+                            tlsuv_realloc_func realloc_func,
+                            tlsuv_calloc_func calloc_func,
+                            tlsuv_free_func free_func) {
+  if (malloc_func == NULL || realloc_func == NULL ||
+      calloc_func == NULL || free_func == NULL) {
+    return UV_EINVAL;
+  }
+
+  tlsuv__allocator.malloc = malloc_func;
+  tlsuv__allocator.realloc = realloc_func;
+  tlsuv__allocator.calloc = calloc_func;
+  tlsuv__allocator.free = free_func;
+
+  return 0;
+}
+
+void* tlsuv_malloc(size_t size) {
+    if (size > 0)
+        return tlsuv__allocator.malloc(size);
+    return NULL;
+}
+
+void* tlsuv_realloc(void* ptr, size_t size) {
+  if (size > 0)
+    return tlsuv__allocator.realloc(ptr, size);
+  tlsuv_free(ptr);
+  return NULL;
+}
+
+
+void* tlsuv_calloc(size_t count, size_t size) {
+  return tlsuv__allocator.calloc(count, size);
+}
+
+void tlsuv_free(void* ptr) {
+  int saved_errno;
+
+  /* The system allocator the assumption that errno is not modified but custom
+   * allocators may not be so careful.
+   */
+  saved_errno = errno;
+  tlsuv__allocator.free(ptr);
+  errno = saved_errno;
+}
diff --git a/src/common.h b/src/common.h
new file mode 100644
index 00000000..c9e7c05a
--- /dev/null
+++ b/src/common.h
@@ -0,0 +1,18 @@
+#pragma once
+#include <stdlib.h>
+
+typedef void* (*tlsuv_malloc_func)(size_t size);
+typedef void* (*tlsuv_malloc_func)(size_t size);
+typedef void* (*tlsuv_realloc_func)(void* ptr, size_t size);
+typedef void* (*tlsuv_calloc_func)(size_t count, size_t size);
+typedef void (*tlsuv_free_func)(void* ptr);
+
+int tlsuv_replace_allocator(tlsuv_malloc_func malloc_func,
+                            tlsuv_realloc_func realloc_func,
+                            tlsuv_calloc_func calloc_func,
+                            tlsuv_free_func free_func);
+
+void *tlsuv_malloc(size_t size);
+void *tlsuv_realloc(void* ptr, size_t size);
+void *tlsuv_calloc(size_t count, size_t size);
+void tlsuv_free(void* ptr);
diff --git a/src/http.c b/src/http.c
index 840503cb..0edfbb94 100644
--- a/src/http.c
+++ b/src/http.c
@@ -18,6 +18,7 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "common.h"
 #include "um_debug.h"
 #include "win32_compat.h"
 #include "http_req.h"
@@ -81,7 +82,7 @@ static void http_read_cb(uv_link_t *link, ssize_t nread, const uv_buf_t *buf) {
         close_connection(c);
         uv_async_send(&c->proc);
         if (buf && buf->base) {
-            free(buf->base);
+            tlsuv_free(buf->base);
         }
         return;
     }
@@ -93,7 +94,7 @@ static void http_read_cb(uv_link_t *link, ssize_t nread, const uv_buf_t *buf) {
                 UM_LOG(WARN, "failed to parse HTTP response");
                 fail_active_request(c, UV_EINVAL, "failed to parse HTTP response");
                 close_connection(c);
-                free(buf->base);
+                tlsuv_free(buf->base);
                 return;
             }
         }
@@ -115,7 +116,7 @@ static void http_read_cb(uv_link_t *link, ssize_t nread, const uv_buf_t *buf) {
             }
 
             http_req_free(hr);
-            free(hr);
+            tlsuv_free(hr);
 
             if (!keep_alive) {
                 close_connection(c);
@@ -128,7 +129,7 @@ static void http_read_cb(uv_link_t *link, ssize_t nread, const uv_buf_t *buf) {
     }
 
     if (buf && buf->base) {
-        free(buf->base);
+        tlsuv_free(buf->base);
     }
 }
 
@@ -139,7 +140,7 @@ static void clear_req_body(tlsuv_http_req_t *req, int code) {
         if (chunk->cb) {
             chunk->cb(req, chunk->chunk, code);
         }
-        free(chunk);
+        tlsuv_free(chunk);
 
         chunk = next;
     }
@@ -153,7 +154,7 @@ static void fail_active_request(tlsuv_http_t *c, int code, const char *msg) {
         c->active->resp_cb(&c->active->resp, c->active->data);
         clear_req_body(c->active, code);
         http_req_free(c->active);
-        free(c->active);
+        tlsuv_free(c->active);
         c->active = NULL;
     }
 }
@@ -173,7 +174,7 @@ static void fail_all_requests(tlsuv_http_t *c, int code, const char *msg) {
         }
         clear_req_body(r, code);
         http_req_free(r);
-        free(r);
+        tlsuv_free(r);
     }
 }
 
@@ -290,7 +291,7 @@ static void src_connect_timeout(uv_timer_t *t) {
 
 static void req_write_cb(uv_link_t *source, int status, void *arg) {
     UM_LOG(VERB, "request write completed: %d", status);
-    free(arg);
+    tlsuv_free(arg);
 }
 
 static void req_write_body_cb(uv_link_t *source, int status, void *arg) {
@@ -299,12 +300,12 @@ static void req_write_body_cb(uv_link_t *source, int status, void *arg) {
     if (chunk->cb) {
         chunk->cb(chunk->req, chunk->chunk, status);
     }
-    free(chunk);
+    tlsuv_free(chunk);
 }
 
 static void chunk_hdr_wcb(uv_link_t *l, int status, void *arg) {
     if (arg != NULL) {
-        free(arg);
+        tlsuv_free(arg);
     }
 }
 
@@ -323,7 +324,7 @@ static void send_body(tlsuv_http_req_t *req) {
 
         if (req->req_chunked) {
             if (b->len > 0) {
-                buf.base = malloc(10);
+                buf.base = tlsuv_malloc(10);
                 buf.len = snprintf(buf.base, 10, "%zx\r\n", b->len);
                 uv_link_write((uv_link_t *) &clt->http_link, &buf, 1, NULL, chunk_hdr_wcb, buf.base);
 
@@ -338,7 +339,7 @@ static void send_body(tlsuv_http_req_t *req) {
                 buf.base = "0\r\n\r\n";
                 buf.len = 5;
                 uv_link_write((uv_link_t *) &clt->http_link, &buf, 1, NULL, chunk_hdr_wcb, NULL);
-                free(b);
+                tlsuv_free(b);
                 req->state = body_sent;
             }
         }
@@ -408,10 +409,10 @@ static void process_requests(uv_async_t *ar) {
         if (c->active->state < headers_sent) {
             UM_LOG(VERB, "sending request[%s] headers", c->active->path);
             uv_buf_t req;
-            req.base = malloc(8196);
+            req.base = tlsuv_malloc(8196);
             ssize_t header_len = http_req_write(c->active, req.base, 8196);
             if (header_len == UV_ENOMEM) {
-                free(req.base);
+                tlsuv_free(req.base);
                 fail_active_request(c, (int)header_len, "request header too big");
                 uv_async_send(&c->proc);
                 return;
@@ -458,12 +459,12 @@ int tlsuv_http_close(tlsuv_http_t *clt, tlsuv_http_close_cb close_cb) {
 
 static void http_set_prefix(tlsuv_http_t *clt, const char *pfx, size_t pfx_len) {
     if (clt->prefix) {
-        free(clt->prefix);
+        tlsuv_free(clt->prefix);
         clt->prefix = NULL;
     }
 
     if (pfx) {
-        clt->prefix = calloc(1, pfx_len + 1);
+        clt->prefix = tlsuv_calloc(1, pfx_len + 1);
         strncpy(clt->prefix, pfx, pfx_len);
     }
 }
@@ -499,7 +500,7 @@ int tlsuv_http_set_url(tlsuv_http_t *clt, const char *url) {
 
     if (clt->host) {
         clt->host_change = true;
-        free(clt->host);
+        tlsuv_free(clt->host);
     }
     set_http_header(&clt->headers, "Host", NULL);
 
@@ -541,7 +542,7 @@ int tlsuv_http_init_with_src(uv_loop_t *l, tlsuv_http_t *clt, const char *url, t
 
     clt->connect_timeout = 0;
     clt->idle_time = DEFAULT_IDLE_TIMEOUT;
-    clt->conn_timer = calloc(1, sizeof(uv_timer_t));
+    clt->conn_timer = tlsuv_calloc(1, sizeof(uv_timer_t));
     uv_timer_init(l, clt->conn_timer);
     uv_unref((uv_handle_t *) clt->conn_timer);
     clt->conn_timer->data = clt;
@@ -563,7 +564,7 @@ void tlsuv_http_set_path_prefix(tlsuv_http_t *clt, const char *prefix) {
 }
 
 int tlsuv_http_init(uv_loop_t *l, tlsuv_http_t *clt, const char *url) {
-    tcp_src_t *src = calloc(1, sizeof(tcp_src_t));
+    tcp_src_t *src = tlsuv_calloc(1, sizeof(tcp_src_t));
     tcp_src_init(l, src);
     tcp_src_nodelay(src, 1);
     tcp_src_keepalive(src, 1, 3);
@@ -588,7 +589,7 @@ void tlsuv_http_set_ssl(tlsuv_http_t *clt, tls_context *tls) {
 }
 
 tlsuv_http_req_t *tlsuv_http_req(tlsuv_http_t *clt, const char *method, const char *path, tlsuv_http_resp_cb resp_cb, void *ctx) {
-    tlsuv_http_req_t *r = calloc(1, sizeof(tlsuv_http_req_t));
+    tlsuv_http_req_t *r = tlsuv_calloc(1, sizeof(tlsuv_http_req_t));
     http_req_init(r, method, path);
 
     r->client = clt;
@@ -647,7 +648,7 @@ int http_req_cancel_err(tlsuv_http_t *clt, tlsuv_http_req_t *req, int error, con
         }
 
         http_req_free(req);
-        free(req);
+        tlsuv_free(req);
         return 0;
     } else {
         return UV_EINVAL;
@@ -686,7 +687,7 @@ int tlsuv_http_req_header(tlsuv_http_req_t *req, const char *name, const char *v
 
 void tlsuv_http_req_end(tlsuv_http_req_t *req) {
     if (req->req_chunked) {
-        struct body_chunk_s *chunk = calloc(1, sizeof(struct body_chunk_s));
+        struct body_chunk_s *chunk = tlsuv_calloc(1, sizeof(struct body_chunk_s));
 
         chunk->len = 0;
         chunk->next = NULL;
@@ -717,7 +718,7 @@ int tlsuv_http_req_data(tlsuv_http_req_t *req, const char *body, size_t bodylen,
         return UV_EINVAL;
     }
 
-    struct body_chunk_s *chunk = calloc(1, sizeof(struct body_chunk_s));
+    struct body_chunk_s *chunk = tlsuv_calloc(1, sizeof(struct body_chunk_s));
     chunk->chunk = (char*)body;
     chunk->len = bodylen;
     chunk->cb = cb;
@@ -742,12 +743,12 @@ int tlsuv_http_req_data(tlsuv_http_req_t *req, const char *body, size_t bodylen,
 
 static void free_http(tlsuv_http_t *clt) {
     free_hdr_list(&clt->headers);
-    free(clt->host);
+    tlsuv_free(clt->host);
     if (clt->prefix) free(clt->prefix);
 
     if (clt->active) {
         http_req_free(clt->active);
-        free(clt->active);
+        tlsuv_free(clt->active);
         clt->active = NULL;
     }
 
@@ -755,13 +756,13 @@ static void free_http(tlsuv_http_t *clt) {
         tlsuv_http_req_t *req = STAILQ_FIRST(&clt->requests);
         STAILQ_REMOVE_HEAD(&clt->requests, _next);
         http_req_free(req);
-        free(req);
+        tlsuv_free(req);
     }
 
     if (clt->own_src && clt->src) {
         clt->src->release(clt->src);
         tcp_src_free((tcp_src_t *) clt->src);
-        free(clt->src);
+        tlsuv_free(clt->src);
         clt->src = NULL;
     }
     tlsuv_tls_link_free(&clt->tls_link);
diff --git a/src/http_req.c b/src/http_req.c
index 7a23fe7b..2a647ccb 100644
--- a/src/http_req.c
+++ b/src/http_req.c
@@ -57,14 +57,14 @@ void http_req_free(tlsuv_http_req_t *req) {
     free_hdr_list(&req->req_headers);
     free_hdr_list(&req->resp.headers);
     if (req->resp.status) {
-        free(req->resp.status);
+        tlsuv_free(req->resp.status);
     }
     if (req->inflater) {
         um_free_inflater(req->inflater);
     }
-    free(req->query);
-    free(req->path);
-    free(req->method);
+    tlsuv_free(req->query);
+    tlsuv_free(req->path);
+    tlsuv_free(req->method);
 }
 
 static int printable_len(const unsigned char* buf, size_t len) {
@@ -91,8 +91,8 @@ ssize_t http_req_process(tlsuv_http_req_t *req, const char* buf, ssize_t len) {
 }
 
 static void free_hdr(tlsuv_http_hdr *hdr) {
-    free(hdr->name);
-    free(hdr->value);
+    tlsuv_free(hdr->name);
+    tlsuv_free(hdr->value);
 }
 
 void free_hdr_list(um_header_list *l) {
@@ -102,7 +102,7 @@ void free_hdr_list(um_header_list *l) {
         LIST_REMOVE(h, _next);
 
         free_hdr(h);
-        free(h);
+        tlsuv_free(h);
     }
 }
 
@@ -128,12 +128,12 @@ static ssize_t write_url_encoded(char *buf, size_t maxlen, const char *url) {
 }
 
 static void free_body_cb(tlsuv_http_req_t *r, char *body, ssize_t i) {
-    free(body);
+    tlsuv_free(body);
 }
 
 static char *encode_query (size_t count, const tlsuv_http_pair *pairs, size_t *outlen) {
 #define MAX_FORM (16 * 1024)
-    char *body = malloc(MAX_FORM);
+    char *body = tlsuv_malloc(MAX_FORM);
     if (body == NULL) {
         return NULL;
     }
@@ -161,7 +161,7 @@ static char *encode_query (size_t count, const tlsuv_http_pair *pairs, size_t *o
         *outlen = len;
     return body;
     error:
-    free(body);
+    tlsuv_free(body);
     return NULL;
 }
 
@@ -179,7 +179,7 @@ int tlsuv_http_req_query(tlsuv_http_req_t *req, size_t count, const tlsuv_http_p
         }
     }
 
-    free(req->query);
+    tlsuv_free(req->query);
     req->query = query;
     return 0;
 }
@@ -268,7 +268,7 @@ l += a_size;\
 void add_http_header(um_header_list *hl, const char* name, const char *value, size_t vallen) {
     tlsuv_http_hdr *h;
 
-    h = malloc(sizeof(tlsuv_http_hdr));
+    h = tlsuv_malloc(sizeof(tlsuv_http_hdr));
     h->name = strdup(name);
     LIST_INSERT_HEAD(hl, h, _next);
 
@@ -286,19 +286,19 @@ void set_http_header(um_header_list *hl, const char* name, const char *value) {
     if (value == NULL) {
         if (h != NULL) {
             LIST_REMOVE(h, _next);
-            free(h->value);
-            free(h->name);
-            free(h);
+            tlsuv_free(h->value);
+            tlsuv_free(h->name);
+            tlsuv_free(h);
         }
         return;
     }
 
     if (h == NULL) {
-        h = malloc(sizeof(tlsuv_http_hdr));
+        h = tlsuv_malloc(sizeof(tlsuv_http_hdr));
         h->name = strdup(name);
         LIST_INSERT_HEAD(hl, h, _next);
     } else {
-        free(h->value);
+        tlsuv_free(h->value);
     }
 
     h->value = strdup(value);
@@ -360,7 +360,7 @@ static int http_status_cb(llhttp_t *parser, const char *status, size_t len) {
     tlsuv_http_req_t *r = parser->data;
     r->resp.code = (int) parser->status_code;
     snprintf(r->resp.http_version, sizeof(r->resp.http_version), "%1d.%1d", parser->http_major, parser->http_minor);
-    r->resp.status = calloc(1, len+1);
+    r->resp.status = tlsuv_calloc(1, len+1);
     strncpy(r->resp.status, status, len);
     return 0;
 }
diff --git a/src/mbedtls/engine.c b/src/mbedtls/engine.c
index bd6568e8..4f54e3ef 100644
--- a/src/mbedtls/engine.c
+++ b/src/mbedtls/engine.c
@@ -32,6 +32,7 @@
 #include <mbedtls/pem.h>
 #include <mbedtls/version.h>
 
+#include "../common.h"
 #include "../bio.h"
 #include "../um_debug.h"
 #include "keys.h"
@@ -200,11 +201,11 @@ static const char *mbedtls_eng_error(tlsuv_engine_t eng) {
 }
 
 tls_context *new_mbedtls_ctx(const char *ca, size_t ca_len) {
-    struct mbedtls_context *c = calloc(1, sizeof(struct mbedtls_context));
+    struct mbedtls_context *c = tlsuv_calloc(1, sizeof(struct mbedtls_context));
     c->api = mbedtls_context_api;
     if (ca && ca_len > 0) {
         c->ca_len = ca_len;
-        c->ca = calloc(1, ca_len + 1);
+        c->ca = tlsuv_calloc(1, ca_len + 1);
         memcpy(c->ca, ca, ca_len);
     }
 
@@ -230,15 +231,15 @@ static void init_ssl_context(mbedtls_ssl_config *ssl_config, const char *cabuf,
                                 MBEDTLS_SSL_PRESET_DEFAULT);
     mbedtls_ssl_conf_renegotiation(ssl_config, MBEDTLS_SSL_RENEGOTIATION_ENABLED);
     mbedtls_ssl_conf_authmode(ssl_config, MBEDTLS_SSL_VERIFY_REQUIRED);
-    engine->drbg = calloc(1, sizeof(mbedtls_ctr_drbg_context));
-    engine->entropy = calloc(1, sizeof(mbedtls_entropy_context));
+    engine->drbg = tlsuv_calloc(1, sizeof(mbedtls_ctr_drbg_context));
+    engine->entropy = tlsuv_calloc(1, sizeof(mbedtls_entropy_context));
     mbedtls_ctr_drbg_init(engine->drbg);
     mbedtls_entropy_init(engine->entropy);
-    unsigned char *seed = malloc(MBEDTLS_ENTROPY_MAX_SEED_SIZE); // uninitialized memory
+    unsigned char *seed = tlsuv_malloc(MBEDTLS_ENTROPY_MAX_SEED_SIZE); // uninitialized memory
     mbedtls_ctr_drbg_seed(engine->drbg, mbedtls_entropy_func, engine->entropy, seed, MBEDTLS_ENTROPY_MAX_SEED_SIZE);
     mbedtls_ssl_conf_rng(ssl_config, mbedtls_ctr_drbg_random, engine->drbg);
 
-    engine->ca = calloc(1, sizeof(mbedtls_x509_crt));
+    engine->ca = tlsuv_calloc(1, sizeof(mbedtls_x509_crt));
     mbedtls_x509_crt_init(engine->ca);
 
     if (cabuf != NULL) {
@@ -285,7 +286,7 @@ static void init_ssl_context(mbedtls_ssl_config *ssl_config, const char *cabuf,
 
 
     mbedtls_ssl_conf_ca_chain(ssl_config, engine->ca, NULL);
-    free(seed);
+    tlsuv_free(seed);
 }
 
 static int internal_cert_verify(void *ctx, mbedtls_x509_crt *crt, int depth, uint32_t *flags) {
@@ -371,13 +372,13 @@ static int internal_cert_verify(void *ctx, mbedtls_x509_crt *crt, int depth, uin
 tlsuv_engine_t new_mbedtls_engine(void *ctx, const char *host) {
     struct mbedtls_context *context = ctx;
 
-    struct mbedtls_engine *mbed_eng = calloc(1, sizeof(struct mbedtls_engine));
+    struct mbedtls_engine *mbed_eng = tlsuv_calloc(1, sizeof(struct mbedtls_engine));
     init_ssl_context(&mbed_eng->config, context->ca, context->ca_len);
 
     if (context->own_key && context->own_cert) {
         mbedtls_ssl_conf_own_cert(&mbed_eng->config, context->own_cert, &context->own_key->pkey);
     }
-    mbedtls_ssl_context *ssl = calloc(1, sizeof(mbedtls_ssl_context));
+    mbedtls_ssl_context *ssl = tlsuv_calloc(1, sizeof(mbedtls_ssl_context));
 
     mbedtls_ssl_init(ssl);
     mbedtls_ssl_setup(ssl, &mbed_eng->config);
@@ -484,22 +485,22 @@ static void mbedtls_free_ctx(tls_context *ctx) {
 
     if (c->own_cert) {
         mbedtls_x509_crt_free(c->own_cert);
-        free(c->own_cert);
+        tlsuv_free(c->own_cert);
     }
 
-    free(c->ca);
+    tlsuv_free(c->ca);
 
-    free(c);
+    tlsuv_free(c);
 }
 
 static int mbedtls_reset(tlsuv_engine_t engine) {
     struct mbedtls_engine *e = (struct mbedtls_engine *)engine;
     if (e->session == NULL) {
-        e->session = calloc(1, sizeof(mbedtls_ssl_session));
+        e->session = tlsuv_calloc(1, sizeof(mbedtls_ssl_session));
     }
     if (mbedtls_ssl_get_session(e->ssl, e->session) != 0) {
         mbedtls_ssl_session_free(e->session);
-        free(e->session);
+        tlsuv_free(e->session);
         e->session = NULL;
     }
     e->io = NULL;
@@ -513,42 +514,42 @@ static void mbedtls_free(tlsuv_engine_t engine) {
 
     mbedtls_ssl_free(e->ssl);
     if (e->ssl) {
-        free(e->ssl);
+        tlsuv_free(e->ssl);
         e->ssl = NULL;
     }
-    free(e->ssl);
+    tlsuv_free(e->ssl);
     if (e->session) {
         mbedtls_ssl_session_free(e->session);
-        free(e->session);
+        tlsuv_free(e->session);
     }
 
     if (e->protocols) {
         for (int i = 0; e->protocols[i] != NULL; i++) {
-            free(e->protocols[i]);
+            tlsuv_free(e->protocols[i]);
         }
-        free(e->protocols);
+        tlsuv_free(e->protocols);
     }
     mbedtls_x509_crt_free(e->ca);
     mbedtls_ssl_config_free(&e->config);
     mbedtls_ctr_drbg_free(e->drbg);
     mbedtls_entropy_free(e->entropy);
-    free(e->drbg);
-    free(e->entropy);
-    free(e->ca);
-    free(e);
+    tlsuv_free(e->drbg);
+    tlsuv_free(e->entropy);
+    tlsuv_free(e->ca);
+    tlsuv_free(e);
 }
 
 static void mbedtls_free_cert(tls_cert *cert) {
     mbedtls_x509_crt *c = *cert;
     mbedtls_x509_crt_free(c);
-    free(c);
+    tlsuv_free(c);
     *cert = NULL;
 }
 
 static void mbedtls_set_alpn_protocols(tlsuv_engine_t engine, const char** protos, int len) {
     struct mbedtls_engine *e = (struct mbedtls_engine *)engine;
 
-    e->protocols = calloc(len + 1, sizeof(char*));
+    e->protocols = tlsuv_calloc(len + 1, sizeof(char*));
     for (int i = 0; i < len; i++) {
         e->protocols[i] = strdup(protos[i]);
     }
@@ -556,7 +557,7 @@ static void mbedtls_set_alpn_protocols(tlsuv_engine_t engine, const char** proto
 }
 
 static int mbedtls_load_cert(tls_cert *c, const char *cert_buf, size_t cert_len) {
-    mbedtls_x509_crt *cert = calloc(1, sizeof(mbedtls_x509_crt));
+    mbedtls_x509_crt *cert = tlsuv_calloc(1, sizeof(mbedtls_x509_crt));
     if (cert_buf[cert_len - 1] != '\0') {
         cert_len += 1;
     }
@@ -566,7 +567,7 @@ static int mbedtls_load_cert(tls_cert *c, const char *cert_buf, size_t cert_len)
         if (rc < 0) {
             UM_LOG(WARN, "failed to load certificate");
             mbedtls_x509_crt_free(cert);
-            free(cert);
+            tlsuv_free(cert);
             cert = NULL;
         }
     }
@@ -815,7 +816,7 @@ static int parse_pkcs7_certs(tls_cert *chain, const char *pkcs7, size_t pkcs7len
         UM_LOG(ERR, "base64 decoding parsing error: %d", rc);
         return rc;
     }
-    uint8_t *base64_decoded_pkcs7 = calloc(1, der_len + 1);
+    uint8_t *base64_decoded_pkcs7 = tlsuv_calloc(1, der_len + 1);
     rc = mbedtls_base64_decode(base64_decoded_pkcs7, der_len, &der_len, (const uint8_t *)pkcs7, pkcs7len);
     if (rc != 0) {
         UM_LOG(ERR, "base64 decoding parsing error: %d", rc);
@@ -902,14 +903,14 @@ static int parse_pkcs7_certs(tls_cert *chain, const char *pkcs7, size_t pkcs7len
         }
 
         if (certs == NULL) {
-            certs = calloc(1, sizeof(mbedtls_x509_crt));
+            certs = tlsuv_calloc(1, sizeof(mbedtls_x509_crt));
         }
         cert_len += (cbp - cert_buf);
         rc = mbedtls_x509_crt_parse(certs, cert_buf, cert_len);
         if (rc != 0) {
             UM_LOG(ERR, "failed to parse cert: %d", rc);
             mbedtls_x509_crt_free(certs);
-            free(certs);
+            tlsuv_free(certs);
             *chain = NULL;
             return rc;
         }
@@ -917,7 +918,7 @@ static int parse_pkcs7_certs(tls_cert *chain, const char *pkcs7, size_t pkcs7len
 
     } while (rc == 0);
 
-    free(der);
+    tlsuv_free(der);
     *chain = certs;
     return 0;
 }
@@ -936,7 +937,7 @@ static int write_cert_pem(tls_cert cert, int full_chain, char **pem, size_t *pem
         c = c->next;
     }
 
-    uint8_t *pembuf = malloc(total_len + 1);
+    uint8_t *pembuf = tlsuv_malloc(total_len + 1);
     uint8_t *p = pembuf;
     c = cert;
     while (c != NULL) {
diff --git a/src/mbedtls/keys.c b/src/mbedtls/keys.c
index 6794c621..78602611 100644
--- a/src/mbedtls/keys.c
+++ b/src/mbedtls/keys.c
@@ -16,6 +16,7 @@
 #include <string.h>
 #include <tlsuv/tlsuv.h>
 
+#include "../common.h"
 #include "../um_debug.h"
 #include "keys.h"
 #include "mbedtls/ctr_drbg.h"
@@ -59,17 +60,17 @@ void priv_key_init(struct priv_key_s *privkey) {
 static void pubkey_free(tlsuv_public_key_t k) {
     struct pub_key_s *pub = (struct pub_key_s *) k;
     mbedtls_pk_free(&pub->pkey);
-    free(pub);
+    tlsuv_free(pub);
 }
 
 static int pubkey_pem(tlsuv_public_key_t pk, char **pem, size_t *pemlen) {
     struct pub_key_s *pub = (struct pub_key_s *) pk;
     size_t len = 1024;
-    char *buf = malloc(len);
+    char *buf = tlsuv_malloc(len);
     int rc;
     rc = mbedtls_pk_write_pubkey_pem(&pub->pkey, (unsigned char*)buf, len);
     if (rc != 0) {
-        free(buf);
+        tlsuv_free(buf);
         UM_LOG(WARN, "pubkey to_pem error: %d/%s", rc, mbedtls_error(rc));
         return -1;
     }
@@ -120,7 +121,7 @@ static int pubkey_verify(tlsuv_public_key_t pk, enum hash_algo md, const char *d
 static void privkey_free(tlsuv_private_key_t k) {
     struct priv_key_s *priv = (struct priv_key_s *) k;
     mbedtls_pk_free(&priv->pkey);
-    free(priv);
+    tlsuv_free(priv);
 }
 
 static int privkey_sign(tlsuv_private_key_t pk, enum hash_algo md, const char *data, size_t datalen, char *sig, size_t *siglen) {
@@ -172,7 +173,7 @@ static int privkey_sign(tlsuv_private_key_t pk, enum hash_algo md, const char *d
 
 static tlsuv_public_key_t privkey_pubkey(tlsuv_private_key_t pk) {
     struct priv_key_s *priv = (struct priv_key_s *) pk;
-    struct pub_key_s *pub = calloc(1, sizeof(*pub));
+    struct pub_key_s *pub = tlsuv_calloc(1, sizeof(*pub));
     pub_key_init(pub);
 
     // there is probably a more straight-forward way,
@@ -199,7 +200,7 @@ static int privkey_to_pem(tlsuv_private_key_t pk, char **pem, size_t *pemlen) {
 }
 
 int load_key(tlsuv_private_key_t *key, const char* keydata, size_t keydatalen) {
-    struct priv_key_s *privkey = calloc(1, sizeof(struct priv_key_s));
+    struct priv_key_s *privkey = tlsuv_calloc(1, sizeof(struct priv_key_s));
     priv_key_init(privkey);
     mbedtls_pk_init(&privkey->pkey);
 
@@ -213,7 +214,7 @@ int load_key(tlsuv_private_key_t *key, const char* keydata, size_t keydatalen) {
     int rc = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, NULL, 0);
     if (rc != 0) {
         mbedtls_pk_free(&privkey->pkey);
-        free(privkey);
+        tlsuv_free(privkey);
         *key = NULL;
         return rc;
     }
@@ -231,7 +232,7 @@ int load_key(tlsuv_private_key_t *key, const char* keydata, size_t keydatalen) {
         );
         if (rc < 0) {
             mbedtls_pk_free(&privkey->pkey);
-            free(privkey);
+            tlsuv_free(privkey);
             *key = NULL;
             return rc;
         }
@@ -249,7 +250,7 @@ int gen_key(tlsuv_private_key_t *key) {
     mbedtls_ecp_group_id ec_curve = MBEDTLS_ECP_DP_SECP256R1;
     mbedtls_pk_type_t pk_type = MBEDTLS_PK_ECKEY;
 
-    struct priv_key_s *private_key = calloc(1, sizeof(struct priv_key_s));
+    struct priv_key_s *private_key = tlsuv_calloc(1, sizeof(struct priv_key_s));
     *private_key = PRIV_KEY_API;
     mbedtls_pk_context *pk = &private_key->pkey;
     mbedtls_pk_init(pk);
@@ -277,7 +278,7 @@ int gen_key(tlsuv_private_key_t *key) {
     on_error:
     if (ret != 0) {
         mbedtls_pk_free(pk);
-        free(private_key);
+        tlsuv_free(private_key);
     } else {
         *key = (tlsuv_private_key_t)private_key;
     }
diff --git a/src/mbedtls/p11_rsa.c b/src/mbedtls/p11_rsa.c
index cf75e269..c1378822 100644
--- a/src/mbedtls/p11_rsa.c
+++ b/src/mbedtls/p11_rsa.c
@@ -20,6 +20,8 @@
 #include <mbedtls/oid.h>
 #include <mbedtls/version.h>
 
+#include "../common.h"
+
 #include <stdlib.h>
 #include <string.h>
 
@@ -61,14 +63,14 @@ int p11_load_rsa(mbedtls_pk_context *pk, struct mp11_key_ctx_s *p11key, mp11_con
     if (rc != CKR_OK) {
         return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
     }
-    pubattr[0].pValue = malloc(pubattr[0].ulValueLen);
-    pubattr[1].pValue = malloc(pubattr[1].ulValueLen);
+    pubattr[0].pValue = tlsuv_malloc(pubattr[0].ulValueLen);
+    pubattr[1].pValue = tlsuv_malloc(pubattr[1].ulValueLen);
     rc = p11->funcs->C_GetAttributeValue(p11->session, p11key->pub_handle, pubattr, 2);
     if (rc != CKR_OK) {
         return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
     }
 
-    mbedtls_rsa_context *rsa = malloc(sizeof(mbedtls_rsa_context));
+    mbedtls_rsa_context *rsa = tlsuv_malloc(sizeof(mbedtls_rsa_context));
     mbedtls_platform_zeroize(rsa, sizeof(mbedtls_rsa_context));
 #if MBEDTLS_VERSION_MAJOR == 3
     mbedtls_rsa_init(rsa /*, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_SHA256*/);
@@ -132,7 +134,7 @@ static int p11_rsa_sign(void *ctx, mbedtls_md_type_t md_alg,
         return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
     }
 
-    CK_BYTE *msg = malloc(hash_len + oid_len);
+    CK_BYTE *msg = tlsuv_malloc(hash_len + oid_len);
     memcpy(msg, oid, oid_len);
     memcpy(msg + oid_len, hash, hash_len);
 
@@ -167,8 +169,8 @@ static int p11_rsa_verify(void *ctx, mbedtls_md_type_t md_alg,
 static void p11_rsa_free(void *ctx) {
     mp11_key_ctx *p11key = ctx;
     mbedtls_rsa_free(p11key->pub);
-    free(p11key->pub);
-    free(ctx);
+    tlsuv_free(p11key->pub);
+    tlsuv_free(ctx);
 }
 
 static size_t p11_rsa_bitlen(const void *ctx) {
diff --git a/src/openssl/engine.c b/src/openssl/engine.c
index 1ca4d23b..b1986820 100644
--- a/src/openssl/engine.c
+++ b/src/openssl/engine.c
@@ -21,6 +21,7 @@
 #include <string.h>
 #include <stdarg.h>
 
+#include "../common.h"
 #include "../um_debug.h"
 #include <tlsuv/tlsuv.h>
 
@@ -174,7 +175,7 @@ static const char *tls_eng_error(tlsuv_engine_t self) {
 }
 
 tls_context *new_openssl_ctx(const char *ca, size_t ca_len) {
-    struct openssl_ctx *c = calloc(1, sizeof(struct openssl_ctx));
+    struct openssl_ctx *c = tlsuv_calloc(1, sizeof(struct openssl_ctx));
     c->api = openssl_context_api;
     init_ssl_context(c, ca, ca_len);
 
@@ -298,7 +299,7 @@ static X509_STORE** process_chains(X509_STORE *store, int *count) {
 
     idx = 0;
     int root_count = sk_X509_num(roots);
-    X509_STORE **stores = calloc(root_count, sizeof (X509_STORE*));
+    X509_STORE **stores = tlsuv_calloc(root_count, sizeof (X509_STORE*));
     while(sk_X509_num(roots) > 0) {
         X509 *r = sk_X509_pop(roots);
         X509_STORE *s = X509_STORE_new();
@@ -574,7 +575,7 @@ void info_cb(const SSL *s, int where, int ret) {
 tlsuv_engine_t new_openssl_engine(void *ctx, const char *host) {
     struct openssl_ctx *context = ctx;
 
-    struct openssl_engine *engine = calloc(1, sizeof(struct openssl_engine));
+    struct openssl_engine *engine = tlsuv_calloc(1, sizeof(struct openssl_engine));
     engine->api = openssl_engine_api;
 
     engine->ssl = SSL_new(context->ctx);
@@ -618,7 +619,7 @@ static void set_protocols(tlsuv_engine_t self, const char** protocols, int len)
         protolen += strlen(protocols[i]) + 1;
     }
 
-    unsigned char *alpn_protocols = malloc(protolen + 1);
+    unsigned char *alpn_protocols = tlsuv_malloc(protolen + 1);
     unsigned char *p = alpn_protocols;
     for (int i=0; i < len; i++) {
         size_t plen = strlen(protocols[i]);
@@ -628,7 +629,7 @@ static void set_protocols(tlsuv_engine_t self, const char** protocols, int len)
     }
     *p = 0;
     SSL_set_alpn_protos(e->ssl, alpn_protocols, strlen((char*)alpn_protocols));
-    free(alpn_protocols);
+    tlsuv_free(alpn_protocols);
 }
 
 static int cert_verify_cb(X509_STORE_CTX *certs, void *ctx) {
@@ -678,7 +679,7 @@ static int tls_verify_signature(void *cert, enum hash_algo md, const char* data,
 static void tls_free_ctx(tls_context *ctx) {
     struct openssl_ctx *c = (struct openssl_ctx*)ctx;
     if (c->alpn_protocols) {
-        free(c->alpn_protocols);
+        tlsuv_free(c->alpn_protocols);
     }
     if (c->own_key) {
         c->own_key->free((struct tlsuv_private_key_s *) c->own_key);
@@ -689,10 +690,10 @@ static void tls_free_ctx(tls_context *ctx) {
         for (int i = 0; i < c->ca_chains_count; i++) {
             X509_STORE_free(c->ca_chains[i]);
         }
-        free(c->ca_chains);
+        tlsuv_free(c->ca_chains);
     }
     SSL_CTX_free(c->ctx);
-    free(c);
+    tlsuv_free(c);
 }
 
 static int tls_reset(tlsuv_engine_t self) {
@@ -714,9 +715,9 @@ static void tls_free(tlsuv_engine_t self) {
     SSL_free(e->ssl);
 
     if (e->alpn) {
-        free(e->alpn);
+        tlsuv_free(e->alpn);
     }
-    free(e);
+    tlsuv_free(e);
 }
 
 static void tls_free_cert(tls_cert *cert) {
@@ -886,7 +887,7 @@ static const char* tls_get_alpn(tlsuv_engine_t self) {
     unsigned int protolen;
     SSL_get0_alpn_selected(eng->ssl, &proto, &protolen);
 
-    eng->alpn = calloc(1, protolen + 1);
+    eng->alpn = tlsuv_calloc(1, protolen + 1);
     strncpy(eng->alpn, (const char*)proto, protolen);
     return eng->alpn;
 }
@@ -1024,7 +1025,7 @@ static int write_cert_pem(tls_cert cert, int full_chain, char **pem, size_t *pem
     }
 
     *pemlen = BIO_ctrl_pending(pembio);
-    *pem = calloc(1, *pemlen + 1);
+    *pem = tlsuv_calloc(1, *pemlen + 1);
     BIO_read(pembio, *pem, (int)*pemlen);
 
     BIO_free_all(pembio);
@@ -1070,7 +1071,7 @@ goto on_error;            \
         UM_LOG(WARN, "%s => %s", op, tls_error(ret));
     } else {
         size_t len = BIO_ctrl_pending(b);
-        *pem = calloc(1, len + 1);
+        *pem = tlsuv_calloc(1, len + 1);
         BIO_read(b, *pem, (int)len);
         if (pemlen) {
             *pemlen = len;
diff --git a/src/tls_link.c b/src/tls_link.c
index 712633f6..7e2eb076 100644
--- a/src/tls_link.c
+++ b/src/tls_link.c
@@ -16,6 +16,7 @@
 #include <uv_link_t.h>
 #include <tlsuv/tls_engine.h>
 #include "tlsuv/tls_link.h"
+#include "common.h"
 #include "um_debug.h"
 #include "util.h"
 #include <string.h>
@@ -199,8 +200,8 @@ static void tls_link_io_write_cb(uv_link_t *l, int status, void *data) {
     if (req->cb) {
         req->cb(l, status, req->ctx);
     }
-    free(req->b);
-    free(req);
+    tlsuv_free(req->b);
+    tlsuv_free(req);
 }
 
 static void tls_link_flush_io(tls_link_t *tls, uv_link_write_cb cb, void *ctx) {
@@ -211,8 +212,8 @@ static void tls_link_flush_io(tls_link_t *tls, uv_link_write_cb cb, void *ctx) {
     WAB_GET_SPACE(*tls->ssl_out, p, len);
     while (len > 0) {
         if (req == NULL) {
-            req = calloc(1, sizeof(struct flush_req));
-            req->b = malloc(TLS_BUF_SZ);
+            req = tlsuv_calloc(1, sizeof(struct flush_req));
+            req->b = tlsuv_malloc(TLS_BUF_SZ);
         }
         memcpy(req->b + total, p, len);
         total += len;
@@ -286,9 +287,9 @@ static ssize_t tls_link_io_read(io_ctx ctx, char *data, size_t max) {
 int tlsuv_tls_link_init(tls_link_t *tls, tlsuv_engine_t engine, tls_handshake_cb cb) {
     uv_link_init((uv_link_t *) tls, &tls_methods);
     tls->engine = engine;
-    tls->ssl_in = malloc(sizeof(ssl_buf_t));
+    tls->ssl_in = tlsuv_malloc(sizeof(ssl_buf_t));
     WAB_INIT(*tls->ssl_in);
-    tls->ssl_out = malloc(sizeof(ssl_buf_t));
+    tls->ssl_out = tlsuv_malloc(sizeof(ssl_buf_t));
     WAB_INIT(*tls->ssl_out);
 
     engine->set_io(engine, tls, tls_link_io_read, tls_link_io_write);
@@ -298,9 +299,9 @@ int tlsuv_tls_link_init(tls_link_t *tls, tlsuv_engine_t engine, tls_handshake_cb
 
 void tlsuv_tls_link_free(tls_link_t *tls) {
     if (tls) {
-        free(tls->ssl_out);
+        tlsuv_free(tls->ssl_out);
         tls->ssl_out = NULL;
-        free(tls->ssl_in);
+        tlsuv_free(tls->ssl_in);
         tls->ssl_in = NULL;
     }
 }
diff --git a/src/tlsuv.c b/src/tlsuv.c
index 963e24c2..494115dd 100644
--- a/src/tlsuv.c
+++ b/src/tlsuv.c
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include "common.h"
 #include "tlsuv/tlsuv.h"
 #include "um_debug.h"
 #include "util.h"
@@ -197,7 +198,7 @@ const char* tlsuv_stream_get_protocol(tlsuv_stream_t *clt) {
 }
 
 int tlsuv_stream_set_hostname(tlsuv_stream_t *clt, const char *host) {
-    free (clt->host);
+    tlsuv_free (clt->host);
     clt->host = strdup(host);
     return 0;
 }
@@ -290,7 +291,7 @@ static void fail_pending_reqs(tlsuv_stream_t *clt, int err) {
         if (req->wr->cb) {
             req->wr->cb(req->wr, (int) err);
         }
-        free(req);
+        tlsuv_free(req);
     }
 }
 
@@ -317,7 +318,7 @@ static void process_outbound(tlsuv_stream_t *clt) {
             if (req->wr->cb) {
                 req->wr->cb(req->wr, 0);
             }
-            free(req);
+            tlsuv_free(req);
             continue;
         }
 
@@ -490,7 +491,7 @@ static void on_resolve(uv_getaddrinfo_t *req, int status, struct addrinfo *addr)
         }
     }
     uv_freeaddrinfo(addr);
-    free(req);
+    tlsuv_free(req);
 }
 
 int tlsuv_stream_connect(uv_connect_t *req, tlsuv_stream_t *clt, const char *host, int port, uv_connect_cb cb) {
@@ -513,7 +514,7 @@ int tlsuv_stream_connect(uv_connect_t *req, tlsuv_stream_t *clt, const char *hos
     tlsuv_stream_set_hostname(clt, host);
     clt->conn_req = req;
 
-    clt->resolve_req = calloc(1, sizeof(uv_getaddrinfo_t));
+    clt->resolve_req = tlsuv_calloc(1, sizeof(uv_getaddrinfo_t));
     clt->resolve_req->data = clt;
     struct addrinfo hints = {
             .ai_socktype = SOCK_STREAM,
@@ -540,7 +541,7 @@ int tlsuv_stream_read_start(tlsuv_stream_t *clt, uv_alloc_cb alloc_cb, uv_read_c
     } else {
         // schedule idle read (if nothing on the wire)
         // in case reading was stopped with data buffered in TLS engine
-        uv_idle_t *idle = calloc(1, sizeof(*idle));
+        uv_idle_t *idle = tlsuv_calloc(1, sizeof(*idle));
         clt->watcher.data = idle;
         uv_idle_init(clt->loop, idle);
         idle->data = clt;
@@ -602,7 +603,7 @@ int tlsuv_stream_write(uv_write_t *req, tlsuv_stream_t *clt, uv_buf_t *buf, uv_w
     }
 
     // queue request or whatever left
-    tlsuv_write_t *wr = malloc(sizeof(*wr));
+    tlsuv_write_t *wr = tlsuv_malloc(sizeof(*wr));
     wr->wr = req;
     wr->buf = uv_buf_init(buf->base + count, buf->len - count);
     clt->queue_len += 1;
@@ -614,7 +615,7 @@ int tlsuv_stream_write(uv_write_t *req, tlsuv_stream_t *clt, uv_buf_t *buf, uv_w
 
 int tlsuv_stream_free(tlsuv_stream_t *clt) {
     if (clt->host) {
-        free(clt->host);
+        tlsuv_free(clt->host);
         clt->host = NULL;
     }
     if (clt->tls_engine) {
diff --git a/src/websocket.c b/src/websocket.c
index 1a7af48f..c042c1be 100644
--- a/src/websocket.c
+++ b/src/websocket.c
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include "common.h"
 #include "tlsuv/websocket.h"
 #include "http_req.h"
 #include "portable_endian.h"
@@ -67,7 +68,7 @@ int tlsuv_websocket_init_with_src(uv_loop_t *loop, tlsuv_websocket_t *ws, tlsuv_
     ws->loop = loop;
     ws->type = UV_IDLE;
     ws->src = src;
-    ws->req = calloc(1, sizeof(tlsuv_http_req_t));
+    ws->req = tlsuv_calloc(1, sizeof(tlsuv_http_req_t));
 
     char randbuf[24];
     uv_random(NULL, NULL, randbuf, sizeof(randbuf), 0, NULL);
@@ -169,7 +170,7 @@ int tlsuv_websocket_connect(uv_connect_t *req, tlsuv_websocket_t *ws, const char
 
     http_req_init(ws->req, "GET", path);
     if (path != DEFAULT_PATH) {
-        free((char*)path);
+        tlsuv_free((char*)path);
     }
     set_http_header(&ws->req->req_headers, "host", host);
 
@@ -195,7 +196,7 @@ int tlsuv_websocket_write(uv_write_t *req, tlsuv_websocket_t *ws, uv_buf_t *buf,
     }
     uint8_t mask[4];
     uv_random(NULL, NULL, mask, sizeof(mask), 0, NULL);
-    char *frame = malloc(headerlen + buf->len);
+    char *frame = tlsuv_malloc(headerlen + buf->len);
 
     frame[0] = WS_FIN | OpCode_BIN;
     char *ptr = frame + 1;
@@ -222,9 +223,9 @@ int tlsuv_websocket_write(uv_write_t *req, tlsuv_websocket_t *ws, uv_buf_t *buf,
     bufs.len = headerlen + buf->len;
     bufs.base = frame;
 
-    ws_write_t *ws_wreq = calloc(1, sizeof(ws_write_t));
+    ws_write_t *ws_wreq = tlsuv_calloc(1, sizeof(ws_write_t));
     ws_wreq->wr = req;
-    ws_wreq->bufs = malloc(sizeof(uv_buf_t));
+    ws_wreq->bufs = tlsuv_malloc(sizeof(uv_buf_t));
     ws_wreq->bufs[0] = bufs;
     ws_wreq->nbufs = 1;
     ws_wreq->cb = cb;
@@ -273,10 +274,10 @@ static void ws_write_cb(uv_link_t *l, int nwrote, void *data) {
         ws_wreq->cb(wr, nwrote);
     }
     for (int i=0; i < ws_wreq->nbufs; i++) {
-        free(ws_wreq->bufs[i].base);
+        tlsuv_free(ws_wreq->bufs[i].base);
     }
-    free(ws_wreq->bufs);
-    free(ws_wreq);
+    tlsuv_free(ws_wreq->bufs);
+    tlsuv_free(ws_wreq);
 }
 
 int ws_read_start(uv_link_t *l) {
@@ -285,13 +286,13 @@ int ws_read_start(uv_link_t *l) {
 
     tlsuv_websocket_t *ws = l->data;
     uv_buf_t buf;
-    buf.base = malloc(8196);
+    buf.base = tlsuv_malloc(8196);
     buf.len = http_req_write(ws->req, buf.base, 8196);
 
     UM_LOG(VERB, "starting WebSocket handshake(sending %zd bytes)[%.*s]", buf.len, (int)buf.len, buf.base);
 
-    ws_write_t *ws_wreq = calloc(1, sizeof(ws_write_t));
-    ws_wreq->bufs = malloc(sizeof(uv_buf_t));
+    ws_write_t *ws_wreq = tlsuv_calloc(1, sizeof(ws_write_t));
+    ws_wreq->bufs = tlsuv_malloc(sizeof(uv_buf_t));
     ws_wreq->bufs[0] = buf;
     ws_wreq->nbufs = 1;
 
@@ -320,7 +321,7 @@ void ws_read_cb(uv_link_t *l, ssize_t nread, const uv_buf_t *buf) {
             UM_LOG(ERR, "failed to parse connect/upgrade response");
             ws->conn_req->cb(ws->conn_req, -1);
             http_req_free(ws->req);
-            free(ws->req);
+            tlsuv_free(ws->req);
             ws->req = NULL;
             failed = true;
         } else {
@@ -336,14 +337,14 @@ void ws_read_cb(uv_link_t *l, ssize_t nread, const uv_buf_t *buf) {
                 }
                 ws->conn_req = NULL;
                 http_req_free(ws->req);
-                free(ws->req);
+                tlsuv_free(ws->req);
                 ws->req = NULL;
             }
         }
     }
 
     if (failed || processed == nread) {
-        free(buf->base);
+        tlsuv_free(buf->base);
         return;
     }
 
@@ -393,7 +394,7 @@ void ws_read_cb(uv_link_t *l, ssize_t nread, const uv_buf_t *buf) {
             UM_LOG(INFO, "got unsupported frame %hd", op);
     }
 
-    free(buf->base);
+    tlsuv_free(buf->base);
 }
 
 static void send_pong(tlsuv_websocket_t *ws, const char* ping_data, int len) {
@@ -401,7 +402,7 @@ static void send_pong(tlsuv_websocket_t *ws, const char* ping_data, int len) {
     uint8_t mask[4];
     uv_buf_t buf;
     buf.len = 2 + sizeof(mask) + len;
-    buf.base = malloc(buf.len);
+    buf.base = tlsuv_malloc(buf.len);
 
     buf.base[0] = WS_FIN | OpCode_Pong;
     buf.base[1] = (char)(WS_MASK | (0x7f & len));
@@ -417,8 +418,8 @@ static void send_pong(tlsuv_websocket_t *ws, const char* ping_data, int len) {
         }
     }
 
-    ws_write_t *ws_wreq = calloc(1, sizeof(ws_write_t));
-    ws_wreq->bufs = malloc(sizeof(uv_buf_t));
+    ws_write_t *ws_wreq = tlsuv_calloc(1, sizeof(ws_write_t));
+    ws_wreq->bufs = tlsuv_malloc(sizeof(uv_buf_t));
     ws_wreq->bufs[0] = buf;
     ws_wreq->nbufs = 1;
 
@@ -430,11 +431,11 @@ static void on_ws_close(tlsuv_websocket_t *ws) {
 
     if (ws->req) {
         http_req_free(ws->req);
-        free(ws->req);
+        tlsuv_free(ws->req);
         ws->req = NULL;
     }
     if (ws->host) {
-        free(ws->host);
+        tlsuv_free(ws->host);
         ws->host = NULL;
     }
     if (ws->tls && ws->tls_link.engine) {
diff --git a/src/win32_compat.h b/src/win32_compat.h
index 409ffc15..fca7a0d0 100644
--- a/src/win32_compat.h
+++ b/src/win32_compat.h
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#include "common.h"
 
 #ifndef UV_MBED_WIN32_COMPAT_H
 #define UV_MBED_WIN32_COMPAT_H
@@ -25,7 +26,7 @@
 #if !defined (strndup_DEFINED)
 #define strndup_DEFINED
 static char* strndup(const char* p, size_t len) {
-    char *s = malloc(len + 1);
+    char *s = tlsuv_malloc(len + 1);
     strncpy(s, p, len);
     s[len] = '\0';
     return s;