diff --git a/boilerplate/cairo-boilerplate-cogl.c b/boilerplate/cairo-boilerplate-cogl.c
index e39ad333d..e31dffa9b 100644
--- a/boilerplate/cairo-boilerplate-cogl.c
+++ b/boilerplate/cairo-boilerplate-cogl.c
@@ -92,7 +92,7 @@ _cairo_boilerplate_cogl_create_offscreen_color_surface (const char		*name,
                 -1, 100);
     cogl_pop_framebuffer ();
 
-    closure = malloc (sizeof (cogl_closure_t));
+    closure = _cairo_malloc (sizeof (cogl_closure_t));
     *abstract_closure = closure;
     closure->device = device;
     closure->fb = fb;
@@ -138,7 +138,7 @@ _cairo_boilerplate_cogl_create_onscreen_color_surface (const char	       *name,
                 -1, 100);
     cogl_pop_framebuffer ();
 
-    closure = malloc (sizeof (cogl_closure_t));
+    closure = _cairo_malloc (sizeof (cogl_closure_t));
     *abstract_closure = closure;
     closure->device = device;
     closure->fb = fb;
diff --git a/boilerplate/cairo-boilerplate-system.c b/boilerplate/cairo-boilerplate-system.c
index ec23341a4..b3f92fa7b 100644
--- a/boilerplate/cairo-boilerplate-system.c
+++ b/boilerplate/cairo-boilerplate-system.c
@@ -44,7 +44,7 @@ xmalloc (size_t size)
     if (size == 0)
 	return NULL;
 
-    buf = malloc (size);
+    buf = _cairo_malloc (size);
     if (buf == NULL) {
 	fprintf (stderr, "Error: Out of memory. Exiting.\n");
 	exit (1);
@@ -117,7 +117,7 @@ xasprintf (char       **strp,
     }
 
     len = (ret + sizeof (int)) & -sizeof (int);
-    *strp = malloc (len);
+    *strp = _cairo_malloc (len);
     if (*strp == NULL) {
 	fprintf (stderr, "Out of memory\n");
 	exit (1);
diff --git a/boilerplate/cairo-boilerplate-vg.c b/boilerplate/cairo-boilerplate-vg.c
index 692765745..ee4ba4aaf 100644
--- a/boilerplate/cairo-boilerplate-vg.c
+++ b/boilerplate/cairo-boilerplate-vg.c
@@ -105,7 +105,7 @@ _cairo_boilerplate_vg_create_surface_glx (const char		    *name,
     cairo_vg_context_t *context;
     vg_closure_glx_t *vgc;
 
-    vgc = malloc (sizeof (vg_closure_glx_t));
+    vgc = _cairo_malloc (sizeof (vg_closure_glx_t));
     *closure = vgc;
 
     if (width == 0)
diff --git a/boilerplate/cairo-boilerplate-win32-printing.c b/boilerplate/cairo-boilerplate-win32-printing.c
index 625d52c53..7d7649543 100644
--- a/boilerplate/cairo-boilerplate-win32-printing.c
+++ b/boilerplate/cairo-boilerplate-win32-printing.c
@@ -131,7 +131,7 @@ create_printer_dc (win32_target_closure_t *ptc)
 
     ptc->dc = NULL;
     GetDefaultPrinter (NULL, &size);
-    printer_name = malloc (size);
+    printer_name = _cairo_malloc (size);
 
     if (printer_name == NULL)
 	return;
diff --git a/boilerplate/cairo-boilerplate-xcb.c b/boilerplate/cairo-boilerplate-xcb.c
index cc9b422e9..1de28194b 100644
--- a/boilerplate/cairo-boilerplate-xcb.c
+++ b/boilerplate/cairo-boilerplate-xcb.c
@@ -206,7 +206,7 @@ _cairo_boilerplate_xcb_create_similar (cairo_surface_t *other,
     xcb_render_pictforminfo_t *render_format;
     int depth;
 
-    similar = malloc (sizeof (*similar));
+    similar = _cairo_malloc (sizeof (*similar));
 
     switch (content) {
     default:
diff --git a/boilerplate/cairo-boilerplate-xlib.c b/boilerplate/cairo-boilerplate-xlib.c
index f3d559806..e13d81cc6 100644
--- a/boilerplate/cairo-boilerplate-xlib.c
+++ b/boilerplate/cairo-boilerplate-xlib.c
@@ -244,7 +244,7 @@ _cairo_boilerplate_xlib_create_similar (cairo_surface_t		*other,
     struct similar *similar;
     cairo_surface_t *surface;
 
-    similar = malloc (sizeof (*similar));
+    similar = _cairo_malloc (sizeof (*similar));
     similar->dpy = cairo_xlib_surface_get_display (other);
 
     switch (content) {
diff --git a/boilerplate/cairo-boilerplate.c b/boilerplate/cairo-boilerplate.c
index 4804deaff..ac8929a60 100644
--- a/boilerplate/cairo-boilerplate.c
+++ b/boilerplate/cairo-boilerplate.c
@@ -183,7 +183,7 @@ _cairo_boilerplate_image_create_similar (cairo_surface_t *other,
     }
 
     stride = cairo_format_stride_for_width(format, width);
-    ptr = malloc (stride* height);
+    ptr = _cairo_malloc (stride* height);
 
     surface = cairo_image_surface_create_for_data (ptr, format,
 						   width, height, stride);
@@ -232,7 +232,7 @@ _cairo_boilerplate_image16_create_similar (cairo_surface_t *other,
     }
 
     stride = cairo_format_stride_for_width(format, width);
-    ptr = malloc (stride* height);
+    ptr = _cairo_malloc (stride* height);
 
     surface = cairo_image_surface_create_for_data (ptr, format,
 						   width, height, stride);
diff --git a/doc/tutorial/src/include/cairo-tutorial-pdf.h b/doc/tutorial/src/include/cairo-tutorial-pdf.h
index 00d0f188e..a000b63e3 100644
--- a/doc/tutorial/src/include/cairo-tutorial-pdf.h
+++ b/doc/tutorial/src/include/cairo-tutorial-pdf.h
@@ -51,7 +51,7 @@ main (int argc, char **argv)
 	*dash = '.';
     } else {
 	char *new_filename;
-	new_filename = malloc (strlen (filename) + 5);
+	new_filename = _cairo_malloc (strlen (filename) + 5);
 	sprintf (new_filename, "%s.pdf", filename);
 	free (filename);
 	filename = new_filename;
diff --git a/doc/tutorial/src/include/cairo-tutorial-png.h b/doc/tutorial/src/include/cairo-tutorial-png.h
index 428baf294..7d6c0ece4 100644
--- a/doc/tutorial/src/include/cairo-tutorial-png.h
+++ b/doc/tutorial/src/include/cairo-tutorial-png.h
@@ -57,7 +57,7 @@ main (int argc, char **argv)
 	*dash = '.';
     } else {
 	char *new_filename;
-	new_filename = malloc (strlen (filename) + 5);
+	new_filename = _cairo_malloc (strlen (filename) + 5);
 	sprintf (new_filename, "%s.png", filename);
 	free (filename);
 	filename = new_filename;
diff --git a/perf/cairo-perf-trace.c b/perf/cairo-perf-trace.c
index 02e0e29f9..075e84352 100644
--- a/perf/cairo-perf-trace.c
+++ b/perf/cairo-perf-trace.c
@@ -278,7 +278,7 @@ _similar_surface_create (void		 *closure,
     }
 
     surface = args->target->create_similar (args->surface, content, width, height);
-    s = malloc (sizeof (struct scache));
+    s = _cairo_malloc (sizeof (struct scache));
     if (s == NULL)
 	return surface;
 
diff --git a/perf/cairo-stats.c b/perf/cairo-stats.c
index aee9fe8b5..81da4afa0 100644
--- a/perf/cairo-stats.c
+++ b/perf/cairo-stats.c
@@ -111,7 +111,7 @@ _cairo_histogram_init (cairo_histogram_t *h,
 
     h->num_columns = width - 2;
     h->num_rows = height - 1;
-    h->columns = malloc (sizeof(int)*h->num_columns);
+    h->columns = _cairo_malloc (sizeof(int)*h->num_columns);
     return h->columns != NULL;
 }
 
diff --git a/perf/dirent-win32.h b/perf/dirent-win32.h
index 0f2ed05e5..3488f5fe0 100644
--- a/perf/dirent-win32.h
+++ b/perf/dirent-win32.h
@@ -50,7 +50,7 @@ opendir(const char *dirname)
 {
     DIR *dirp;
 
-    dirp = malloc (sizeof (*dirp));
+    dirp = _cairo_malloc (sizeof (*dirp));
     if (unlikely (dirp == NULL))
 	return NULL;
 
diff --git a/src/cairo-analysis-surface.c b/src/cairo-analysis-surface.c
index c07e068f9..6ee13a92e 100644
--- a/src/cairo-analysis-surface.c
+++ b/src/cairo-analysis-surface.c
@@ -118,7 +118,7 @@ attach_proxy (cairo_surface_t *source,
 {
     struct proxy *proxy;
 
-    proxy = malloc (sizeof (*proxy));
+    proxy = _cairo_malloc (sizeof (*proxy));
     if (unlikely (proxy == NULL))
 	return _cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -830,7 +830,7 @@ _cairo_analysis_surface_create (cairo_surface_t		*target)
     if (unlikely (status))
 	return _cairo_surface_create_in_error (status);
 
-    surface = malloc (sizeof (cairo_analysis_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_analysis_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1020,7 +1020,7 @@ _cairo_null_surface_create (cairo_content_t content)
 {
     cairo_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_surface_t));
     if (unlikely (surface == NULL)) {
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
     }
diff --git a/src/cairo-base64-stream.c b/src/cairo-base64-stream.c
index 636431372..6352545f7 100644
--- a/src/cairo-base64-stream.c
+++ b/src/cairo-base64-stream.c
@@ -125,7 +125,7 @@ _cairo_base64_stream_create (cairo_output_stream_t *output)
     if (output->status)
 	return _cairo_output_stream_create_in_error (output->status);
 
-    stream = malloc (sizeof (cairo_base64_stream_t));
+    stream = _cairo_malloc (sizeof (cairo_base64_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
diff --git a/src/cairo-base85-stream.c b/src/cairo-base85-stream.c
index f81affb49..3202f1e5f 100644
--- a/src/cairo-base85-stream.c
+++ b/src/cairo-base85-stream.c
@@ -114,7 +114,7 @@ _cairo_base85_stream_create (cairo_output_stream_t *output)
     if (output->status)
 	return _cairo_output_stream_create_in_error (output->status);
 
-    stream = malloc (sizeof (cairo_base85_stream_t));
+    stream = _cairo_malloc (sizeof (cairo_base85_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
diff --git a/src/cairo-beos-surface.cpp b/src/cairo-beos-surface.cpp
index c97641685..42fcc93fa 100644
--- a/src/cairo-beos-surface.cpp
+++ b/src/cairo-beos-surface.cpp
@@ -915,9 +915,9 @@ _cairo_beos_surface_create_internal (BView*   view,
 				     BBitmap* bmp,
 				     bool     owns_bitmap_view)
 {
-    // Must use malloc, because cairo code will use free() on the surface
+    // Must use _cairo_malloc, because cairo code will use free() on the surface
     cairo_beos_surface_t *surface = static_cast<cairo_beos_surface_t*>(
-					malloc(sizeof(cairo_beos_surface_t)));
+					_cairo_malloc(sizeof(cairo_beos_surface_t)));
     if (surface == NULL) {
 	_cairo_error (CAIRO_STATUS_NO_MEMORY);
         return const_cast<cairo_surface_t*>(&_cairo_surface_nil);
diff --git a/src/cairo-cff-subset.c b/src/cairo-cff-subset.c
index 13fee5058..37727eddb 100644
--- a/src/cairo-cff-subset.c
+++ b/src/cairo-cff-subset.c
@@ -547,7 +547,7 @@ cff_index_append_copy (cairo_array_t *index,
 
     element.length = length;
     element.is_copy = TRUE;
-    element.data = malloc (element.length);
+    element.data = _cairo_malloc (element.length);
     if (unlikely (element.data == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -610,12 +610,12 @@ cff_dict_create_operator (int            operator,
 {
     cff_dict_operator_t *op;
 
-    op = malloc (sizeof (cff_dict_operator_t));
+    op = _cairo_malloc (sizeof (cff_dict_operator_t));
     if (unlikely (op == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     _cairo_dict_init_key (op, operator);
-    op->operand = malloc (size);
+    op->operand = _cairo_malloc (size);
     if (unlikely (op->operand == NULL)) {
         free (op);
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
@@ -716,7 +716,7 @@ cff_dict_set_operands (cairo_hash_table_t *dict,
     op = _cairo_hash_table_lookup (dict, &key.base);
     if (op != NULL) {
         free (op->operand);
-        op->operand = malloc (size);
+        op->operand = _cairo_malloc (size);
 	if (unlikely (op->operand == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -870,7 +870,7 @@ cairo_cff_font_read_name (cairo_cff_font_t *font)
 		len -= 7;
 	    }
 	}
-        font->ps_name = malloc (len + 1);
+        font->ps_name = _cairo_malloc (len + 1);
         if (unlikely (font->ps_name == NULL))
             return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1858,7 +1858,7 @@ cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
     cairo_status_t status;
 
     font->num_fontdicts = 1;
-    font->fd_dict = malloc (sizeof (cairo_hash_table_t *));
+    font->fd_dict = _cairo_malloc (sizeof (cairo_hash_table_t *));
     if (unlikely (font->fd_dict == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1869,11 +1869,11 @@ cairo_cff_font_create_cid_fontdict (cairo_cff_font_t *font)
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
 
-    font->fd_subset_map = malloc (sizeof (int));
+    font->fd_subset_map = _cairo_malloc (sizeof (int));
     if (unlikely (font->fd_subset_map == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
-    font->private_dict_offset = malloc (sizeof (int));
+    font->private_dict_offset = _cairo_malloc (sizeof (int));
     if (unlikely (font->private_dict_offset == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1968,7 +1968,7 @@ cairo_cff_font_subset_font (cairo_cff_font_t  *font)
 	if (unlikely (status))
 	    return status;
     }  else {
-	font->private_dict_offset = malloc (sizeof (int));
+	font->private_dict_offset = _cairo_malloc (sizeof (int));
 	if (unlikely (font->private_dict_offset == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
@@ -2560,7 +2560,7 @@ cairo_cff_font_generate (cairo_cff_font_t  *font,
 
     /* If the PS name is not found, create a CairoFont-x-y name. */
     if (font->ps_name == NULL) {
-        font->ps_name = malloc (30);
+        font->ps_name = _cairo_malloc (30);
         if (unlikely (font->ps_name == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -2710,7 +2710,7 @@ _cairo_cff_font_load_opentype_cff (cairo_cff_font_t  *font)
 
     font->is_opentype = TRUE;
     font->data_length = data_length;
-    font->data = malloc (data_length);
+    font->data = _cairo_malloc (data_length);
     if (unlikely (font->data == NULL))
         return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -2745,7 +2745,7 @@ _cairo_cff_font_load_cff (cairo_cff_font_t  *font)
     font->font_name = NULL;
     font->is_opentype = FALSE;
     font->data_length = data_length;
-    font->data = malloc (data_length);
+    font->data = _cairo_malloc (data_length);
     if (unlikely (font->data == NULL))
         return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -2981,7 +2981,7 @@ _cairo_cff_subset_init (cairo_cff_subset_t          *cff_subset,
     cff_subset->ascent = (double)font->ascent/font->units_per_em;
     cff_subset->descent = (double)font->descent/font->units_per_em;
 
-    cff_subset->data = malloc (length);
+    cff_subset->data = _cairo_malloc (length);
     if (unlikely (cff_subset->data == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto fail4;
@@ -3040,7 +3040,7 @@ _cairo_cff_scaled_font_is_cid_cff (cairo_scaled_font_t *scaled_font)
 	(status = backend->load_truetype_table (scaled_font, TT_TAG_CFF,
 						0, NULL, &data_length)) == CAIRO_INT_STATUS_SUCCESS)
     {
-	data = malloc (data_length);
+	data = _cairo_malloc (data_length);
 	if (unlikely (data == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    return FALSE;
@@ -3057,7 +3057,7 @@ _cairo_cff_scaled_font_is_cid_cff (cairo_scaled_font_t *scaled_font)
 	(status = backend->load_type1_data (scaled_font,
 					    0, NULL, &data_length)) == CAIRO_INT_STATUS_SUCCESS)
     {
-	data = malloc (data_length);
+	data = _cairo_malloc (data_length);
 	if (unlikely (data == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    return FALSE;
@@ -3130,7 +3130,7 @@ _cairo_cff_font_fallback_create (cairo_scaled_font_subset_t  *scaled_font_subset
     cairo_status_t status;
     cairo_cff_font_t *font;
 
-    font = malloc (sizeof (cairo_cff_font_t));
+    font = _cairo_malloc (sizeof (cairo_cff_font_t));
     if (unlikely (font == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -3316,7 +3316,7 @@ cairo_cff_font_fallback_generate (cairo_cff_font_t           *font,
 	if (unlikely (status))
 	    return status;
     } else {
-	font->private_dict_offset = malloc (sizeof (int));
+	font->private_dict_offset = _cairo_malloc (sizeof (int));
 	if (unlikely (font->private_dict_offset == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
@@ -3393,7 +3393,7 @@ _cairo_cff_fallback_init (cairo_cff_subset_t          *cff_subset,
     cff_subset->ascent = (double)type2_subset.y_max/1000;
     cff_subset->descent = (double)type2_subset.y_min/1000;
 
-    cff_subset->data = malloc (length);
+    cff_subset->data = _cairo_malloc (length);
     if (unlikely (cff_subset->data == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto fail4;
diff --git a/src/cairo-clip-tor-scan-converter.c b/src/cairo-clip-tor-scan-converter.c
index e32a5a9d9..454595821 100644
--- a/src/cairo-clip-tor-scan-converter.c
+++ b/src/cairo-clip-tor-scan-converter.c
@@ -242,7 +242,7 @@ struct _pool_chunk {
 /* A memory pool.  This is supposed to be embedded on the stack or
  * within some other structure.	 It may optionally be followed by an
  * embedded array from which requests are fulfilled until
- * malloc needs to be called to allocate a first real chunk. */
+ * _cairo_malloc needs to be called to allocate a first real chunk. */
 struct pool {
     /* Chunk we're allocating from. */
     struct _pool_chunk *current;
@@ -465,7 +465,7 @@ _pool_chunk_create(struct pool *pool, size_t size)
 {
     struct _pool_chunk *p;
 
-    p = malloc(size + sizeof(struct _pool_chunk));
+    p = _cairo_malloc(size + sizeof(struct _pool_chunk));
     if (unlikely (NULL == p))
 	longjmp (*pool->jmp, _cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-clip.c b/src/cairo-clip.c
index 0df9b06bf..d499bf0ad 100644
--- a/src/cairo-clip.c
+++ b/src/cairo-clip.c
@@ -62,7 +62,7 @@ _cairo_clip_path_create (cairo_clip_t *clip)
 
     clip_path = _freed_pool_get (&clip_path_pool);
     if (unlikely (clip_path == NULL)) {
-	clip_path = malloc (sizeof (cairo_clip_path_t));
+	clip_path = _cairo_malloc (sizeof (cairo_clip_path_t));
 	if (unlikely (clip_path == NULL))
 	    return NULL;
     }
@@ -108,7 +108,7 @@ _cairo_clip_create (void)
 
     clip = _freed_pool_get (&clip_pool);
     if (unlikely (clip == NULL)) {
-	clip = malloc (sizeof (cairo_clip_t));
+	clip = _cairo_malloc (sizeof (cairo_clip_t));
 	if (unlikely (clip == NULL))
 	    return NULL;
     }
@@ -735,7 +735,7 @@ _cairo_rectangle_list_create_in_error (cairo_status_t status)
     if (status == CAIRO_STATUS_CLIP_NOT_REPRESENTABLE)
 	return (cairo_rectangle_list_t*) &_cairo_rectangles_not_representable;
 
-    list = malloc (sizeof (*list));
+    list = _cairo_malloc (sizeof (*list));
     if (unlikely (list == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_rectangle_list_t*) &_cairo_rectangles_nil;
@@ -795,7 +795,7 @@ _cairo_clip_copy_rectangle_list (cairo_clip_t *clip, cairo_gstate_t *gstate)
     }
 
  DONE:
-    list = malloc (sizeof (cairo_rectangle_list_t));
+    list = _cairo_malloc (sizeof (cairo_rectangle_list_t));
     if (unlikely (list == NULL)) {
         free (rectangles);
 	return ERROR_LIST (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-cogl-context.c b/src/cairo-cogl-context.c
index 0116b0a5a..c32278057 100644
--- a/src/cairo-cogl-context.c
+++ b/src/cairo-cogl-context.c
@@ -755,7 +755,7 @@ _cairo_cogl_context_create (void *target)
 
     cr = _freed_pool_get (&context_pool);
     if (unlikely (cr == NULL)) {
-	cr = malloc (sizeof (cairo_cogl_context_t));
+	cr = _cairo_malloc (sizeof (cairo_cogl_context_t));
 	if (unlikely (cr == NULL))
 	    return _cairo_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
     }
diff --git a/src/cairo-cogl-gradient.c b/src/cairo-cogl-gradient.c
index f8c800416..0923e3b6d 100644
--- a/src/cairo-cogl-gradient.c
+++ b/src/cairo-cogl-gradient.c
@@ -397,7 +397,7 @@ _cairo_cogl_get_linear_gradient (cairo_cogl_device_t *device,
     }
 
     if (!gradient) {
-	gradient = malloc (sizeof (cairo_cogl_linear_gradient_t) +
+	gradient = _cairo_malloc (sizeof (cairo_cogl_linear_gradient_t) +
 			   sizeof (cairo_gradient_stop_t) * (n_stops - 1));
 	if (!gradient)
 	    return CAIRO_INT_STATUS_NO_MEMORY;
@@ -413,7 +413,7 @@ _cairo_cogl_get_linear_gradient (cairo_cogl_device_t *device,
     } else
 	_cairo_cogl_linear_gradient_reference (gradient);
 
-    entry = malloc (sizeof (cairo_cogl_linear_texture_entry_t));
+    entry = _cairo_malloc (sizeof (cairo_cogl_linear_texture_entry_t));
     if (!entry) {
 	status = CAIRO_INT_STATUS_NO_MEMORY;
 	goto BAIL;
diff --git a/src/cairo-cogl-surface.c b/src/cairo-cogl-surface.c
index b46066c9b..2f7ed58d3 100644
--- a/src/cairo-cogl-surface.c
+++ b/src/cairo-cogl-surface.c
@@ -1994,7 +1994,7 @@ _cairo_cogl_get_path_stroke_meta (cairo_cogl_surface_t *surface,
     CAIRO_REFERENCE_COUNT_INIT (&meta->ref_count, 1);
     meta->cache_entry.hash = hash;
     meta->counter = 0;
-    meta_path = malloc (sizeof (cairo_path_fixed_t));
+    meta_path = _cairo_malloc (sizeof (cairo_path_fixed_t));
     if (!meta_path)
 	goto BAIL;
     /* FIXME: we should add a ref-counted wrapper for our user_paths
@@ -2248,7 +2248,7 @@ _cairo_cogl_get_path_fill_meta (cairo_cogl_surface_t *surface)
     meta->cache_entry.hash = hash;
     meta->counter = 0;
     CAIRO_REFERENCE_COUNT_INIT (&meta->ref_count, 1);
-    meta_path = malloc (sizeof (cairo_path_fixed_t));
+    meta_path = _cairo_malloc (sizeof (cairo_path_fixed_t));
     if (!meta_path)
 	goto BAIL;
     /* FIXME: we should add a ref-counted wrapper for our user_paths
@@ -2504,7 +2504,7 @@ _cairo_cogl_surface_create_full (cairo_cogl_device_t *dev,
     if (unlikely (status))
 	return _cairo_surface_create_in_error (status);
 
-    surface = malloc (sizeof (cairo_cogl_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_cogl_surface_t));
     if (unlikely (surface == NULL))
         return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-compiler-private.h b/src/cairo-compiler-private.h
index d982c101d..b77fab96d 100644
--- a/src/cairo-compiler-private.h
+++ b/src/cairo-compiler-private.h
@@ -46,7 +46,7 @@
 
 /* Size in bytes of buffer to use off the stack per functions.
  * Mostly used by text functions.  For larger allocations, they'll
- * malloc(). */
+ * _cairo_malloc(). */
 #ifndef CAIRO_STACK_BUFFER_SIZE
 #define CAIRO_STACK_BUFFER_SIZE (512 * sizeof (int))
 #endif
diff --git a/src/cairo-damage.c b/src/cairo-damage.c
index 63191fee9..97d9fe909 100644
--- a/src/cairo-damage.c
+++ b/src/cairo-damage.c
@@ -51,7 +51,7 @@ _cairo_damage_create (void)
 {
     cairo_damage_t *damage;
 
-    damage = malloc (sizeof (*damage));
+    damage = _cairo_malloc (sizeof (*damage));
     if (unlikely (damage == NULL)) {
 	_cairo_error_throw(CAIRO_STATUS_NO_MEMORY);
 	return (cairo_damage_t *) &__cairo_damage__nil;
@@ -122,7 +122,7 @@ _cairo_damage_add_boxes(cairo_damage_t *damage,
     if (size < count)
 	size = (count + 64) & ~63;
 
-    chunk = malloc (sizeof (*chunk) + sizeof (cairo_box_t) * size);
+    chunk = _cairo_malloc (sizeof (*chunk) + sizeof (cairo_box_t) * size);
     if (unlikely (chunk == NULL)) {
 	_cairo_damage_destroy (damage);
 	return (cairo_damage_t *) &__cairo_damage__nil;
@@ -210,7 +210,7 @@ _cairo_damage_reduce (cairo_damage_t *damage)
 
     boxes = damage->tail->base;
     if (damage->dirty > damage->tail->size) {
-	boxes = free_boxes = malloc (damage->dirty * sizeof (cairo_box_t));
+	boxes = free_boxes = _cairo_malloc (damage->dirty * sizeof (cairo_box_t));
 	if (unlikely (boxes == NULL)) {
 	    _cairo_damage_destroy (damage);
 	    return (cairo_damage_t *) &__cairo_damage__nil;
diff --git a/src/cairo-default-context.c b/src/cairo-default-context.c
index 694eecf78..985215ff7 100644
--- a/src/cairo-default-context.c
+++ b/src/cairo-default-context.c
@@ -1481,7 +1481,7 @@ _cairo_default_context_create (void *target)
 
     cr = _freed_pool_get (&context_pool);
     if (unlikely (cr == NULL)) {
-	cr = malloc (sizeof (cairo_default_context_t));
+	cr = _cairo_malloc (sizeof (cairo_default_context_t));
 	if (unlikely (cr == NULL))
 	    return _cairo_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
     }
diff --git a/src/cairo-deflate-stream.c b/src/cairo-deflate-stream.c
index ae23bda94..b51a6399c 100644
--- a/src/cairo-deflate-stream.c
+++ b/src/cairo-deflate-stream.c
@@ -124,7 +124,7 @@ _cairo_deflate_stream_create (cairo_output_stream_t *output)
     if (output->status)
 	return _cairo_output_stream_create_in_error (output->status);
 
-    stream = malloc (sizeof (cairo_deflate_stream_t));
+    stream = _cairo_malloc (sizeof (cairo_deflate_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
diff --git a/src/cairo-font-face-twin.c b/src/cairo-font-face-twin.c
index 2ad263028..a0855c9f6 100644
--- a/src/cairo-font-face-twin.c
+++ b/src/cairo-font-face-twin.c
@@ -288,7 +288,7 @@ twin_font_face_create_properties (cairo_font_face_t *twin_face)
 {
     twin_face_properties_t *props;
 
-    props = malloc (sizeof (twin_face_properties_t));
+    props = _cairo_malloc (sizeof (twin_face_properties_t));
     if (unlikely (props == NULL))
 	return NULL;
 
@@ -412,7 +412,7 @@ twin_scaled_font_compute_properties (cairo_scaled_font_t *scaled_font,
     cairo_status_t status;
     twin_scaled_properties_t *props;
 
-    props = malloc (sizeof (twin_scaled_properties_t));
+    props = _cairo_malloc (sizeof (twin_scaled_properties_t));
     if (unlikely (props == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-font-options.c b/src/cairo-font-options.c
index de6ae951f..1ce109e56 100644
--- a/src/cairo-font-options.c
+++ b/src/cairo-font-options.c
@@ -109,7 +109,7 @@ cairo_font_options_create (void)
 {
     cairo_font_options_t *options;
 
-    options = malloc (sizeof (cairo_font_options_t));
+    options = _cairo_malloc (sizeof (cairo_font_options_t));
     if (!options) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_font_options_t *) &_cairo_font_options_nil;
@@ -143,7 +143,7 @@ cairo_font_options_copy (const cairo_font_options_t *original)
     if (cairo_font_options_status ((cairo_font_options_t *) original))
 	return (cairo_font_options_t *) &_cairo_font_options_nil;
 
-    options = malloc (sizeof (cairo_font_options_t));
+    options = _cairo_malloc (sizeof (cairo_font_options_t));
     if (!options) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_font_options_t *) &_cairo_font_options_nil;
@@ -242,7 +242,7 @@ cairo_font_options_merge (cairo_font_options_t       *options,
         char *p;
 
         /* 'merge' variations by concatenating - later entries win */
-        p = malloc (strlen (other->variations) + strlen (options->variations) + 2);
+        p = _cairo_malloc (strlen (other->variations) + strlen (options->variations) + 2);
         p[0] = 0;
         strcat (p, options->variations);
         strcat (p, ",");
diff --git a/src/cairo-freelist-private.h b/src/cairo-freelist-private.h
index f85f68914..7977d6d71 100644
--- a/src/cairo-freelist-private.h
+++ b/src/cairo-freelist-private.h
@@ -45,7 +45,7 @@ cairo_private void
 _cairo_freelist_fini (cairo_freelist_t *freelist);
 
 /* Allocate a new node from the freelist.  If the freelist contains no
- * nodes, a new one will be allocated using malloc().  The caller is
+ * nodes, a new one will be allocated using _cairo_malloc().  The caller is
  * responsible for calling _cairo_freelist_free() or free() on the
  * returned node.  Returns %NULL on memory allocation error. */
 cairo_private void *
diff --git a/src/cairo-freelist.c b/src/cairo-freelist.c
index 631fe48d5..7f2f3b30b 100644
--- a/src/cairo-freelist.c
+++ b/src/cairo-freelist.c
@@ -61,7 +61,7 @@ _cairo_freelist_alloc (cairo_freelist_t *freelist)
 	return node;
     }
 
-    return malloc (freelist->nodesize);
+    return _cairo_malloc (freelist->nodesize);
 }
 
 void *
@@ -139,7 +139,7 @@ _cairo_freepool_alloc_from_new_pool (cairo_freepool_t *freepool)
 	else
 	    poolsize = (128 * freepool->nodesize + 8191) & -8192;
 
-	pool = malloc (sizeof (cairo_freelist_pool_t) + poolsize);
+	pool = _cairo_malloc (sizeof (cairo_freelist_pool_t) + poolsize);
 	if (unlikely (pool == NULL))
 	    return pool;
 
diff --git a/src/cairo-ft-font.c b/src/cairo-ft-font.c
index 9b1070898..9f932a208 100644
--- a/src/cairo-ft-font.c
+++ b/src/cairo-ft-font.c
@@ -300,7 +300,7 @@ _cairo_ft_unscaled_font_map_create (void)
      * detect some other call path. */
     assert (cairo_ft_unscaled_font_map == NULL);
 
-    font_map = malloc (sizeof (cairo_ft_unscaled_font_map_t));
+    font_map = _cairo_malloc (sizeof (cairo_ft_unscaled_font_map_t));
     if (unlikely (font_map == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -563,7 +563,7 @@ _cairo_ft_unscaled_font_create_internal (cairo_bool_t from_face,
     }
 
     /* Otherwise create it and insert into hash table. */
-    unscaled = malloc (sizeof (cairo_ft_unscaled_font_t));
+    unscaled = _cairo_malloc (sizeof (cairo_ft_unscaled_font_t));
     if (unlikely (unscaled == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto UNWIND_FONT_MAP_LOCK;
@@ -1977,7 +1977,7 @@ _cairo_ft_options_merge (cairo_ft_options_t *options,
         char *p;
 
         /* 'merge' variations by concatenating - later entries win */
-        p = malloc (strlen (other->base.variations) + strlen (options->base.variations) + 2);
+        p = _cairo_malloc (strlen (other->base.variations) + strlen (options->base.variations) + 2);
         p[0] = 0;
         strcat (p, other->base.variations);
         strcat (p, ",");
@@ -2015,7 +2015,7 @@ _cairo_ft_font_face_scaled_font_create (void		    *abstract_font_face,
     if (unlikely (face == NULL)) /* backend error */
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
-    scaled_font = malloc (sizeof (cairo_ft_scaled_font_t));
+    scaled_font = _cairo_malloc (sizeof (cairo_ft_scaled_font_t));
     if (unlikely (scaled_font == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto FAIL;
@@ -2307,7 +2307,7 @@ cairo_ft_apply_variations (FT_Face                 face,
         unsigned int i;
         const char *p;
 
-        coords = malloc (sizeof (FT_Fixed) * ft_mm_var->num_axis);
+        coords = _cairo_malloc (sizeof (FT_Fixed) * ft_mm_var->num_axis);
 	/* FIXME check coords. */
 
 	if (scaled_font->unscaled->variations)
@@ -2364,7 +2364,7 @@ skip:
             p = end ? end + 1 : NULL;
         }
 
-        current_coords = malloc (sizeof (FT_Fixed) * ft_mm_var->num_axis);
+        current_coords = _cairo_malloc (sizeof (FT_Fixed) * ft_mm_var->num_axis);
 #ifdef HAVE_FT_GET_VAR_DESIGN_COORDINATES
         ret = FT_Get_Var_Design_Coordinates (face, ft_mm_var->num_axis, current_coords);
         if (ret == 0) {
@@ -3247,7 +3247,7 @@ _cairo_ft_font_face_create_for_pattern (FcPattern *pattern)
 {
     cairo_ft_font_face_t *font_face;
 
-    font_face = malloc (sizeof (cairo_ft_font_face_t));
+    font_face = _cairo_malloc (sizeof (cairo_ft_font_face_t));
     if (unlikely (font_face == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_font_face_t *) &_cairo_font_face_nil;
@@ -3309,7 +3309,7 @@ _cairo_ft_font_face_create (cairo_ft_unscaled_font_t *unscaled,
     }
 
     /* No match found, create a new one */
-    font_face = malloc (sizeof (cairo_ft_font_face_t));
+    font_face = _cairo_malloc (sizeof (cairo_ft_font_face_t));
     if (unlikely (!font_face)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_font_face_t *)&_cairo_font_face_nil;
diff --git a/src/cairo-gl-device.c b/src/cairo-gl-device.c
index 38582fd24..ec919d043 100644
--- a/src/cairo-gl-device.c
+++ b/src/cairo-gl-device.c
@@ -307,7 +307,7 @@ _cairo_gl_context_init (cairo_gl_context_t *ctx)
 
     ctx->vbo_size = _cairo_gl_get_vbo_size();
 
-    ctx->vb = malloc (ctx->vbo_size);
+    ctx->vb = _cairo_malloc (ctx->vbo_size);
     if (unlikely (ctx->vb == NULL)) {
 	    _cairo_cache_fini (&ctx->gradients);
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-gl-gradient.c b/src/cairo-gl-gradient.c
index 0ab01ac3e..28fd7c293 100644
--- a/src/cairo-gl-gradient.c
+++ b/src/cairo-gl-gradient.c
@@ -248,7 +248,7 @@ _cairo_gl_gradient_create (cairo_gl_context_t           *ctx,
 	return CAIRO_STATUS_SUCCESS;
     }
 
-    gradient = malloc (sizeof (cairo_gl_gradient_t) + sizeof (cairo_gradient_stop_t) * (n_stops - 1));
+    gradient = _cairo_malloc (sizeof (cairo_gl_gradient_t) + sizeof (cairo_gradient_stop_t) * (n_stops - 1));
     if (gradient == NULL)
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-gl-shaders.c b/src/cairo-gl-shaders.c
index 7d4fefbbc..12c83b9ff 100644
--- a/src/cairo-gl-shaders.c
+++ b/src/cairo-gl-shaders.c
@@ -1060,7 +1060,7 @@ _cairo_gl_get_shader_by_type (cairo_gl_context_t *ctx,
     if (unlikely (status))
 	return status;
 
-    entry = malloc (sizeof (cairo_shader_cache_entry_t));
+    entry = _cairo_malloc (sizeof (cairo_shader_cache_entry_t));
     if (unlikely (entry == NULL)) {
         free (fs_source);
         return _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-gl-source.c b/src/cairo-gl-source.c
index ba11b7e92..7e0ee4a82 100644
--- a/src/cairo-gl-source.c
+++ b/src/cairo-gl-source.c
@@ -69,7 +69,7 @@ _cairo_gl_pattern_to_source (cairo_surface_t *dst,
     if (pattern == NULL)
 	return _cairo_gl_white_source ();
 
-    source = malloc (sizeof (*source));
+    source = _cairo_malloc (sizeof (*source));
     if (unlikely (source == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -97,7 +97,7 @@ _cairo_gl_white_source (void)
 {
     cairo_gl_source_t *source;
 
-    source = malloc (sizeof (*source));
+    source = _cairo_malloc (sizeof (*source));
     if (unlikely (source == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-gl-surface.c b/src/cairo-gl-surface.c
index 6be6d9868..0fe283f00 100644
--- a/src/cairo-gl-surface.c
+++ b/src/cairo-gl-surface.c
@@ -1259,7 +1259,7 @@ _cairo_gl_surface_map_to_image (void      *abstract_surface,
 	uint8_t *bot = image->data + (image->height-1)*image->stride;
 
 	if (image->stride > (int)sizeof(stack)) {
-	    row = malloc (image->stride);
+	    row = _cairo_malloc (image->stride);
 	    if (unlikely (row == NULL)) {
 		cairo_surface_destroy (&image->base);
 		return _cairo_image_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
diff --git a/src/cairo-gstate.c b/src/cairo-gstate.c
index 40cc4a6fe..f476f5df1 100644
--- a/src/cairo-gstate.c
+++ b/src/cairo-gstate.c
@@ -241,7 +241,7 @@ _cairo_gstate_save (cairo_gstate_t **gstate, cairo_gstate_t **freelist)
 
     top = *freelist;
     if (top == NULL) {
-	top = malloc (sizeof (cairo_gstate_t));
+	top = _cairo_malloc (sizeof (cairo_gstate_t));
 	if (unlikely (top == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     } else
diff --git a/src/cairo-hash.c b/src/cairo-hash.c
index 928c74b8b..5a789906f 100644
--- a/src/cairo-hash.c
+++ b/src/cairo-hash.c
@@ -164,7 +164,7 @@ _cairo_hash_table_create (cairo_hash_keys_equal_func_t keys_equal)
 {
     cairo_hash_table_t *hash_table;
 
-    hash_table = malloc (sizeof (cairo_hash_table_t));
+    hash_table = _cairo_malloc (sizeof (cairo_hash_table_t));
     if (unlikely (hash_table == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return NULL;
diff --git a/src/cairo-image-compositor.c b/src/cairo-image-compositor.c
index 122a8ca42..bbf4cf228 100644
--- a/src/cairo-image-compositor.c
+++ b/src/cairo-image-compositor.c
@@ -2934,7 +2934,7 @@ inplace_renderer_init (cairo_image_span_renderer_t	*r,
 	/* Create an effectively unbounded mask by repeating the single line */
 	buf = r->_buf;
 	if (width > SZ_BUF) {
-	    buf = malloc (width);
+	    buf = _cairo_malloc (width);
 	    if (unlikely (buf == NULL)) {
 		pixman_image_unref (r->src);
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-image-source.c b/src/cairo-image-source.c
index 3e3ca2814..0b50afcad 100644
--- a/src/cairo-image-source.c
+++ b/src/cairo-image-source.c
@@ -872,7 +872,7 @@ create_separable_convolution (int *n_values,
     size_y = (1 << ysubsample) * ywidth;
 
     *n_values = 4 + size_x + size_y;
-    params = malloc (*n_values * sizeof (pixman_fixed_t));
+    params = _cairo_malloc (*n_values * sizeof (pixman_fixed_t));
     if (!params) return 0;
 
     params[0] = pixman_int_to_fixed (xwidth);
@@ -1077,7 +1077,7 @@ attach_proxy (cairo_surface_t *source,
 {
     struct proxy *proxy;
 
-    proxy = malloc (sizeof (*proxy));
+    proxy = _cairo_malloc (sizeof (*proxy));
     if (unlikely (proxy == NULL))
 	return _cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1407,7 +1407,7 @@ _pixman_image_for_surface (cairo_image_surface_t *dst,
 	    return NULL;
 	}
 
-	cleanup = malloc (sizeof (*cleanup));
+	cleanup = _cairo_malloc (sizeof (*cleanup));
 	if (unlikely (cleanup == NULL)) {
 	    _cairo_surface_release_source_image (pattern->surface, image, extra);
 	    pixman_image_unref (pixman_image);
@@ -1498,7 +1498,7 @@ _pixman_image_for_raster (cairo_image_surface_t *dst,
 	return NULL;
     }
 
-    cleanup = malloc (sizeof (*cleanup));
+    cleanup = _cairo_malloc (sizeof (*cleanup));
     if (unlikely (cleanup == NULL)) {
 	pixman_image_unref (pixman_image);
 	_cairo_surface_release_source_image (surface, image, extra);
@@ -1594,7 +1594,7 @@ _cairo_image_source_create_for_pattern (cairo_surface_t *dst,
 
     TRACE ((stderr, "%s\n", __FUNCTION__));
 
-    source = malloc (sizeof (cairo_image_source_t));
+    source = _cairo_malloc (sizeof (cairo_image_source_t));
     if (unlikely (source == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-image-surface.c b/src/cairo-image-surface.c
index f565250a5..9894335c1 100644
--- a/src/cairo-image-surface.c
+++ b/src/cairo-image-surface.c
@@ -182,7 +182,7 @@ _cairo_image_surface_create_for_pixman_image (pixman_image_t		*pixman_image,
 {
     cairo_image_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_image_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_image_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -427,7 +427,7 @@ _cairo_image_surface_create_with_content (cairo_content_t	content,
  * cairo_surface_t *surface;
  *
  * stride = cairo_format_stride_for_width (format, width);
- * data = malloc (stride * height);
+ * data = _cairo_malloc (stride * height);
  * surface = cairo_image_surface_create_for_data (data, format,
  *						  width, height,
  *						  stride);
@@ -462,7 +462,7 @@ slim_hidden_def (cairo_format_stride_for_width);
  * cairo_image_surface_create_for_data:
  * @data: a pointer to a buffer supplied by the application in which
  *     to write contents. This pointer must be suitably aligned for any
- *     kind of variable, (for example, a pointer returned by malloc).
+ *     kind of variable, (for example, a pointer returned by _cairo_malloc).
  * @format: the format of pixels in the buffer
  * @width: the width of the image to be stored in the buffer
  * @height: the height of the image to be stored in the buffer
diff --git a/src/cairo-lzw.c b/src/cairo-lzw.c
index de7f99983..f27b3c338 100644
--- a/src/cairo-lzw.c
+++ b/src/cairo-lzw.c
@@ -73,7 +73,7 @@ _lzw_buf_init (lzw_buf_t *buf, int size)
     buf->pending = 0;
     buf->pending_bits = 0;
 
-    buf->data = malloc (size);
+    buf->data = _cairo_malloc (size);
     if (unlikely (buf->data == NULL)) {
 	buf->data_size = 0;
 	buf->status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-malloc-private.h b/src/cairo-malloc-private.h
index 570f7cb0e..276321e10 100644
--- a/src/cairo-malloc-private.h
+++ b/src/cairo-malloc-private.h
@@ -51,16 +51,16 @@
  * _cairo_malloc:
  * @size: size in bytes
  *
- * Allocate @size memory using malloc().
+ * Allocate @size memory using _cairo_malloc().
  * The memory should be freed using free().
- * malloc is skipped, if 0 bytes are requested, and %NULL will be returned.
+ * _cairo_malloc is skipped, if 0 bytes are requested, and %NULL will be returned.
  *
  * Return value: A pointer to the newly allocated memory, or %NULL in
- * case of malloc() failure or size is 0.
+ * case of _cairo_malloc() failure or size is 0.
  **/
 
 #define _cairo_malloc(size) \
-   ((size) > 0 ? malloc((unsigned) (size)) : NULL)
+   ((size) > 0 ? _cairo_malloc((unsigned) (size)) : NULL)
 
 /**
  * _cairo_malloc_ab:
@@ -76,7 +76,7 @@
  * out a constant division.
  *
  * Return value: A pointer to the newly allocated memory, or %NULL in
- * case of malloc() failure or overflow.
+ * case of _cairo_malloc() failure or overflow.
  **/
 
 #define _cairo_malloc_ab(a, size) \
@@ -119,7 +119,7 @@
  * out a constant division.
  *
  * Return value: A pointer to the newly allocated memory, or %NULL in
- * case of malloc() failure or overflow.
+ * case of _cairo_malloc() failure or overflow.
  **/
 
 #define _cairo_malloc_abc(a, b, size) \
@@ -138,7 +138,7 @@
  * _cairo_malloc_ab().  The memory should be freed using free().
  *
  * Return value: A pointer to the newly allocated memory, or %NULL in
- * case of malloc() failure or overflow.
+ * case of _cairo_malloc() failure or overflow.
  **/
 
 #define _cairo_malloc_ab_plus_c(a, size, c) \
diff --git a/src/cairo-mempool.c b/src/cairo-mempool.c
index 751ede320..3505129db 100644
--- a/src/cairo-mempool.c
+++ b/src/cairo-mempool.c
@@ -40,7 +40,7 @@
 #include "cairo-list-inline.h"
 
 /* a simple buddy allocator for memory pools
- * XXX fragmentation? use Doug Lea's malloc?
+ * XXX fragmentation? use Doug Lea's _cairo_malloc?
  */
 
 #define BITTEST(p, n)  ((p)->map[(n) >> 3] &   (128 >> ((n) & 7)))
@@ -316,7 +316,7 @@ _cairo_mempool_init (cairo_mempool_t *pool,
     for (i = 0; i < ARRAY_LENGTH (pool->free); i++)
 	cairo_list_init (&pool->free[i]);
 
-    pool->map = malloc ((num_blocks + 7) >> 3);
+    pool->map = _cairo_malloc ((num_blocks + 7) >> 3);
     if (pool->map == NULL) {
 	free (pool->blocks);
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-misc.c b/src/cairo-misc.c
index ecd866a64..6e63bc7e6 100644
--- a/src/cairo-misc.c
+++ b/src/cairo-misc.c
@@ -1069,7 +1069,7 @@ _cairo_intern_string (const char **str_inout, int len)
     istring = _cairo_hash_table_lookup (_cairo_intern_string_ht,
 					&tmpl.hash_entry);
     if (istring == NULL) {
-	istring = malloc (sizeof (cairo_intern_string_t) + len + 1);
+	istring = _cairo_malloc (sizeof (cairo_intern_string_t) + len + 1);
 	if (likely (istring != NULL)) {
 	    istring->hash_entry.hash = tmpl.hash_entry.hash;
 	    istring->len = tmpl.len;
diff --git a/src/cairo-mono-scan-converter.c b/src/cairo-mono-scan-converter.c
index 2a9546cf8..891f435c9 100644
--- a/src/cairo-mono-scan-converter.c
+++ b/src/cairo-mono-scan-converter.c
@@ -587,7 +587,7 @@ _cairo_mono_scan_converter_create (int			xmin,
     cairo_mono_scan_converter_t *self;
     cairo_status_t status;
 
-    self = malloc (sizeof(struct _cairo_mono_scan_converter));
+    self = _cairo_malloc (sizeof(struct _cairo_mono_scan_converter));
     if (unlikely (self == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto bail_nomem;
diff --git a/src/cairo-os2-surface.c b/src/cairo-os2-surface.c
index 226eec0c8..b2466b553 100644
--- a/src/cairo-os2-surface.c
+++ b/src/cairo-os2-surface.c
@@ -167,7 +167,7 @@ cairo_os2_fini (void)
 /*
  * This function calls the allocation function depending on which
  * method was compiled into the library: it can be native allocation
- * (DosAllocMem/DosFreeMem) or C-Library based allocation (malloc/free).
+ * (DosAllocMem/DosFreeMem) or C-Library based allocation (_cairo_malloc/free).
  * Actually, for pixel buffers that we use this function for, cairo
  * uses _cairo_malloc_abc, so we use that here, too. And use the
  * change to check the size argument
@@ -197,8 +197,8 @@ void *_buffer_alloc (size_t a, size_t b, const unsigned int size)
                      PAG_READ | PAG_WRITE | PAG_COMMIT))
         return NULL;
 #else
-    /* Clear the malloc'd buffer the way DosAllocMem() does. */
-    buffer = malloc (nbytes);
+    /* Clear the _cairo_malloc'd buffer the way DosAllocMem() does. */
+    buffer = _cairo_malloc (nbytes);
     if (buffer) {
         memset (buffer, 0, nbytes);
     }
@@ -718,7 +718,7 @@ cairo_os2_surface_create (HPS hps_client_window,
     }
 
     /* Allocate an OS/2 surface structure. */
-    local_os2_surface = (cairo_os2_surface_t *) malloc (sizeof (cairo_os2_surface_t));
+    local_os2_surface = (cairo_os2_surface_t *) _cairo_malloc (sizeof (cairo_os2_surface_t));
     if (!local_os2_surface) {
         status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
         goto error_exit;
diff --git a/src/cairo-output-stream.c b/src/cairo-output-stream.c
index cbb60c74e..72b81526c 100644
--- a/src/cairo-output-stream.c
+++ b/src/cairo-output-stream.c
@@ -147,7 +147,7 @@ _cairo_output_stream_create (cairo_write_func_t		write_func,
 {
     cairo_output_stream_with_closure_t *stream;
 
-    stream = malloc (sizeof (cairo_output_stream_with_closure_t));
+    stream = _cairo_malloc (sizeof (cairo_output_stream_with_closure_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
@@ -173,7 +173,7 @@ _cairo_output_stream_create_in_error (cairo_status_t status)
     if (status == CAIRO_STATUS_WRITE_ERROR)
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil_write_error;
 
-    stream = malloc (sizeof (cairo_output_stream_t));
+    stream = _cairo_malloc (sizeof (cairo_output_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
@@ -639,7 +639,7 @@ _cairo_output_stream_create_for_file (FILE *file)
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil_write_error;
     }
 
-    stream = malloc (sizeof *stream);
+    stream = _cairo_malloc (sizeof *stream);
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
@@ -678,7 +678,7 @@ _cairo_output_stream_create_for_filename (const char *filename)
 	}
     }
 
-    stream = malloc (sizeof *stream);
+    stream = _cairo_malloc (sizeof *stream);
     if (unlikely (stream == NULL)) {
 	fclose (file);
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
@@ -722,7 +722,7 @@ _cairo_memory_stream_create (void)
 {
     memory_stream_t *stream;
 
-    stream = malloc (sizeof *stream);
+    stream = _cairo_malloc (sizeof *stream);
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
@@ -749,7 +749,7 @@ _cairo_memory_stream_destroy (cairo_output_stream_t *abstract_stream,
     stream = (memory_stream_t *) abstract_stream;
 
     *length_out = _cairo_array_num_elements (&stream->array);
-    *data_out = malloc (*length_out);
+    *data_out = _cairo_malloc (*length_out);
     if (unlikely (*data_out == NULL)) {
 	status = _cairo_output_stream_destroy (abstract_stream);
 	assert (status == CAIRO_STATUS_SUCCESS);
@@ -799,7 +799,7 @@ _cairo_null_stream_create (void)
 {
     cairo_output_stream_t *stream;
 
-    stream = malloc (sizeof *stream);
+    stream = _cairo_malloc (sizeof *stream);
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
diff --git a/src/cairo-paginated-surface.c b/src/cairo-paginated-surface.c
index e9454d416..fc16f790b 100644
--- a/src/cairo-paginated-surface.c
+++ b/src/cairo-paginated-surface.c
@@ -98,7 +98,7 @@ _cairo_paginated_surface_create (cairo_surface_t				*target,
     cairo_paginated_surface_t *surface;
     cairo_status_t status;
 
-    surface = malloc (sizeof (cairo_paginated_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_paginated_surface_t));
     if (unlikely (surface == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto FAIL;
diff --git a/src/cairo-path-fixed.c b/src/cairo-path-fixed.c
index ac44bb71b..9e9166cbd 100644
--- a/src/cairo-path-fixed.c
+++ b/src/cairo-path-fixed.c
@@ -325,7 +325,7 @@ _cairo_path_fixed_create (void)
 {
     cairo_path_fixed_t	*path;
 
-    path = malloc (sizeof (cairo_path_fixed_t));
+    path = _cairo_malloc (sizeof (cairo_path_fixed_t));
     if (!path) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return NULL;
diff --git a/src/cairo-path.c b/src/cairo-path.c
index 43cd175a3..566e86f5a 100644
--- a/src/cairo-path.c
+++ b/src/cairo-path.c
@@ -294,7 +294,7 @@ _cairo_path_create_in_error (cairo_status_t status)
     if (status == CAIRO_STATUS_NO_MEMORY)
 	return (cairo_path_t*) &_cairo_path_nil;
 
-    path = malloc (sizeof (cairo_path_t));
+    path = _cairo_malloc (sizeof (cairo_path_t));
     if (unlikely (path == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_path_t*) &_cairo_path_nil;
@@ -314,7 +314,7 @@ _cairo_path_create_internal (cairo_path_fixed_t *path_fixed,
 {
     cairo_path_t *path;
 
-    path = malloc (sizeof (cairo_path_t));
+    path = _cairo_malloc (sizeof (cairo_path_t));
     if (unlikely (path == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_path_t*) &_cairo_path_nil;
diff --git a/src/cairo-pattern.c b/src/cairo-pattern.c
index 11637fca5..745b95011 100644
--- a/src/cairo-pattern.c
+++ b/src/cairo-pattern.c
@@ -498,22 +498,22 @@ _cairo_pattern_create_copy (cairo_pattern_t	  **pattern_out,
 
     switch (other->type) {
     case CAIRO_PATTERN_TYPE_SOLID:
-	pattern = malloc (sizeof (cairo_solid_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_solid_pattern_t));
 	break;
     case CAIRO_PATTERN_TYPE_SURFACE:
-	pattern = malloc (sizeof (cairo_surface_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_surface_pattern_t));
 	break;
     case CAIRO_PATTERN_TYPE_LINEAR:
-	pattern = malloc (sizeof (cairo_linear_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_linear_pattern_t));
 	break;
     case CAIRO_PATTERN_TYPE_RADIAL:
-	pattern = malloc (sizeof (cairo_radial_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_radial_pattern_t));
 	break;
     case CAIRO_PATTERN_TYPE_MESH:
-	pattern = malloc (sizeof (cairo_mesh_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_mesh_pattern_t));
 	break;
     case CAIRO_PATTERN_TYPE_RASTER_SOURCE:
-	pattern = malloc (sizeof (cairo_raster_source_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_raster_source_pattern_t));
 	break;
     default:
 	ASSERT_NOT_REACHED;
@@ -604,7 +604,7 @@ _cairo_pattern_create_solid (const cairo_color_t *color)
 	_freed_pool_get (&freed_pattern_pool[CAIRO_PATTERN_TYPE_SOLID]);
     if (unlikely (pattern == NULL)) {
 	/* None cached, need to create a new pattern. */
-	pattern = malloc (sizeof (cairo_solid_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_solid_pattern_t));
 	if (unlikely (pattern == NULL)) {
 	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	    return (cairo_pattern_t *) &_cairo_pattern_nil;
@@ -738,7 +738,7 @@ cairo_pattern_create_for_surface (cairo_surface_t *surface)
     pattern =
 	_freed_pool_get (&freed_pattern_pool[CAIRO_PATTERN_TYPE_SURFACE]);
     if (unlikely (pattern == NULL)) {
-	pattern = malloc (sizeof (cairo_surface_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_surface_pattern_t));
 	if (unlikely (pattern == NULL)) {
 	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	    return (cairo_pattern_t *)&_cairo_pattern_nil.base;
@@ -790,7 +790,7 @@ cairo_pattern_create_linear (double x0, double y0, double x1, double y1)
     pattern =
 	_freed_pool_get (&freed_pattern_pool[CAIRO_PATTERN_TYPE_LINEAR]);
     if (unlikely (pattern == NULL)) {
-	pattern = malloc (sizeof (cairo_linear_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_linear_pattern_t));
 	if (unlikely (pattern == NULL)) {
 	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	    return (cairo_pattern_t *) &_cairo_pattern_nil.base;
@@ -844,7 +844,7 @@ cairo_pattern_create_radial (double cx0, double cy0, double radius0,
     pattern =
 	_freed_pool_get (&freed_pattern_pool[CAIRO_PATTERN_TYPE_RADIAL]);
     if (unlikely (pattern == NULL)) {
-	pattern = malloc (sizeof (cairo_radial_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_radial_pattern_t));
 	if (unlikely (pattern == NULL)) {
 	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	    return (cairo_pattern_t *) &_cairo_pattern_nil.base;
@@ -1022,7 +1022,7 @@ cairo_pattern_create_mesh (void)
     pattern =
 	_freed_pool_get (&freed_pattern_pool[CAIRO_PATTERN_TYPE_MESH]);
     if (unlikely (pattern == NULL)) {
-	pattern = malloc (sizeof (cairo_mesh_pattern_t));
+	pattern = _cairo_malloc (sizeof (cairo_mesh_pattern_t));
 	if (unlikely (pattern == NULL)) {
 	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	    return (cairo_pattern_t *) &_cairo_pattern_nil.base;
@@ -4480,7 +4480,7 @@ cairo_mesh_pattern_get_path (cairo_pattern_t *pattern,
 
     patch = _cairo_array_index_const (&mesh->patches, patch_num);
 
-    path = malloc (sizeof (cairo_path_t));
+    path = _cairo_malloc (sizeof (cairo_path_t));
     if (path == NULL)
 	return _cairo_path_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-pdf-interchange.c b/src/cairo-pdf-interchange.c
index ea5166603..e0955b27c 100644
--- a/src/cairo-pdf-interchange.c
+++ b/src/cairo-pdf-interchange.c
@@ -100,7 +100,7 @@ add_tree_node (cairo_pdf_surface_t           *surface,
 {
     cairo_pdf_struct_tree_node_t *node;
 
-    node = malloc (sizeof(cairo_pdf_struct_tree_node_t));
+    node = _cairo_malloc (sizeof(cairo_pdf_struct_tree_node_t));
     if (unlikely (node == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -177,7 +177,7 @@ add_annotation (cairo_pdf_surface_t           *surface,
     cairo_pdf_interchange_t *ic = &surface->interchange;
     cairo_pdf_annotation_t *annot;
 
-    annot = malloc (sizeof(cairo_pdf_annotation_t));
+    annot = _cairo_malloc (sizeof(cairo_pdf_annotation_t));
     if (unlikely (annot == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-pdf-operators.c b/src/cairo-pdf-operators.c
index 42f770940..491ef8ca2 100644
--- a/src/cairo-pdf-operators.c
+++ b/src/cairo-pdf-operators.c
@@ -359,7 +359,7 @@ _word_wrap_stream_create (cairo_output_stream_t *output, cairo_bool_t ps, int ma
     if (output->status)
 	return _cairo_output_stream_create_in_error (output->status);
 
-    stream = malloc (sizeof (word_wrap_stream_t));
+    stream = _cairo_malloc (sizeof (word_wrap_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
diff --git a/src/cairo-pdf-shading.c b/src/cairo-pdf-shading.c
index 646e2cd49..b114b3104 100644
--- a/src/cairo-pdf-shading.c
+++ b/src/cairo-pdf-shading.c
@@ -170,7 +170,7 @@ _cairo_pdf_shading_generate_data (cairo_pdf_shading_t        *shading,
      * 4 colors. Each color is stored in 2 bytes * num_color_components.
      */
     shading->data_length = num_patches * (1 + 16 * 2 * 4 + 4 * 2 * num_color_components);
-    shading->data = malloc (shading->data_length);
+    shading->data = _cairo_malloc (shading->data_length);
     if (unlikely (shading->data == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-pdf-surface.c b/src/cairo-pdf-surface.c
index 81ff515c8..47221b43c 100644
--- a/src/cairo-pdf-surface.c
+++ b/src/cairo-pdf-surface.c
@@ -397,7 +397,7 @@ _cairo_pdf_surface_create_for_stream_internal (cairo_output_stream_t	*output,
     cairo_pdf_surface_t *surface;
     cairo_status_t status, status_ignored;
 
-    surface = malloc (sizeof (cairo_pdf_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_pdf_surface_t));
     if (unlikely (surface == NULL)) {
 	/* destroy stream on behalf of caller */
 	status = _cairo_output_stream_destroy (output);
@@ -1591,7 +1591,7 @@ _cairo_pdf_surface_add_source_surface (cairo_pdf_surface_t	         *surface,
 	unique_id_length = 0;
     }
 
-    surface_entry = malloc (sizeof (cairo_pdf_source_surface_entry_t));
+    surface_entry = _cairo_malloc (sizeof (cairo_pdf_source_surface_entry_t));
     if (surface_entry == NULL) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto fail1;
@@ -2875,7 +2875,7 @@ _cairo_pdf_surface_lookup_jbig2_global (cairo_pdf_surface_t       *surface,
 	}
     }
 
-    global.id = malloc(global_id_length);
+    global.id = _cairo_malloc(global_id_length);
     if (unlikely (global.id == NULL)) {
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
@@ -3221,7 +3221,7 @@ _cairo_pdf_surface_emit_ccitt_image (cairo_pdf_surface_t              *surface,
 	return CAIRO_INT_STATUS_UNSUPPORTED;
 
     /* ensure params_string is null terminated */
-    params = malloc (ccitt_params_string_len + 1);
+    params = _cairo_malloc (ccitt_params_string_len + 1);
     memcpy (params, ccitt_params_string, ccitt_params_string_len);
     params[ccitt_params_string_len] = 0;
     status = _cairo_tag_parse_ccitt_params (params, &ccitt_params);
@@ -5166,7 +5166,7 @@ _cairo_utf8_to_pdf_string (const char *utf8, char **str_out)
     }
 
     if (ascii) {
-	str = malloc (len + 3);
+	str = _cairo_malloc (len + 3);
 	if (str == NULL)
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -5183,7 +5183,7 @@ _cairo_utf8_to_pdf_string (const char *utf8, char **str_out)
 	if (unlikely (status))
 	    return status;
 
-	str = malloc (utf16_len*4 + 7);
+	str = _cairo_malloc (utf16_len*4 + 7);
 	if (str == NULL) {
 	    free (utf16);
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
@@ -8332,7 +8332,7 @@ _cairo_pdf_surface_show_text_glyphs (void			*abstract_surface,
 	group->source_res = pattern_res;
 
 	if (utf8_len) {
-	    group->utf8 = malloc (utf8_len);
+	    group->utf8 = _cairo_malloc (utf8_len);
 	    if (unlikely (group->utf8 == NULL)) {
 		_cairo_pdf_smask_group_destroy (group);
 		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-ps-surface.c b/src/cairo-ps-surface.c
index 27a51953e..bdf18b457 100644
--- a/src/cairo-ps-surface.c
+++ b/src/cairo-ps-surface.c
@@ -1103,7 +1103,7 @@ _cairo_ps_surface_get_page_media (cairo_ps_surface_t     *surface)
 	}
     }
 
-    page = malloc (sizeof (cairo_page_media_t));
+    page = _cairo_malloc (sizeof (cairo_page_media_t));
     if (unlikely (page == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return NULL;
@@ -1139,7 +1139,7 @@ _cairo_ps_surface_create_for_stream_internal (cairo_output_stream_t *stream,
     cairo_status_t status, status_ignored;
     cairo_ps_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_ps_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_ps_surface_t));
     if (unlikely (surface == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP;
@@ -2378,7 +2378,7 @@ _base85_strings_stream_create (cairo_output_stream_t *output)
 {
     string_array_stream_t *stream;
 
-    stream = malloc (sizeof (string_array_stream_t));
+    stream = _cairo_malloc (sizeof (string_array_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
@@ -2408,7 +2408,7 @@ _base85_wrap_stream_create (cairo_output_stream_t *output)
 {
     string_array_stream_t *stream;
 
-    stream = malloc (sizeof (string_array_stream_t));
+    stream = _cairo_malloc (sizeof (string_array_stream_t));
     if (unlikely (stream == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_output_stream_t *) &_cairo_output_stream_nil;
@@ -2673,7 +2673,7 @@ _cairo_ps_surface_emit_image (cairo_ps_surface_t          *surface,
     if (use_mask)
 	data_size += (ps_image->width + 7)/8;
     data_size *= ps_image->height;
-    data = malloc (data_size);
+    data = _cairo_malloc (data_size);
     if (unlikely (data == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto bail1;
@@ -3085,7 +3085,7 @@ _cairo_ps_surface_emit_ccitt_image (cairo_ps_surface_t          *surface,
 	return CAIRO_INT_STATUS_UNSUPPORTED;
 
     /* ensure params_string is null terminated */
-    ccitt_params_string = malloc (ccitt_params_data_len + 1);
+    ccitt_params_string = _cairo_malloc (ccitt_params_data_len + 1);
     memcpy (ccitt_params_string, ccitt_params_data, ccitt_params_data_len);
     ccitt_params_string[ccitt_params_data_len] = 0;
     status = _cairo_tag_parse_ccitt_params (ccitt_params_string, &ccitt_params);
@@ -3270,7 +3270,7 @@ _cairo_ps_surface_emit_eps (cairo_ps_surface_t          *surface,
 	return CAIRO_INT_STATUS_UNSUPPORTED;
 
     /* ensure params_string is null terminated */
-    params_string = malloc (eps_params_string_len + 1);
+    params_string = _cairo_malloc (eps_params_string_len + 1);
     memcpy (params_string, eps_params_string, eps_params_string_len);
     params_string[eps_params_string_len] = 0;
     status = _cairo_tag_parse_eps_params (params_string, &eps_params);
diff --git a/src/cairo-qt-surface.cpp b/src/cairo-qt-surface.cpp
index 25c60a8d8..5f669d8be 100644
--- a/src/cairo-qt-surface.cpp
+++ b/src/cairo-qt-surface.cpp
@@ -631,7 +631,7 @@ map_qimage_to_image (QImage *qimg, const cairo_rectangle_int_t *extents)
 	return _cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
     }
 
-    surface = (struct _qimage_surface *) malloc (sizeof(*surface));
+    surface = (struct _qimage_surface *) _cairo_malloc (sizeof(*surface));
     if (unlikely (surface == NULL)) {
 	pixman_image_unref (pixman_image);
 	delete qimg;
@@ -1530,7 +1530,7 @@ cairo_qt_surface_create (QPainter *painter)
 {
     cairo_qt_surface_t *qs;
 
-    qs = (cairo_qt_surface_t *) malloc (sizeof(cairo_qt_surface_t));
+    qs = (cairo_qt_surface_t *) _cairo_malloc (sizeof(cairo_qt_surface_t));
     if (qs == NULL)
         return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1569,7 +1569,7 @@ cairo_qt_surface_create_with_qimage (cairo_format_t format,
 {
     cairo_qt_surface_t *qs;
 
-    qs = (cairo_qt_surface_t *) malloc (sizeof(cairo_qt_surface_t));
+    qs = (cairo_qt_surface_t *) _cairo_malloc (sizeof(cairo_qt_surface_t));
     if (qs == NULL)
         return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1618,7 +1618,7 @@ cairo_qt_surface_create_with_qpixmap (cairo_content_t content,
     if ((content & CAIRO_CONTENT_COLOR) == 0)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_CONTENT));
 
-    qs = (cairo_qt_surface_t *) malloc (sizeof(cairo_qt_surface_t));
+    qs = (cairo_qt_surface_t *) _cairo_malloc (sizeof(cairo_qt_surface_t));
     if (qs == NULL)
         return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-quartz-font.c b/src/cairo-quartz-font.c
index 472214216..f7ef21e43 100644
--- a/src/cairo-quartz-font.c
+++ b/src/cairo-quartz-font.c
@@ -196,7 +196,7 @@ _cairo_quartz_font_face_create_for_toy (cairo_toy_font_face_t   *toy_face,
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
     family = toy_face->family;
-    full_name = malloc (strlen (family) + 64); // give us a bit of room to tack on Bold, Oblique, etc.
+    full_name = _cairo_malloc (strlen (family) + 64); // give us a bit of room to tack on Bold, Oblique, etc.
     /* handle CSS-ish faces */
     if (!strcmp(family, "serif") || !strcmp(family, "Times Roman"))
 	family = "Times";
@@ -283,7 +283,7 @@ _cairo_quartz_font_face_scaled_font_create (void *abstract_face,
     if (!_cairo_quartz_font_symbols_present)
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
-    font = malloc(sizeof(cairo_quartz_scaled_font_t));
+    font = _cairo_malloc(sizeof(cairo_quartz_scaled_font_t));
     if (font == NULL)
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -375,7 +375,7 @@ cairo_quartz_font_face_create_for_cgfont (CGFontRef font)
 
     quartz_font_ensure_symbols();
 
-    font_face = malloc (sizeof (cairo_quartz_font_face_t));
+    font_face = _cairo_malloc (sizeof (cairo_quartz_font_face_t));
     if (!font_face) {
 	cairo_status_t ignore_status;
 	ignore_status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-quartz-image-surface.c b/src/cairo-quartz-image-surface.c
index 8dc3c79c5..c423854f9 100644
--- a/src/cairo-quartz-image-surface.c
+++ b/src/cairo-quartz-image-surface.c
@@ -332,7 +332,7 @@ cairo_quartz_image_surface_create (cairo_surface_t *surface)
     if (format != CAIRO_FORMAT_ARGB32 && format != CAIRO_FORMAT_RGB24)
 	return SURFACE_ERROR_INVALID_FORMAT;
 
-    qisurf = malloc(sizeof(cairo_quartz_image_surface_t));
+    qisurf = _cairo_malloc(sizeof(cairo_quartz_image_surface_t));
     if (qisurf == NULL)
 	return SURFACE_ERROR_NO_MEMORY;
 
diff --git a/src/cairo-quartz-surface.c b/src/cairo-quartz-surface.c
index e047b2280..06b48bb11 100644
--- a/src/cairo-quartz-surface.c
+++ b/src/cairo-quartz-surface.c
@@ -826,7 +826,7 @@ _cairo_surface_to_cgimage (cairo_surface_t       *source,
 	}
     }
 
-    source_img = malloc (sizeof (quartz_source_image_t));
+    source_img = _cairo_malloc (sizeof (quartz_source_image_t));
     if (unlikely (source_img == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -984,7 +984,7 @@ _cairo_quartz_cairo_repeating_surface_pattern_to_quartz (cairo_quartz_surface_t
     if (unlikely (status))
 	return status;
 
-    info = malloc (sizeof (SurfacePatternDrawInfo));
+    info = _cairo_malloc (sizeof (SurfacePatternDrawInfo));
     if (unlikely (!info))
 	return CAIRO_STATUS_NO_MEMORY;
 
@@ -2253,7 +2253,7 @@ _cairo_quartz_surface_create_internal (CGContextRef cgContext,
     quartz_ensure_symbols ();
 
     /* Init the base surface */
-    surface = malloc (sizeof (cairo_quartz_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_quartz_surface_t));
     if (unlikely (surface == NULL))
 	return (cairo_quartz_surface_t*) _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -2401,7 +2401,7 @@ cairo_quartz_surface_create (cairo_format_t format,
     }
 
     /* The Apple docs say that for best performance, the stride and the data
-     * pointer should be 16-byte aligned.  malloc already aligns to 16-bytes,
+     * pointer should be 16-byte aligned.  _cairo_malloc already aligns to 16-bytes,
      * so we don't have to anything special on allocation.
      */
     stride = (stride + 15) & ~15;
diff --git a/src/cairo-recording-surface.c b/src/cairo-recording-surface.c
index 84449522d..6df8b0821 100644
--- a/src/cairo-recording-surface.c
+++ b/src/cairo-recording-surface.c
@@ -158,7 +158,7 @@ static int bbtree_left_or_right (struct bbtree *bbt,
 static struct bbtree *
 bbtree_new (const cairo_box_t *box, cairo_command_header_t *chain)
 {
-    struct bbtree *bbt = malloc (sizeof (*bbt));
+    struct bbtree *bbt = _cairo_malloc (sizeof (*bbt));
     if (bbt == NULL)
 	return NULL;
     bbt->extents = *box;
@@ -386,7 +386,7 @@ cairo_recording_surface_create (cairo_content_t		 content,
 {
     cairo_recording_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_recording_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_recording_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -562,7 +562,7 @@ attach_proxy (cairo_surface_t *source,
 {
     struct proxy *proxy;
 
-    proxy = malloc (sizeof (*proxy));
+    proxy = _cairo_malloc (sizeof (*proxy));
     if (unlikely (proxy == NULL))
 	return _cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -728,7 +728,7 @@ _cairo_recording_surface_paint (void			  *abstract_surface,
     if (unlikely (status))
 	return status;
 
-    command = malloc (sizeof (cairo_command_paint_t));
+    command = _cairo_malloc (sizeof (cairo_command_paint_t));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_COMPOSITE;
@@ -784,7 +784,7 @@ _cairo_recording_surface_mask (void			*abstract_surface,
     if (unlikely (status))
 	return status;
 
-    command = malloc (sizeof (cairo_command_mask_t));
+    command = _cairo_malloc (sizeof (cairo_command_mask_t));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_COMPOSITE;
@@ -852,7 +852,7 @@ _cairo_recording_surface_stroke (void			*abstract_surface,
     if (unlikely (status))
 	return status;
 
-    command = malloc (sizeof (cairo_command_stroke_t));
+    command = _cairo_malloc (sizeof (cairo_command_stroke_t));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_COMPOSITE;
@@ -928,7 +928,7 @@ _cairo_recording_surface_fill (void			*abstract_surface,
     if (unlikely (status))
 	return status;
 
-    command = malloc (sizeof (cairo_command_fill_t));
+    command = _cairo_malloc (sizeof (cairo_command_fill_t));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_COMPOSITE;
@@ -1010,7 +1010,7 @@ _cairo_recording_surface_show_text_glyphs (void				*abstract_surface,
     if (unlikely (status))
 	return status;
 
-    command = malloc (sizeof (cairo_command_show_text_glyphs_t));
+    command = _cairo_malloc (sizeof (cairo_command_show_text_glyphs_t));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_COMPOSITE;
@@ -1034,7 +1034,7 @@ _cairo_recording_surface_show_text_glyphs (void				*abstract_surface,
     command->num_clusters = num_clusters;
 
     if (utf8_len) {
-	command->utf8 = malloc (utf8_len);
+	command->utf8 = _cairo_malloc (utf8_len);
 	if (unlikely (command->utf8 == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto CLEANUP_ARRAYS;
@@ -1192,7 +1192,7 @@ _cairo_recording_surface_copy__paint (cairo_recording_surface_t *surface,
     cairo_command_paint_t *command;
     cairo_status_t status;
 
-    command = malloc (sizeof (*command));
+    command = _cairo_malloc (sizeof (*command));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto err;
@@ -1226,7 +1226,7 @@ _cairo_recording_surface_copy__mask (cairo_recording_surface_t *surface,
     cairo_command_mask_t *command;
     cairo_status_t status;
 
-    command = malloc (sizeof (*command));
+    command = _cairo_malloc (sizeof (*command));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto err;
@@ -1267,7 +1267,7 @@ _cairo_recording_surface_copy__stroke (cairo_recording_surface_t *surface,
     cairo_command_stroke_t *command;
     cairo_status_t status;
 
-    command = malloc (sizeof (*command));
+    command = _cairo_malloc (sizeof (*command));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto err;
@@ -1319,7 +1319,7 @@ _cairo_recording_surface_copy__fill (cairo_recording_surface_t *surface,
     cairo_command_fill_t *command;
     cairo_status_t status;
 
-    command = malloc (sizeof (*command));
+    command = _cairo_malloc (sizeof (*command));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto err;
@@ -1363,7 +1363,7 @@ _cairo_recording_surface_copy__glyphs (cairo_recording_surface_t *surface,
     cairo_command_show_text_glyphs_t *command;
     cairo_status_t status;
 
-    command = malloc (sizeof (*command));
+    command = _cairo_malloc (sizeof (*command));
     if (unlikely (command == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto err;
@@ -1384,7 +1384,7 @@ _cairo_recording_surface_copy__glyphs (cairo_recording_surface_t *surface,
     command->num_clusters = src->show_text_glyphs.num_clusters;
 
     if (command->utf8_len) {
-	command->utf8 = malloc (command->utf8_len);
+	command->utf8 = _cairo_malloc (command->utf8_len);
 	if (unlikely (command->utf8 == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto err_arrays;
@@ -1560,7 +1560,7 @@ _cairo_recording_surface_snapshot (void *abstract_other)
     cairo_recording_surface_t *surface;
     cairo_status_t status;
 
-    surface = malloc (sizeof (cairo_recording_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_recording_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-scaled-font-subsets.c b/src/cairo-scaled-font-subsets.c
index a239ec9b3..5c1afd2d0 100644
--- a/src/cairo-scaled-font-subsets.c
+++ b/src/cairo-scaled-font-subsets.c
@@ -167,7 +167,7 @@ _cairo_sub_font_glyph_create (unsigned long	scaled_font_glyph_index,
 {
     cairo_sub_font_glyph_t *sub_font_glyph;
 
-    sub_font_glyph = malloc (sizeof (cairo_sub_font_glyph_t));
+    sub_font_glyph = _cairo_malloc (sizeof (cairo_sub_font_glyph_t));
     if (unlikely (sub_font_glyph == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return NULL;
@@ -277,7 +277,7 @@ _cairo_sub_font_create (cairo_scaled_font_subsets_t	*parent,
     cairo_sub_font_t *sub_font;
     int i;
 
-    sub_font = malloc (sizeof (cairo_sub_font_t));
+    sub_font = _cairo_malloc (sizeof (cairo_sub_font_t));
     if (unlikely (sub_font == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -404,7 +404,7 @@ _cairo_sub_font_glyph_lookup_unicode (cairo_scaled_font_t    *scaled_font,
     if (unicode != (uint32_t) -1) {
 	len = _cairo_ucs4_to_utf8 (unicode, buf);
 	if (len > 0) {
-	    *utf8_out = malloc (len + 1);
+	    *utf8_out = _cairo_malloc (len + 1);
 	    if (unlikely (*utf8_out == NULL))
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -441,7 +441,7 @@ _cairo_sub_font_glyph_map_to_unicode (cairo_sub_font_glyph_t *sub_font_glyph,
 	    }
 	} else {
 	    /* No existing mapping. Use the requested mapping */
-	    sub_font_glyph->utf8 = malloc (utf8_len + 1);
+	    sub_font_glyph->utf8 = _cairo_malloc (utf8_len + 1);
 	    if (unlikely (sub_font_glyph->utf8 == NULL))
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -611,7 +611,7 @@ _cairo_sub_font_map_glyph (cairo_sub_font_t	*sub_font,
 		if (ucs4_len == 1) {
 		    font_unicode = ucs4[0];
 		    free (font_utf8);
-		    font_utf8 = malloc (text_utf8_len + 1);
+		    font_utf8 = _cairo_malloc (text_utf8_len + 1);
 		    if (font_utf8 == NULL) {
 			free (ucs4);
 			return _cairo_error (CAIRO_STATUS_NO_MEMORY);
@@ -762,7 +762,7 @@ _cairo_scaled_font_subsets_create_internal (cairo_subsets_type_t type)
 {
     cairo_scaled_font_subsets_t *subsets;
 
-    subsets = malloc (sizeof (cairo_scaled_font_subsets_t));
+    subsets = _cairo_malloc (sizeof (cairo_scaled_font_subsets_t));
     if (unlikely (subsets == NULL)) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return NULL;
@@ -1217,7 +1217,7 @@ _cairo_string_init_key (cairo_string_entry_t *key, char *s)
 static cairo_status_t
 create_string_entry (char *s, cairo_string_entry_t **entry)
 {
-    *entry = malloc (sizeof (cairo_string_entry_t));
+    *entry = _cairo_malloc (sizeof (cairo_string_entry_t));
     if (unlikely (*entry == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-scaled-font.c b/src/cairo-scaled-font.c
index 458857020..f7a36c1df 100644
--- a/src/cairo-scaled-font.c
+++ b/src/cairo-scaled-font.c
@@ -368,7 +368,7 @@ _cairo_scaled_font_map_lock (void)
     CAIRO_MUTEX_LOCK (_cairo_scaled_font_map_mutex);
 
     if (cairo_scaled_font_map == NULL) {
-	cairo_scaled_font_map = malloc (sizeof (cairo_scaled_font_map_t));
+	cairo_scaled_font_map = _cairo_malloc (sizeof (cairo_scaled_font_map_t));
 	if (unlikely (cairo_scaled_font_map == NULL))
 	    goto CLEANUP_MUTEX_LOCK;
 
@@ -509,7 +509,7 @@ _cairo_scaled_font_register_placeholder_and_unlock_font_map (cairo_scaled_font_t
     if (unlikely (status))
 	return status;
 
-    placeholder_scaled_font = malloc (sizeof (cairo_scaled_font_t));
+    placeholder_scaled_font = _cairo_malloc (sizeof (cairo_scaled_font_t));
     if (unlikely (placeholder_scaled_font == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1226,7 +1226,7 @@ _cairo_scaled_font_create_in_error (cairo_status_t status)
     CAIRO_MUTEX_LOCK (_cairo_scaled_font_error_mutex);
     scaled_font = _cairo_scaled_font_nil_objects[status];
     if (unlikely (scaled_font == NULL)) {
-	scaled_font = malloc (sizeof (cairo_scaled_font_t));
+	scaled_font = _cairo_malloc (sizeof (cairo_scaled_font_t));
 	if (unlikely (scaled_font == NULL)) {
 	    CAIRO_MUTEX_UNLOCK (_cairo_scaled_font_error_mutex);
 	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
@@ -2875,7 +2875,7 @@ _cairo_scaled_font_allocate_glyph (cairo_scaled_font_t *scaled_font,
         }
     }
 
-    page = malloc (sizeof (cairo_scaled_glyph_page_t));
+    page = _cairo_malloc (sizeof (cairo_scaled_glyph_page_t));
     if (unlikely (page == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-script-surface.c b/src/cairo-script-surface.c
index 91e4baae7..e715cae50 100644
--- a/src/cairo-script-surface.c
+++ b/src/cairo-script-surface.c
@@ -263,7 +263,7 @@ _bitmap_next_id (struct _bitmap *b,
 	b = b->next;
     } while (b != NULL);
 
-    bb = malloc (sizeof (struct _bitmap));
+    bb = _cairo_malloc (sizeof (struct _bitmap));
     if (unlikely (bb == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1104,7 +1104,7 @@ attach_snapshot (cairo_script_context_t *ctx,
     if (! ctx->attach_snapshots)
 	return;
 
-    surface = malloc (sizeof (*surface));
+    surface = _cairo_malloc (sizeof (*surface));
     if (unlikely (surface == NULL))
 	return;
 
@@ -1255,7 +1255,7 @@ _write_image_surface (cairo_output_stream_t *output,
     }
 #else
     if (stride > ARRAY_LENGTH (row_stack)) {
-	rowdata = malloc (stride);
+	rowdata = _cairo_malloc (stride);
 	if (unlikely (rowdata == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     } else
@@ -2178,7 +2178,7 @@ _cairo_script_surface_finish (void *abstract_surface)
 		}
 		cairo_list_del (&surface->operand.link);
 	    } else {
-		struct deferred_finish *link = malloc (sizeof (*link));
+		struct deferred_finish *link = _cairo_malloc (sizeof (*link));
 		if (link == NULL) {
 		    status2 = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 		    if (status == CAIRO_STATUS_SUCCESS)
@@ -2857,7 +2857,7 @@ _emit_type42_font (cairo_script_surface_t *surface,
     if (unlikely (status))
 	return status;
 
-    buf = malloc (size);
+    buf = _cairo_malloc (size);
     if (unlikely (buf == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -2913,7 +2913,7 @@ _emit_scaled_font_init (cairo_script_surface_t *surface,
     cairo_script_font_t *font_private;
     cairo_int_status_t status;
 
-    font_private = malloc (sizeof (cairo_script_font_t));
+    font_private = _cairo_malloc (sizeof (cairo_script_font_t));
     if (unlikely (font_private == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -3643,7 +3643,7 @@ _cairo_script_surface_create_internal (cairo_script_context_t *ctx,
     if (unlikely (ctx == NULL))
 	return (cairo_script_surface_t *) _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NULL_POINTER));
 
-    surface = malloc (sizeof (cairo_script_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_script_surface_t));
     if (unlikely (surface == NULL))
 	return (cairo_script_surface_t *) _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -3692,7 +3692,7 @@ _cairo_script_context_create_internal (cairo_output_stream_t *stream)
 {
     cairo_script_context_t *ctx;
 
-    ctx = malloc (sizeof (cairo_script_context_t));
+    ctx = _cairo_malloc (sizeof (cairo_script_context_t));
     if (unlikely (ctx == NULL))
 	return _cairo_device_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-skia-surface.cpp b/src/cairo-skia-surface.cpp
index 0282c2b51..aeb69cfcd 100644
--- a/src/cairo-skia-surface.cpp
+++ b/src/cairo-skia-surface.cpp
@@ -1043,7 +1043,7 @@ _cairo_skia_surface_create_internal (SkBitmap::Config config,
     cairo_skia_surface_t *surface;
     cairo_format_t format;
 
-    surface = (cairo_skia_surface_t *) malloc (sizeof (cairo_skia_surface_t));
+    surface = (cairo_skia_surface_t *) _cairo_malloc (sizeof (cairo_skia_surface_t));
     if (surface == NULL)
 	return (cairo_skia_surface_t *) _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-surface-observer.c b/src/cairo-surface-observer.c
index 89c7525c7..9c4432e24 100644
--- a/src/cairo-surface-observer.c
+++ b/src/cairo-surface-observer.c
@@ -348,7 +348,7 @@ _cairo_device_create_observer_internal (cairo_device_t *target,
     cairo_device_observer_t *device;
     cairo_status_t status;
 
-    device = malloc (sizeof (cairo_device_observer_t));
+    device = _cairo_malloc (sizeof (cairo_device_observer_t));
     if (unlikely (device == NULL))
 	return _cairo_device_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -379,7 +379,7 @@ _cairo_surface_create_observer_internal (cairo_device_t *device,
     cairo_surface_observer_t *surface;
     cairo_status_t status;
 
-    surface = malloc (sizeof (cairo_surface_observer_t));
+    surface = _cairo_malloc (sizeof (cairo_surface_observer_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1418,7 +1418,7 @@ _cairo_surface_observer_add_callback (cairo_list_t *head,
 {
     struct callback_list *cb;
 
-    cb = malloc (sizeof (*cb));
+    cb = _cairo_malloc (sizeof (*cb));
     if (unlikely (cb == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-surface-snapshot.c b/src/cairo-surface-snapshot.c
index 3477ac574..c8f307843 100644
--- a/src/cairo-surface-snapshot.c
+++ b/src/cairo-surface-snapshot.c
@@ -99,7 +99,7 @@ _cairo_surface_snapshot_acquire_source_image (void                    *abstract_
     struct snapshot_extra *extra;
     cairo_status_t status;
 
-    extra = malloc (sizeof (*extra));
+    extra = _cairo_malloc (sizeof (*extra));
     if (unlikely (extra == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -258,7 +258,7 @@ _cairo_surface_snapshot (cairo_surface_t *surface)
     if (snapshot != NULL)
 	return cairo_surface_reference (&snapshot->base);
 
-    snapshot = malloc (sizeof (cairo_surface_snapshot_t));
+    snapshot = _cairo_malloc (sizeof (cairo_surface_snapshot_t));
     if (unlikely (snapshot == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_SURFACE_FINISHED));
 
diff --git a/src/cairo-surface-subsurface.c b/src/cairo-surface-subsurface.c
index 5b7ce0ce7..b2a10e9bc 100644
--- a/src/cairo-surface-subsurface.c
+++ b/src/cairo-surface-subsurface.c
@@ -462,7 +462,7 @@ cairo_surface_create_for_rectangle (cairo_surface_t *target,
     if (unlikely (target->finished))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_SURFACE_FINISHED));
 
-    surface = malloc (sizeof (cairo_surface_subsurface_t));
+    surface = _cairo_malloc (sizeof (cairo_surface_subsurface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -522,7 +522,7 @@ _cairo_surface_create_for_rectangle_int (cairo_surface_t *target,
 
     assert (target->backend->type != CAIRO_SURFACE_TYPE_SUBSURFACE);
 
-    surface = malloc (sizeof (cairo_surface_subsurface_t));
+    surface = _cairo_malloc (sizeof (cairo_surface_subsurface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-surface.c b/src/cairo-surface.c
index 5580b153c..596ca250d 100644
--- a/src/cairo-surface.c
+++ b/src/cairo-surface.c
@@ -1438,7 +1438,7 @@ cairo_surface_set_mime_data (cairo_surface_t		*surface,
 	return _cairo_surface_set_error (surface, status);
 
     if (data != NULL) {
-	mime_data = malloc (sizeof (cairo_mime_data_t));
+	mime_data = _cairo_malloc (sizeof (cairo_mime_data_t));
 	if (unlikely (mime_data == NULL))
 	    return _cairo_surface_set_error (surface, _cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-svg-surface.c b/src/cairo-svg-surface.c
index c2ef83efa..4b8b9ef4e 100644
--- a/src/cairo-svg-surface.c
+++ b/src/cairo-svg-surface.c
@@ -554,7 +554,7 @@ _cairo_svg_surface_add_source_surface (cairo_svg_surface_t  *surface,
 	unique_id_length = 0;
     }
 
-    source_entry = malloc (sizeof (cairo_svg_source_surface_t));
+    source_entry = _cairo_malloc (sizeof (cairo_svg_source_surface_t));
     if (source_entry == NULL) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto fail;
@@ -656,7 +656,7 @@ _cairo_svg_surface_create_for_document (cairo_svg_document_t	*document,
     cairo_surface_t *paginated;
     cairo_status_t status, status_ignored;
 
-    surface = malloc (sizeof (cairo_svg_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_svg_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -2862,7 +2862,7 @@ _cairo_svg_document_create (cairo_output_stream_t	 *output_stream,
     if (output_stream->status)
 	return output_stream->status;
 
-    document = malloc (sizeof (cairo_svg_document_t));
+    document = _cairo_malloc (sizeof (cairo_svg_document_t));
     if (unlikely (document == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-tag-attributes.c b/src/cairo-tag-attributes.c
index 91cd5aebf..44b1147fb 100644
--- a/src/cairo-tag-attributes.c
+++ b/src/cairo-tag-attributes.c
@@ -267,7 +267,7 @@ parse_string (const char *p, char **s)
     if (!end)
 	return NULL;
 
-    *s = malloc (len + 1);
+    *s = _cairo_malloc (len + 1);
     decode_string (p, &len, *s);
     (*s)[len] = 0;
 
@@ -341,7 +341,7 @@ parse_name (const char *p, const char **end, char **s)
 	p2++;
 
     len = p2 - p;
-    name = malloc (len + 1);
+    name = _cairo_malloc (len + 1);
     if (unlikely (name == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-tag-stack.c b/src/cairo-tag-stack.c
index e7c49094e..7c2d5245e 100644
--- a/src/cairo-tag-stack.c
+++ b/src/cairo-tag-stack.c
@@ -182,7 +182,7 @@ _cairo_tag_stack_push (cairo_tag_stack_t *stack,
 	}
     }
 
-    elem = malloc (sizeof(cairo_tag_stack_elem_t));
+    elem = _cairo_malloc (sizeof(cairo_tag_stack_elem_t));
     if (unlikely (elem == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-tee-surface.c b/src/cairo-tee-surface.c
index 48e9d436f..7a94c9bca 100644
--- a/src/cairo-tee-surface.c
+++ b/src/cairo-tee-surface.c
@@ -428,7 +428,7 @@ cairo_tee_surface_create (cairo_surface_t *master)
     if (unlikely (master->status))
 	return _cairo_surface_create_in_error (master->status);
 
-    surface = malloc (sizeof (cairo_tee_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_tee_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-tor-scan-converter.c b/src/cairo-tor-scan-converter.c
index b1b51872b..c11948ea0 100644
--- a/src/cairo-tor-scan-converter.c
+++ b/src/cairo-tor-scan-converter.c
@@ -288,7 +288,7 @@ struct _pool_chunk {
 /* A memory pool.  This is supposed to be embedded on the stack or
  * within some other structure.	 It may optionally be followed by an
  * embedded array from which requests are fulfilled until
- * malloc needs to be called to allocate a first real chunk. */
+ * _cairo_malloc needs to be called to allocate a first real chunk. */
 struct pool {
     /* Chunk we're allocating from. */
     struct _pool_chunk *current;
@@ -483,7 +483,7 @@ _pool_chunk_create(struct pool *pool, size_t size)
 {
     struct _pool_chunk *p;
 
-    p = malloc(SIZEOF_POOL_CHUNK + size);
+    p = _cairo_malloc(SIZEOF_POOL_CHUNK + size);
     if (unlikely (NULL == p))
 	longjmp (*pool->jmp, _cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1872,7 +1872,7 @@ _cairo_tor_scan_converter_create (int			xmin,
     cairo_tor_scan_converter_t *self;
     cairo_status_t status;
 
-    self = malloc (sizeof(struct _cairo_tor_scan_converter));
+    self = _cairo_malloc (sizeof(struct _cairo_tor_scan_converter));
     if (unlikely (self == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto bail_nomem;
diff --git a/src/cairo-tor22-scan-converter.c b/src/cairo-tor22-scan-converter.c
index 4cec5ee4f..f91c70ed5 100644
--- a/src/cairo-tor22-scan-converter.c
+++ b/src/cairo-tor22-scan-converter.c
@@ -287,7 +287,7 @@ struct _pool_chunk {
 /* A memory pool.  This is supposed to be embedded on the stack or
  * within some other structure.	 It may optionally be followed by an
  * embedded array from which requests are fulfilled until
- * malloc needs to be called to allocate a first real chunk. */
+ * _cairo_malloc needs to be called to allocate a first real chunk. */
 struct pool {
     /* Chunk we're allocating from. */
     struct _pool_chunk *current;
@@ -504,7 +504,7 @@ _pool_chunk_create(struct pool *pool, size_t size)
 {
     struct _pool_chunk *p;
 
-    p = malloc(size + sizeof(struct _pool_chunk));
+    p = _cairo_malloc(size + sizeof(struct _pool_chunk));
     if (unlikely (NULL == p))
 	longjmp (*pool->jmp, _cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1682,7 +1682,7 @@ _cairo_tor22_scan_converter_create (int			xmin,
     cairo_tor22_scan_converter_t *self;
     cairo_status_t status;
 
-    self = malloc (sizeof(struct _cairo_tor22_scan_converter));
+    self = _cairo_malloc (sizeof(struct _cairo_tor22_scan_converter));
     if (unlikely (self == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto bail_nomem;
diff --git a/src/cairo-toy-font-face.c b/src/cairo-toy-font-face.c
index 516f39195..3d2217dae 100644
--- a/src/cairo-toy-font-face.c
+++ b/src/cairo-toy-font-face.c
@@ -312,7 +312,7 @@ cairo_toy_font_face_create (const char          *family,
     }
 
     /* Otherwise create it and insert into hash table. */
-    font_face = malloc (sizeof (cairo_toy_font_face_t));
+    font_face = _cairo_malloc (sizeof (cairo_toy_font_face_t));
     if (unlikely (font_face == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto UNWIND_HASH_TABLE_LOCK;
diff --git a/src/cairo-truetype-subset.c b/src/cairo-truetype-subset.c
index cbf85fa13..781bc2296 100644
--- a/src/cairo-truetype-subset.c
+++ b/src/cairo-truetype-subset.c
@@ -193,7 +193,7 @@ _cairo_truetype_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
     if (unlikely (status))
 	return status;
 
-    font = malloc (sizeof (cairo_truetype_font_t));
+    font = _cairo_malloc (sizeof (cairo_truetype_font_t));
     if (unlikely (font == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -246,7 +246,7 @@ _cairo_truetype_font_create (cairo_scaled_font_subset_t  *scaled_font_subset,
 
     /* If the PS name is not found, create a CairoFont-x-y name. */
     if (font->base.ps_name == NULL) {
-        font->base.ps_name = malloc (30);
+        font->base.ps_name = _cairo_malloc (30);
         if (unlikely (font->base.ps_name == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
             goto fail3;
@@ -622,7 +622,7 @@ cairo_truetype_font_write_glyf_table (cairo_truetype_font_t *font,
     else
 	size = sizeof (int32_t) * (font->base.num_glyphs_in_face + 1);
 
-    u.bytes = malloc (size);
+    u.bytes = _cairo_malloc (size);
     if (unlikely (u.bytes == NULL))
 	return _cairo_truetype_font_set_error (font, CAIRO_STATUS_NO_MEMORY);
 
@@ -1195,7 +1195,7 @@ cairo_truetype_subset_init_internal (cairo_truetype_subset_t     *truetype_subse
     truetype_subset->descent = (double)font->base.descent/font->base.units_per_em;
 
     if (length) {
-	truetype_subset->data = malloc (length);
+    truetype_subset->data = _cairo_malloc (length);
 	if (unlikely (truetype_subset->data == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto fail4;
@@ -1208,7 +1208,7 @@ cairo_truetype_subset_init_internal (cairo_truetype_subset_t     *truetype_subse
 
     if (num_strings) {
 	offsets_length = num_strings * sizeof (unsigned long);
-	truetype_subset->string_offsets = malloc (offsets_length);
+    truetype_subset->string_offsets = _cairo_malloc (offsets_length);
 	if (unlikely (truetype_subset->string_offsets == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto fail5;
@@ -1296,7 +1296,11 @@ _cairo_truetype_reverse_cmap (cairo_scaled_font_t *scaled_font,
 	return CAIRO_INT_STATUS_UNSUPPORTED;
 
     size = be16_to_cpu (map->length);
-    map = malloc (size);
+    /* minimum table size is 24 bytes */
+    if (size < 24)
+    return CAIRO_INT_STATUS_UNSUPPORTED;
+
+    map = _cairo_malloc (size);
     if (unlikely (map == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1462,7 +1466,7 @@ find_name (tt_name_t *name, int name_id, int platform, int encoding, int languag
 	    if (len > MAX_FONT_NAME_LENGTH)
 		break;
 
-	    str = malloc (len + 1);
+        str = _cairo_malloc (len + 1);
 	    if (str == NULL)
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1488,7 +1492,7 @@ find_name (tt_name_t *name, int name_id, int platform, int encoding, int languag
 	for (i = 0; i < u_len; i++)
 	    size += _cairo_ucs4_to_utf8 (be16_to_cpu(u[i]), NULL);
 
-	utf8 = malloc (size + 1);
+    utf8 = _cairo_malloc (size + 1);
 	if (utf8 == NULL) {
 	    status =_cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto fail;
@@ -1523,7 +1527,7 @@ find_name (tt_name_t *name, int name_id, int platform, int encoding, int languag
 	}
     }
     if (has_tag) {
-	p = malloc (len - 6);
+    p = _cairo_malloc (len - 6);
 	if (unlikely (p == NULL)) {
 	    status =_cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto fail;
@@ -1568,7 +1572,7 @@ _cairo_truetype_read_font_name (cairo_scaled_font_t  	 *scaled_font,
     if (status)
 	return status;
 
-    name = malloc (size);
+    name = _cairo_malloc (size);
     if (name == NULL)
         return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-type1-fallback.c b/src/cairo-type1-fallback.c
index c8e7e908b..0b8e66cd0 100644
--- a/src/cairo-type1-fallback.c
+++ b/src/cairo-type1-fallback.c
@@ -760,7 +760,7 @@ _cairo_type1_fallback_init_internal (cairo_type1_subset_t	*type1_subset,
 
     length = font->header_size + font->data_size +
 	font->trailer_size;
-    type1_subset->data = malloc (length);
+    type1_subset->data = _cairo_malloc (length);
     if (unlikely (type1_subset->data == NULL)) {
         status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto fail3;
diff --git a/src/cairo-type1-subset.c b/src/cairo-type1-subset.c
index 4dd7ac17e..89cb96f2e 100644
--- a/src/cairo-type1-subset.c
+++ b/src/cairo-type1-subset.c
@@ -326,7 +326,7 @@ cairo_type1_font_subset_get_matrix (cairo_type1_font_subset_t *font,
 	return CAIRO_INT_STATUS_UNSUPPORTED;
 
     s_max = end - start + 5*decimal_point_len + 1;
-    s = malloc (s_max);
+    s = _cairo_malloc (s_max);
     if (unlikely (s == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -420,7 +420,7 @@ cairo_type1_font_subset_get_fontname (cairo_type1_font_subset_t *font)
     while (end > start && _cairo_isspace(end[-1]))
 	end--;
 
-    s = malloc (end - start + 1);
+    s = _cairo_malloc (end - start + 1);
     if (unlikely (s == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -624,7 +624,7 @@ cairo_type1_font_subset_decrypt_eexec_segment (cairo_type1_font_subset_t *font)
     in = (unsigned char *) font->eexec_segment;
     end = (unsigned char *) in + font->eexec_segment_size;
 
-    font->cleartext = malloc (font->eexec_segment_size + 1);
+    font->cleartext = _cairo_malloc (font->eexec_segment_size + 1);
     if (unlikely (font->cleartext == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -783,7 +783,7 @@ cairo_type1_font_subset_parse_charstring (cairo_type1_font_subset_t *font,
     const unsigned char *p;
     int command;
 
-    charstring = malloc (encrypted_charstring_length);
+    charstring = _cairo_malloc (encrypted_charstring_length);
     if (unlikely (charstring == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1096,7 +1096,7 @@ cairo_type1_font_subset_build_glyph_list (cairo_type1_font_subset_t *font,
     glyph_data_t glyph;
     cairo_status_t status;
 
-    s = malloc (name_length + 1);
+    s = _cairo_malloc (name_length + 1);
     if (unlikely (s == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1285,7 +1285,7 @@ cairo_type1_font_subset_write_private_dict (cairo_type1_font_subset_t *font,
         if (lenIV_end == NULL)
 	    return CAIRO_INT_STATUS_UNSUPPORTED;
 
-        lenIV_str = malloc (lenIV_end - lenIV_start + 1);
+        lenIV_str = _cairo_malloc (lenIV_end - lenIV_start + 1);
         if (unlikely (lenIV_str == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1642,7 +1642,7 @@ cairo_type1_font_subset_generate (void       *abstract_font,
 	return CAIRO_INT_STATUS_UNSUPPORTED;
 
     font->type1_length = data_length;
-    font->type1_data = malloc (font->type1_length);
+    font->type1_data = _cairo_malloc (font->type1_length);
     if (unlikely (font->type1_data == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1768,7 +1768,7 @@ _cairo_type1_subset_init (cairo_type1_subset_t		*type1_subset,
     length = font.base.header_size +
 	     font.base.data_size +
 	     font.base.trailer_size;
-    type1_subset->data = malloc (length);
+    type1_subset->data = _cairo_malloc (length);
     if (unlikely (type1_subset->data == NULL))
 	goto fail3;
 
diff --git a/src/cairo-type3-glyph-surface.c b/src/cairo-type3-glyph-surface.c
index 86c24ed4c..6b2102319 100644
--- a/src/cairo-type3-glyph-surface.c
+++ b/src/cairo-type3-glyph-surface.c
@@ -82,7 +82,7 @@ _cairo_type3_glyph_surface_create (cairo_scaled_font_t			 *scaled_font,
     if (unlikely (stream != NULL && stream->status))
 	return _cairo_surface_create_in_error (stream->status);
 
-    surface = malloc (sizeof (cairo_type3_glyph_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_type3_glyph_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-user-font.c b/src/cairo-user-font.c
index 6d2de2097..a26fb57ee 100644
--- a/src/cairo-user-font.c
+++ b/src/cairo-user-font.c
@@ -402,7 +402,7 @@ _cairo_user_font_face_scaled_font_create (void                        *abstract_
 
     font_face->immutable = TRUE;
 
-    user_scaled_font = malloc (sizeof (cairo_user_scaled_font_t));
+    user_scaled_font = _cairo_malloc (sizeof (cairo_user_scaled_font_t));
     if (unlikely (user_scaled_font == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -544,7 +544,7 @@ cairo_user_font_face_create (void)
 {
     cairo_user_font_face_t *font_face;
 
-    font_face = malloc (sizeof (cairo_user_font_face_t));
+    font_face = _cairo_malloc (sizeof (cairo_user_font_face_t));
     if (!font_face) {
 	_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	return (cairo_font_face_t *)&_cairo_font_face_nil;
diff --git a/src/cairo-vg-surface.c b/src/cairo-vg-surface.c
index b94b7aa93..77986331a 100644
--- a/src/cairo-vg-surface.c
+++ b/src/cairo-vg-surface.c
@@ -1517,7 +1517,7 @@ _vg_surface_create_internal (cairo_vg_context_t *context,
 {
     cairo_vg_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_vg_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_vg_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1712,7 +1712,7 @@ cairo_vg_context_create_for_glx (Display *dpy, GLXContext ctx)
     cairo_vg_context_t *context;
     cairo_status_t status;
 
-    context = malloc (sizeof (*context));
+    context = _cairo_malloc (sizeof (*context));
     if (unlikely (context == NULL))
 	return (cairo_vg_context_t *) &_vg_context_nil;
 
@@ -1817,7 +1817,7 @@ cairo_vg_context_create_for_egl (EGLDisplay egl_display,
     cairo_vg_context_t *context;
     cairo_status_t status;
 
-    context = malloc (sizeof (*context));
+    context = _cairo_malloc (sizeof (*context));
     if (unlikely (context == NULL))
 	return (cairo_vg_context_t *) &_vg_context_nil;
 
diff --git a/src/cairo-xcb-connection.c b/src/cairo-xcb-connection.c
index 67897fa4e..51f5ee323 100644
--- a/src/cairo-xcb-connection.c
+++ b/src/cairo-xcb-connection.c
@@ -111,7 +111,7 @@ _cairo_xcb_connection_find_visual_formats (cairo_xcb_connection_t *connection,
 		cairo_xcb_xrender_format_t *f;
 		cairo_status_t status;
 
-		f = malloc (sizeof (cairo_xcb_xrender_format_t));
+		f = _cairo_malloc (sizeof (cairo_xcb_xrender_format_t));
 		if (unlikely (f == NULL))
 		    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -177,7 +177,7 @@ _cairo_xcb_connection_parse_xrender_formats (cairo_xcb_connection_t *connection,
 	    if (! _cairo_hash_table_lookup (connection->xrender_formats, &key)) {
 		cairo_xcb_xrender_format_t *f;
 
-		f = malloc (sizeof (cairo_xcb_xrender_format_t));
+		f = _cairo_malloc (sizeof (cairo_xcb_xrender_format_t));
 		if (unlikely (f == NULL))
 		    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -634,7 +634,7 @@ _cairo_xcb_connection_get (xcb_connection_t *xcb_connection)
 	}
     }
 
-    connection = malloc (sizeof (cairo_xcb_connection_t));
+    connection = _cairo_malloc (sizeof (cairo_xcb_connection_t));
     if (unlikely (connection == NULL))
 	goto unlock;
 
diff --git a/src/cairo-xcb-screen.c b/src/cairo-xcb-screen.c
index d0019f9cd..0d23ad3c3 100644
--- a/src/cairo-xcb-screen.c
+++ b/src/cairo-xcb-screen.c
@@ -249,7 +249,7 @@ _cairo_xcb_screen_get (xcb_connection_t *xcb_connection,
 	}
     }
 
-    screen = malloc (sizeof (cairo_xcb_screen_t));
+    screen = _cairo_malloc (sizeof (cairo_xcb_screen_t));
     if (unlikely (screen == NULL))
 	goto unlock;
 
diff --git a/src/cairo-xcb-shm.c b/src/cairo-xcb-shm.c
index 2be2dac5b..f6c05d8c6 100644
--- a/src/cairo-xcb-shm.c
+++ b/src/cairo-xcb-shm.c
@@ -50,7 +50,7 @@
 #define CAIRO_MAX_SHM_MEMORY (16*1024*1024)
 
 /* a simple buddy allocator for memory pools
- * XXX fragmentation? use Doug Lea's malloc?
+ * XXX fragmentation? use Doug Lea's _cairo_malloc?
  */
 
 typedef struct _cairo_xcb_shm_mem_block cairo_xcb_shm_mem_block_t;
@@ -209,7 +209,7 @@ _cairo_xcb_connection_allocate_shm_info (cairo_xcb_connection_t *connection,
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
 
-    pool = malloc (sizeof (cairo_xcb_shm_mem_pool_t));
+    pool = _cairo_malloc (sizeof (cairo_xcb_shm_mem_pool_t));
     if (unlikely (pool == NULL)) {
 	CAIRO_MUTEX_UNLOCK (connection->shm_mutex);
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-xcb-surface-core.c b/src/cairo-xcb-surface-core.c
index 40d0ca409..91c0ff995 100644
--- a/src/cairo-xcb-surface-core.c
+++ b/src/cairo-xcb-surface-core.c
@@ -85,7 +85,7 @@ _cairo_xcb_pixmap_create (cairo_xcb_surface_t *target,
 {
     cairo_xcb_pixmap_t *surface;
 
-    surface = malloc (sizeof (cairo_xcb_pixmap_t));
+    surface = _cairo_malloc (sizeof (cairo_xcb_pixmap_t));
     if (unlikely (surface == NULL))
 	return (cairo_xcb_pixmap_t *)
 	    _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
@@ -119,7 +119,7 @@ _cairo_xcb_pixmap_copy (cairo_xcb_surface_t *target)
 {
     cairo_xcb_pixmap_t *surface;
 
-    surface = malloc (sizeof (cairo_xcb_pixmap_t));
+    surface = _cairo_malloc (sizeof (cairo_xcb_pixmap_t));
     if (unlikely (surface == NULL))
 	return (cairo_xcb_pixmap_t *)
 	    _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
diff --git a/src/cairo-xcb-surface-render.c b/src/cairo-xcb-surface-render.c
index a4969c957..42f27c71f 100644
--- a/src/cairo-xcb-surface-render.c
+++ b/src/cairo-xcb-surface-render.c
@@ -114,7 +114,7 @@ _cairo_xcb_picture_create (cairo_xcb_screen_t *screen,
 {
     cairo_xcb_picture_t *surface;
 
-    surface = malloc (sizeof (cairo_xcb_picture_t));
+    surface = _cairo_malloc (sizeof (cairo_xcb_picture_t));
     if (unlikely (surface == NULL))
 	return (cairo_xcb_picture_t *)
 	    _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
@@ -4141,7 +4141,7 @@ _cairo_xcb_font_create (cairo_xcb_connection_t *connection,
     cairo_xcb_font_t	*priv;
     int i;
 
-    priv = malloc (sizeof (cairo_xcb_font_t));
+    priv = _cairo_malloc (sizeof (cairo_xcb_font_t));
     if (unlikely (priv == NULL))
 	return NULL;
 
@@ -4334,7 +4334,7 @@ _cairo_xcb_glyph_fini (cairo_scaled_glyph_private_t *glyph_private,
 	}
 
 	if (to_free == NULL) {
-	    to_free = malloc (sizeof (cairo_xcb_font_glyphset_free_glyphs_t));
+	    to_free = _cairo_malloc (sizeof (cairo_xcb_font_glyphset_free_glyphs_t));
 	    if (unlikely (to_free == NULL)) {
 		_cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 		return; /* XXX cannot propagate failure */
@@ -4361,7 +4361,7 @@ _cairo_xcb_glyph_attach (cairo_xcb_connection_t  *c,
 {
     cairo_xcb_glyph_private_t *priv;
 
-    priv = malloc (sizeof (*priv));
+    priv = _cairo_malloc (sizeof (*priv));
     if (unlikely (priv == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -4472,7 +4472,7 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection,
 	    if (c == 0)
 		break;
 
-	    new = malloc (c);
+	    new = _cairo_malloc (c);
 	    if (unlikely (new == NULL)) {
 		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 		goto BAIL;
@@ -4503,7 +4503,7 @@ _cairo_xcb_surface_add_glyph (cairo_xcb_connection_t *connection,
 	    if (c == 0)
 		break;
 
-	    new = malloc (4 * c);
+	    new = _cairo_malloc (4 * c);
 	    if (unlikely (new == NULL)) {
 		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 		goto BAIL;
@@ -4585,7 +4585,7 @@ _emit_glyphs_chunk (cairo_xcb_surface_t *dst,
     int i;
 
     if (estimated_req_size > ARRAY_LENGTH (stack_buf)) {
-	buf = malloc (estimated_req_size);
+	buf = _cairo_malloc (estimated_req_size);
 	if (unlikely (buf == NULL))
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
     }
diff --git a/src/cairo-xcb-surface.c b/src/cairo-xcb-surface.c
index 39127c148..7f601bb71 100644
--- a/src/cairo-xcb-surface.c
+++ b/src/cairo-xcb-surface.c
@@ -1075,7 +1075,7 @@ _cairo_xcb_surface_create_internal (cairo_xcb_screen_t		*screen,
 {
     cairo_xcb_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_xcb_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_xcb_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-xlib-display.c b/src/cairo-xlib-display.c
index a2a3bc792..add42299b 100644
--- a/src/cairo-xlib-display.c
+++ b/src/cairo-xlib-display.c
@@ -207,7 +207,7 @@ _cairo_xlib_device_create (Display *dpy)
 	}
     }
 
-    display = malloc (sizeof (cairo_xlib_display_t));
+    display = _cairo_malloc (sizeof (cairo_xlib_display_t));
     if (unlikely (display == NULL)) {
 	device = _cairo_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 	goto UNLOCK;
diff --git a/src/cairo-xlib-render-compositor.c b/src/cairo-xlib-render-compositor.c
index 4b75109e0..0db59a8a6 100644
--- a/src/cairo-xlib-render-compositor.c
+++ b/src/cairo-xlib-render-compositor.c
@@ -989,7 +989,7 @@ _cairo_xlib_font_create (cairo_xlib_display_t *display,
     cairo_xlib_font_t *priv;
     int i;
 
-    priv = malloc (sizeof (cairo_xlib_font_t));
+    priv = _cairo_malloc (sizeof (cairo_xlib_font_t));
     if (unlikely (priv == NULL))
 	return NULL;
 
@@ -1089,7 +1089,7 @@ _cairo_xlib_glyph_attach (cairo_xlib_display_t	*display,
 {
     cairo_xlib_glyph_private_t *priv;
 
-    priv = malloc (sizeof (*priv));
+    priv = _cairo_malloc (sizeof (*priv));
     if (unlikely (priv == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1290,7 +1290,7 @@ _cairo_xlib_surface_add_glyph (cairo_xlib_display_t *display,
 	    if (c == 0)
 		break;
 
-	    new = malloc (c);
+	    new = _cairo_malloc (c);
 	    if (!new) {
 		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 		goto BAIL;
@@ -1318,7 +1318,7 @@ _cairo_xlib_surface_add_glyph (cairo_xlib_display_t *display,
 	    if (c == 0)
 		break;
 
-	    new = malloc (4 * c);
+	    new = _cairo_malloc (4 * c);
 	    if (unlikely (new == NULL)) {
 		status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 		goto BAIL;
diff --git a/src/cairo-xlib-screen.c b/src/cairo-xlib-screen.c
index 57beeaab4..ff3bdfcf9 100644
--- a/src/cairo-xlib-screen.c
+++ b/src/cairo-xlib-screen.c
@@ -330,7 +330,7 @@ _cairo_xlib_screen_get (Display *dpy,
 	goto CLEANUP_DISPLAY;
     }
 
-    info = malloc (sizeof (cairo_xlib_screen_t));
+    info = _cairo_malloc (sizeof (cairo_xlib_screen_t));
     if (unlikely (info == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_DISPLAY;
diff --git a/src/cairo-xlib-source.c b/src/cairo-xlib-source.c
index d6ea06a5e..6269edca5 100644
--- a/src/cairo-xlib-source.c
+++ b/src/cairo-xlib-source.c
@@ -109,7 +109,7 @@ source (cairo_xlib_surface_t *dst, Picture picture, Pixmap pixmap)
     if (picture == None)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
-    source = malloc (sizeof (*source));
+    source = _cairo_malloc (sizeof (*source));
     if (unlikely (source == NULL)) {
 	XRenderFreePicture (dst->display->display, picture);
 	if (pixmap)
@@ -966,7 +966,7 @@ surface_source (cairo_xlib_surface_t *dst,
 	_cairo_xlib_shm_surface_get_pixmap (src)) {
 	cairo_xlib_proxy_t *proxy;
 
-	proxy = malloc (sizeof(*proxy));
+	proxy = _cairo_malloc (sizeof(*proxy));
 	if (unlikely (proxy == NULL))
 	    return _cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-xlib-surface-shm.c b/src/cairo-xlib-surface-shm.c
index a339d0c64..1ee1e3d70 100644
--- a/src/cairo-xlib-surface-shm.c
+++ b/src/cairo-xlib-surface-shm.c
@@ -573,7 +573,7 @@ _cairo_xlib_shm_pool_create(cairo_xlib_display_t *display,
     size_t bytes, maxbits = 16, minbits = MIN_BITS;
     Status success;
 
-    pool = malloc (sizeof (cairo_xlib_shm_t));
+    pool = _cairo_malloc (sizeof (cairo_xlib_shm_t));
     if (pool == NULL)
 	return NULL;
 
@@ -650,7 +650,7 @@ _cairo_xlib_shm_info_create (cairo_xlib_display_t *display,
 
     assert (mem != NULL);
 
-    info = malloc (sizeof (*info));
+    info = _cairo_malloc (sizeof (*info));
     if (info == NULL) {
 	_cairo_mempool_free (&pool->mem, mem);
 	return NULL;
@@ -814,7 +814,7 @@ _cairo_xlib_shm_surface_create (cairo_xlib_surface_t *other,
     if (size < MIN_SIZE)
 	return NULL;
 
-    shm = malloc (sizeof (*shm));
+    shm = _cairo_malloc (sizeof (*shm));
     if (unlikely (shm == NULL))
 	return (cairo_xlib_shm_surface_t *)_cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1387,7 +1387,7 @@ _cairo_xlib_display_init_shm (cairo_xlib_display_t *display)
     if (!can_use_shm (display->display, &has_pixmap))
 	return;
 
-    shm = malloc (sizeof (*shm));
+    shm = _cairo_malloc (sizeof (*shm));
     if (unlikely (shm == NULL))
 	return;
 
diff --git a/src/cairo-xlib-surface.c b/src/cairo-xlib-surface.c
index bca0cc585..2a6d896d3 100644
--- a/src/cairo-xlib-surface.c
+++ b/src/cairo-xlib-surface.c
@@ -1766,7 +1766,7 @@ found:
 	;
     }
 
-    surface = malloc (sizeof (cairo_xlib_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_xlib_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairo-xlib-visual.c b/src/cairo-xlib-visual.c
index 863822eeb..979cd5b36 100644
--- a/src/cairo-xlib-visual.c
+++ b/src/cairo-xlib-visual.c
@@ -82,7 +82,7 @@ _cairo_xlib_visual_info_create (Display *dpy,
     for (i = 0; i < RAMP_SIZE; i++)
 	ramp_index_to_short[i] = (0xffff * i + ((RAMP_SIZE-1)>>1)) / (RAMP_SIZE-1);
 
-    info = malloc (sizeof (cairo_xlib_visual_info_t));
+    info = _cairo_malloc (sizeof (cairo_xlib_visual_info_t));
     if (unlikely (info == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/cairo-xlib-xcb-surface.c b/src/cairo-xlib-xcb-surface.c
index 0bf426190..4fa9f2883 100644
--- a/src/cairo-xlib-xcb-surface.c
+++ b/src/cairo-xlib-xcb-surface.c
@@ -391,7 +391,7 @@ _cairo_xlib_xcb_device_create (Display *dpy, cairo_device_t *xcb_device)
 	}
     }
 
-    display = malloc (sizeof (cairo_xlib_xcb_display_t));
+    display = _cairo_malloc (sizeof (cairo_xlib_xcb_display_t));
     if (unlikely (display == NULL)) {
 	device = _cairo_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 	goto unlock;
@@ -438,7 +438,7 @@ _cairo_xlib_xcb_surface_create (void *dpy,
     if (unlikely (xcb->status))
 	return xcb;
 
-    surface = malloc (sizeof (*surface));
+    surface = _cairo_malloc (sizeof (*surface));
     if (unlikely (surface == NULL)) {
 	cairo_surface_destroy (xcb);
 	return _cairo_surface_create_in_error (CAIRO_STATUS_NO_MEMORY);
diff --git a/src/cairo-xml-surface.c b/src/cairo-xml-surface.c
index 3c13fa3f5..35773a2b2 100644
--- a/src/cairo-xml-surface.c
+++ b/src/cairo-xml-surface.c
@@ -258,7 +258,7 @@ _cairo_xml_create_internal (cairo_output_stream_t *stream)
 {
     cairo_xml_t *xml;
 
-    xml = malloc (sizeof (cairo_xml_t));
+    xml = _cairo_malloc (sizeof (cairo_xml_t));
     if (unlikely (xml == NULL))
 	return _cairo_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -933,7 +933,7 @@ _cairo_xml_emit_type42_font (cairo_xml_t *xml,
     if (unlikely (status))
 	return status;
 
-    buf = malloc (size);
+    buf = _cairo_malloc (size);
     if (unlikely (buf == NULL))
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1098,7 +1098,7 @@ _cairo_xml_surface_create_internal (cairo_device_t *device,
 {
     cairo_xml_surface_t *surface;
 
-    surface = malloc (sizeof (cairo_xml_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_xml_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/cairoint.h b/src/cairoint.h
index cfae18cf9..7076c2a42 100644
--- a/src/cairoint.h
+++ b/src/cairoint.h
@@ -2108,7 +2108,7 @@ CAIRO_END_DECLS
 #include "cairo-mutex-private.h"
 #include "cairo-fixed-private.h"
 #include "cairo-wideint-private.h"
-#include "cairo-malloc-private.h"
+#include "cairo-_cairo_malloc-private.h"
 #include "cairo-hash-private.h"
 
 #if HAVE_VALGRIND
diff --git a/src/drm/cairo-drm-gallium-surface.c b/src/drm/cairo-drm-gallium-surface.c
index 164ab03ce..ca18f7336 100644
--- a/src/drm/cairo-drm-gallium-surface.c
+++ b/src/drm/cairo-drm-gallium-surface.c
@@ -529,7 +529,7 @@ _gallium_fake_bo_create (uint32_t size, uint32_t name)
 
     /* XXX integrate with winsys handle */
 
-    bo = malloc (sizeof (cairo_drm_bo_t));
+    bo = _cairo_malloc (sizeof (cairo_drm_bo_t));
 
     CAIRO_REFERENCE_COUNT_INIT (&bo->ref_count, 1);
     bo->name = name;
@@ -556,7 +556,7 @@ gallium_surface_create_internal (gallium_device_t *device,
     cairo_format_t format;
     int stride, size;
 
-    surface = malloc (sizeof (gallium_surface_t));
+    surface = _cairo_malloc (sizeof (gallium_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -641,7 +641,7 @@ gallium_surface_create_for_name (cairo_drm_device_t *base_dev,
     cairo_status_t status;
     cairo_content_t content;
 
-    surface = malloc (sizeof (gallium_surface_t));
+    surface = _cairo_malloc (sizeof (gallium_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -768,7 +768,7 @@ _cairo_drm_gallium_device_create (int fd, dev_t dev, int vendor_id, int chip_id)
 	return NULL;
     }
 
-    device = malloc (sizeof (gallium_device_t));
+    device = _cairo_malloc (sizeof (gallium_device_t));
     if (device == NULL) {
 	dlclose (handle);
 	return _cairo_drm_device_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
diff --git a/src/drm/cairo-drm-i915-shader.c b/src/drm/cairo-drm-i915-shader.c
index 65e75c512..045ca5264 100644
--- a/src/drm/cairo-drm-i915-shader.c
+++ b/src/drm/cairo-drm-i915-shader.c
@@ -85,7 +85,7 @@ i915_packed_pixel_surface_create (i915_device_t *device,
     if (width > 2048 || height > 2048)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_SIZE));
 
-    surface = malloc (sizeof (i915_packed_pixel_surface_t));
+    surface = _cairo_malloc (sizeof (i915_packed_pixel_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/drm/cairo-drm-i915-spans.c b/src/drm/cairo-drm-i915-spans.c
index b3f4e0afd..f40bb2f2e 100644
--- a/src/drm/cairo-drm-i915-spans.c
+++ b/src/drm/cairo-drm-i915-spans.c
@@ -98,7 +98,7 @@ i915_accumulate_rectangle (i915_spans_t *spans)
     if (unlikely (spans->vbo_offset + size > I915_VBO_SIZE)) {
 	struct vbo *vbo;
 
-	vbo = malloc (sizeof (struct vbo));
+	vbo = _cairo_malloc (sizeof (struct vbo));
 	if (unlikely (vbo == NULL)) {
 	    /* throw error! */
 	}
diff --git a/src/drm/cairo-drm-i915-surface.c b/src/drm/cairo-drm-i915-surface.c
index cdbf258c2..8fc5f7a9d 100644
--- a/src/drm/cairo-drm-i915-surface.c
+++ b/src/drm/cairo-drm-i915-surface.c
@@ -2432,7 +2432,7 @@ i915_surface_create_internal (cairo_drm_device_t *base_dev,
     i915_surface_t *surface;
     cairo_status_t status_ignored;
 
-    surface = malloc (sizeof (i915_surface_t));
+    surface = _cairo_malloc (sizeof (i915_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -2542,7 +2542,7 @@ i915_surface_create_for_name (cairo_drm_device_t *base_dev,
 	break;
     }
 
-    surface = malloc (sizeof (i915_surface_t));
+    surface = _cairo_malloc (sizeof (i915_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -2698,7 +2698,7 @@ i915_surface_create_from_cacheable_image_internal (i915_device_t *device,
 	    break;
     }
     if (node == NULL) {
-	cache = malloc (sizeof (intel_buffer_cache_t));
+	cache = _cairo_malloc (sizeof (intel_buffer_cache_t));
 	if (unlikely (cache == NULL)) {
 	    status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	    goto CLEANUP_DEVICE;
@@ -2735,7 +2735,7 @@ i915_surface_create_from_cacheable_image_internal (i915_device_t *device,
     if (unlikely (status))
 	goto CLEANUP_CACHE;
 
-    surface = malloc (sizeof (i915_surface_t));
+    surface = _cairo_malloc (sizeof (i915_surface_t));
     if (unlikely (surface == NULL)) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_CACHE;
@@ -2879,7 +2879,7 @@ _cairo_drm_i915_device_create (int fd, dev_t dev_id, int vendor_id, int chip_id)
     if (! intel_info (fd, &gtt_size))
 	return NULL;
 
-    device = malloc (sizeof (i915_device_t));
+    device = _cairo_malloc (sizeof (i915_device_t));
     if (device == NULL)
 	return (cairo_drm_device_t *) _cairo_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/drm/cairo-drm-i965-glyphs.c b/src/drm/cairo-drm-i965-glyphs.c
index c66a63d73..1ef0a6f59 100644
--- a/src/drm/cairo-drm-i965-glyphs.c
+++ b/src/drm/cairo-drm-i965-glyphs.c
@@ -71,7 +71,7 @@ i965_glyphs_accumulate_rectangle (i965_glyphs_t *glyphs)
     if (unlikely (glyphs->vbo_offset + size > I965_VERTEX_SIZE)) {
 	struct i965_vbo *vbo;
 
-	vbo = malloc (sizeof (struct i965_vbo));
+	vbo = _cairo_malloc (sizeof (struct i965_vbo));
 	if (unlikely (vbo == NULL)) {
 	    /* throw error! */
 	}
diff --git a/src/drm/cairo-drm-i965-spans.c b/src/drm/cairo-drm-i965-spans.c
index 5cba7cec8..4d1f491fa 100644
--- a/src/drm/cairo-drm-i965-spans.c
+++ b/src/drm/cairo-drm-i965-spans.c
@@ -87,7 +87,7 @@ i965_spans_accumulate_rectangle (i965_spans_t *spans)
     if (unlikely (spans->vbo_offset + size > I965_VERTEX_SIZE)) {
 	struct i965_vbo *vbo;
 
-	vbo = malloc (sizeof (struct i965_vbo));
+	vbo = _cairo_malloc (sizeof (struct i965_vbo));
 	if (unlikely (vbo == NULL)) {
 	    /* throw error! */
 	}
diff --git a/src/drm/cairo-drm-i965-surface.c b/src/drm/cairo-drm-i965-surface.c
index 04050ef9c..9d29e4753 100644
--- a/src/drm/cairo-drm-i965-surface.c
+++ b/src/drm/cairo-drm-i965-surface.c
@@ -1568,7 +1568,7 @@ i965_surface_create_internal (cairo_drm_device_t *base_dev,
     i965_surface_t *surface;
     cairo_status_t status_ignored;
 
-    surface = malloc (sizeof (i965_surface_t));
+    surface = _cairo_malloc (sizeof (i965_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1657,7 +1657,7 @@ i965_surface_create_for_name (cairo_drm_device_t *base_dev,
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_FORMAT));
     }
 
-    surface = malloc (sizeof (i965_surface_t));
+    surface = _cairo_malloc (sizeof (i965_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -1808,7 +1808,7 @@ _cairo_drm_i965_device_create (int fd, dev_t dev, int vendor_id, int chip_id)
     if (! intel_info (fd, &gtt_size))
 	return  NULL;
 
-    device = malloc (sizeof (i965_device_t));
+    device = _cairo_malloc (sizeof (i965_device_t));
     if (unlikely (device == NULL))
 	return (cairo_drm_device_t *) _cairo_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/drm/cairo-drm-intel-surface.c b/src/drm/cairo-drm-intel-surface.c
index e295b624a..8fe2c3ae3 100644
--- a/src/drm/cairo-drm-intel-surface.c
+++ b/src/drm/cairo-drm-intel-surface.c
@@ -312,7 +312,7 @@ intel_surface_create (cairo_drm_device_t *device,
     intel_surface_t *surface;
     cairo_status_t status;
 
-    surface = malloc (sizeof (intel_surface_t));
+    surface = _cairo_malloc (sizeof (intel_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -363,7 +363,7 @@ intel_surface_create_for_name (cairo_drm_device_t *device,
     if (stride < cairo_format_stride_for_width (format, width))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_STRIDE));
 
-    surface = malloc (sizeof (intel_surface_t));
+    surface = _cairo_malloc (sizeof (intel_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -425,7 +425,7 @@ _cairo_drm_intel_device_create (int fd, dev_t dev, int vendor_id, int chip_id)
     if (! intel_info (fd, NULL))
 	return NULL;
 
-    device = malloc (sizeof (intel_device_t));
+    device = _cairo_malloc (sizeof (intel_device_t));
     if (unlikely (device == NULL))
 	return (cairo_drm_device_t *) _cairo_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/drm/cairo-drm-intel.c b/src/drm/cairo-drm-intel.c
index b5459d90e..e6fb83dd5 100644
--- a/src/drm/cairo-drm-intel.c
+++ b/src/drm/cairo-drm-intel.c
@@ -576,7 +576,7 @@ _intel_bo_put_a1_image (intel_device_t *device,
 	uint8_t *dst;
 
 	if (width > (int) sizeof (buf)) {
-	    a8 = malloc (width);
+	    a8 = _cairo_malloc (width);
 	    if (a8 == NULL)
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	}
@@ -844,7 +844,7 @@ intel_glyph_cache_add_glyph (intel_device_t *device,
 	int x;
 
 	if (width > (int) sizeof (buf)) {
-	    a8 = malloc (width);
+	    a8 = _cairo_malloc (width);
 	    if (unlikely (a8 == NULL))
 		return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	}
diff --git a/src/drm/cairo-drm-radeon-surface.c b/src/drm/cairo-drm-radeon-surface.c
index 687d4f205..9c9f8526c 100644
--- a/src/drm/cairo-drm-radeon-surface.c
+++ b/src/drm/cairo-drm-radeon-surface.c
@@ -317,7 +317,7 @@ radeon_surface_create_internal (cairo_drm_device_t *device,
     radeon_surface_t *surface;
     cairo_status_t status;
 
-    surface = malloc (sizeof (radeon_surface_t));
+    surface = _cairo_malloc (sizeof (radeon_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -385,7 +385,7 @@ radeon_surface_create_for_name (cairo_drm_device_t *device,
     if (stride < cairo_format_stride_for_width (format, width))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_INVALID_STRIDE));
 
-    surface = malloc (sizeof (radeon_surface_t));
+    surface = _cairo_malloc (sizeof (radeon_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -427,7 +427,7 @@ _cairo_drm_radeon_device_create (int fd, dev_t dev, int vendor_id, int chip_id)
     if (! radeon_info (fd, &gart_size, &vram_size))
 	return NULL;
 
-    device = malloc (sizeof (radeon_device_t));
+    device = _cairo_malloc (sizeof (radeon_device_t));
     if (device == NULL)
 	return _cairo_drm_device_create_in_error (CAIRO_STATUS_NO_MEMORY);
 
diff --git a/src/skia/cairo-skia-surface.cpp b/src/skia/cairo-skia-surface.cpp
index 834a2f13b..a9b6086dd 100644
--- a/src/skia/cairo-skia-surface.cpp
+++ b/src/skia/cairo-skia-surface.cpp
@@ -233,7 +233,7 @@ _cairo_skia_surface_create_internal (SkBitmap::Config config,
     pixman_format_code_t pixman_format;
     SkColorType colorType;
 
-    surface = (cairo_skia_surface_t *) malloc (sizeof (cairo_skia_surface_t));
+    surface = (cairo_skia_surface_t *) _cairo_malloc (sizeof (cairo_skia_surface_t));
     if (unlikely (surface == NULL))
 	return (cairo_skia_surface_t *) _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/test-compositor-surface.c b/src/test-compositor-surface.c
index 945d65b03..d6e04a122 100644
--- a/src/test-compositor-surface.c
+++ b/src/test-compositor-surface.c
@@ -78,7 +78,7 @@ test_compositor_surface_create (const cairo_compositor_t *compositor,
     if (unlikely (pixman_image == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
-    surface = malloc (sizeof (test_compositor_surface_t));
+    surface = _cairo_malloc (sizeof (test_compositor_surface_t));
     if (unlikely (surface == NULL)) {
 	pixman_image_unref (pixman_image);
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
diff --git a/src/test-null-compositor-surface.c b/src/test-null-compositor-surface.c
index 6b8d4eeb6..35913a2b9 100644
--- a/src/test-null-compositor-surface.c
+++ b/src/test-null-compositor-surface.c
@@ -81,7 +81,7 @@ test_compositor_surface_create (const cairo_compositor_t *compositor,
     if (unlikely (pixman_image == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
-    surface = malloc (sizeof (test_compositor_surface_t));
+    surface = _cairo_malloc (sizeof (test_compositor_surface_t));
     if (unlikely (surface == NULL)) {
 	pixman_image_unref (pixman_image);
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
diff --git a/src/test-paginated-surface.c b/src/test-paginated-surface.c
index a9f073fe4..7967f7406 100644
--- a/src/test-paginated-surface.c
+++ b/src/test-paginated-surface.c
@@ -74,7 +74,7 @@ _cairo_test_paginated_surface_create (cairo_surface_t *target)
     if (unlikely (status))
 	return _cairo_surface_create_in_error (status);
 
-    surface = malloc (sizeof (test_paginated_surface_t));
+    surface = _cairo_malloc (sizeof (test_paginated_surface_t));
     if (unlikely (surface == NULL))
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/win32/cairo-win32-debug.c b/src/win32/cairo-win32-debug.c
index ff7aeaf1f..5c4960180 100644
--- a/src/win32/cairo-win32-debug.c
+++ b/src/win32/cairo-win32-debug.c
@@ -66,7 +66,7 @@ _cairo_win32_debug_dump_hrgn (HRGN rgn, char *header)
     }
 
     z = GetRegionData(rgn, 0, NULL);
-    rd = (RGNDATA*) malloc(z);
+    rd = (RGNDATA*) _cairo_malloc(z);
     z = GetRegionData(rgn, z, rd);
 
     fprintf (stderr, " %ld rects, bounds: %ld %ld %ld %ld\n",
diff --git a/src/win32/cairo-win32-device.c b/src/win32/cairo-win32-device.c
index c60c4948d..f0df15e1d 100644
--- a/src/win32/cairo-win32-device.c
+++ b/src/win32/cairo-win32-device.c
@@ -136,7 +136,7 @@ _cairo_win32_device_get (void)
     if (__cairo_win32_device)
 	return cairo_device_reference (__cairo_win32_device);
 
-    device = malloc (sizeof (*device));
+    device = _cairo_malloc (sizeof (*device));
 
     _cairo_device_init (&device->base, &_cairo_win32_device_backend);
 
diff --git a/src/win32/cairo-win32-display-surface.c b/src/win32/cairo-win32-display-surface.c
index ccfad10dd..2b40e1acf 100644
--- a/src/win32/cairo-win32-display-surface.c
+++ b/src/win32/cairo-win32-display-surface.c
@@ -298,7 +298,7 @@ _cairo_win32_display_surface_create_for_dc (HDC             original_dc,
     unsigned char *bits;
     int rowstride;
 
-    surface = malloc (sizeof (*surface));
+    surface = _cairo_malloc (sizeof (*surface));
     if (surface == NULL)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
@@ -719,7 +719,7 @@ _cairo_win32_display_surface_set_clip (cairo_win32_display_surface_t *surface,
 
     data_size = sizeof (RGNDATAHEADER) + num_rects * sizeof (RECT);
     if (data_size > sizeof (stack)) {
-	data = malloc (data_size);
+	data = _cairo_malloc (data_size);
 	if (!data)
 	    return _cairo_error(CAIRO_STATUS_NO_MEMORY);
     } else
@@ -988,7 +988,7 @@ cairo_win32_surface_create_with_format (HDC hdc, cairo_format_t format)
 	break;
     }
 
-    surface = malloc (sizeof (*surface));
+    surface = _cairo_malloc (sizeof (*surface));
     if (surface == NULL)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/src/win32/cairo-win32-font.c b/src/win32/cairo-win32-font.c
index 1b86b8100..a031c1363 100644
--- a/src/win32/cairo-win32-font.c
+++ b/src/win32/cairo-win32-font.c
@@ -323,7 +323,7 @@ _win32_scaled_font_create (LOGFONTW                   *logfont,
     if (hdc == NULL)
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
-    f = malloc (sizeof(cairo_win32_scaled_font_t));
+    f = _cairo_malloc (sizeof(cairo_win32_scaled_font_t));
     if (f == NULL)
 	return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -472,7 +472,7 @@ _win32_scaled_font_get_unscaled_hfont (cairo_win32_scaled_font_t *scaled_font,
 	if (! otm_size)
 	    return _cairo_win32_print_gdi_error ("_win32_scaled_font_get_unscaled_hfont:GetOutlineTextMetrics");
 
-	otm = malloc (otm_size);
+	otm = _cairo_malloc (otm_size);
 	if (otm == NULL)
 	    return _cairo_error (CAIRO_STATUS_NO_MEMORY);
 
@@ -1388,7 +1388,7 @@ _cairo_win32_scaled_font_index_to_ucs4 (void		*abstract_font,
 	goto exit1;
     }
 
-    glyph_set = malloc (res);
+    glyph_set = _cairo_malloc (res);
     if (glyph_set == NULL) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto exit1;
@@ -1696,7 +1696,7 @@ _cairo_win32_scaled_font_init_glyph_path (cairo_win32_scaled_font_t *scaled_font
 	goto CLEANUP_FONT;
     }
 
-    ptr = buffer = malloc (bytesGlyph);
+    ptr = buffer = _cairo_malloc (bytesGlyph);
     if (!buffer) {
 	status = _cairo_error (CAIRO_STATUS_NO_MEMORY);
 	goto CLEANUP_FONT;
@@ -2071,7 +2071,7 @@ cairo_win32_font_face_create_for_logfontw_hfont (LOGFONTW *logfont, HFONT font)
     }
 
     /* Otherwise create it and insert into hash table. */
-    font_face = malloc (sizeof (cairo_win32_font_face_t));
+    font_face = _cairo_malloc (sizeof (cairo_win32_font_face_t));
     if (!font_face) {
         _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
 	goto FAIL;
diff --git a/src/win32/cairo-win32-printing-surface.c b/src/win32/cairo-win32-printing-surface.c
index 68321c86c..7f88cd1e5 100644
--- a/src/win32/cairo-win32-printing-surface.c
+++ b/src/win32/cairo-win32-printing-surface.c
@@ -1020,8 +1020,8 @@ _cairo_win32_printing_surface_paint_linear_pattern (cairo_win32_printing_surface
     num_rects = num_stops - 1;
 
     /* Add an extra four points and two rectangles for EXTEND_PAD */
-    vert = malloc (sizeof (TRIVERTEX) * (num_rects*2*num_ranges + 4));
-    rect = malloc (sizeof (GRADIENT_RECT) * (num_rects*num_ranges + 2));
+    vert = _cairo_malloc (sizeof (TRIVERTEX) * (num_rects*2*num_ranges + 4));
+    rect = _cairo_malloc (sizeof (GRADIENT_RECT) * (num_rects*num_ranges + 2));
 
     for (i = 0; i < num_ranges*num_rects; i++) {
 	vert[i*2].y = (LONG) clip.top;
@@ -2131,7 +2131,7 @@ cairo_win32_printing_surface_create (HDC hdc)
     cairo_win32_printing_surface_t *surface;
     cairo_surface_t *paginated;
 
-    surface = malloc (sizeof (cairo_win32_printing_surface_t));
+    surface = _cairo_malloc (sizeof (cairo_win32_printing_surface_t));
     if (surface == NULL)
 	return _cairo_surface_create_in_error (_cairo_error (CAIRO_STATUS_NO_MEMORY));
 
diff --git a/test/any2ppm.c b/test/any2ppm.c
index a92412d08..235578080 100644
--- a/test/any2ppm.c
+++ b/test/any2ppm.c
@@ -600,7 +600,7 @@ _getline (int fd, char **linep, size_t *lenp)
 
     line = *linep;
     if (line == NULL) {
-	line = malloc (1024);
+	line = _cairo_malloc (1024);
 	if (line == NULL)
 	    return -1;
 	line[0] = '\0';
diff --git a/test/cairo-test-trace.c b/test/cairo-test-trace.c
index 5badc4377..af9d97fd6 100644
--- a/test/cairo-test-trace.c
+++ b/test/cairo-test-trace.c
@@ -657,7 +657,7 @@ spawn_recorder (const char *socket_path, const char *trace, test_runner_t **out)
     if (DEBUG)
 	printf ("Spawning recorder for %s\n", trace);
 
-    tr = malloc (sizeof (*tr));
+    tr = _cairo_malloc (sizeof (*tr));
     if (tr == NULL)
 	return -1;
 
@@ -740,7 +740,7 @@ matches_reference (struct slave *slave)
 	height = cairo_image_surface_get_height (a);
 	stride = cairo_image_surface_get_stride (a);
 	size = height * stride * 4;
-	data = malloc (size);
+	data = _cairo_malloc (size);
 	if (data == NULL)
 	    return FALSE;
 
diff --git a/test/cairo-test.c b/test/cairo-test.c
index d93468bdb..a24b884f3 100644
--- a/test/cairo-test.c
+++ b/test/cairo-test.c
@@ -803,7 +803,7 @@ REPEAT:
     last_fault_count = MEMFAULT_COUNT_FAULTS ();
 
     /* Pre-initialise fontconfig so that the configuration is loaded without
-     * malloc failures (our primary goal is to test cairo fault tolerance).
+     * _cairo_malloc failures (our primary goal is to test cairo fault tolerance).
      */
 #if HAVE_FCINIT
     FcInit ();
@@ -943,7 +943,7 @@ REPEAT:
 #if HAVE_MEMFAULT
     MEMFAULT_DISABLE_FAULTS ();
 
-    /* repeat test after malloc failure injection */
+    /* repeat test after _cairo_malloc failure injection */
     if (ctx->malloc_failure &&
 	MEMFAULT_COUNT_FAULTS () - last_fault_count > 0 &&
 	(status == CAIRO_TEST_NO_MEMORY ||
diff --git a/test/mime-unique-id.c b/test/mime-unique-id.c
index bdd056137..95447fb02 100755
--- a/test/mime-unique-id.c
+++ b/test/mime-unique-id.c
@@ -126,7 +126,7 @@ create_recording_surface_with_mime_jpg (cairo_test_context_t *ctx, cairo_surface
     fseek (f, 0, SEEK_END);
     len = ftell(f);
     fseek (f, 0, SEEK_SET);
-    data = malloc (len);
+    data = _cairo_malloc (len);
     if (fread(data, len, 1, f) != 1) {
 	cairo_test_log (ctx, "Unable to read file %s\n", jpeg_filename);
 	return CAIRO_TEST_FAILURE;
diff --git a/test/pdf-mime-data.c b/test/pdf-mime-data.c
index 69fafa145..1ff3f5af4 100644
--- a/test/pdf-mime-data.c
+++ b/test/pdf-mime-data.c
@@ -73,7 +73,7 @@ read_file (const cairo_test_context_t *ctx,
     fseek (fp, 0, SEEK_END);
     *len = ftell(fp);
     fseek (fp, 0, SEEK_SET);
-    *data = malloc (*len);
+    *data = _cairo_malloc (*len);
     if (*data == NULL) {
 	fclose(fp);
 	cairo_test_log (ctx, "Could not allocate memory for buffer to read \
diff --git a/test/pdf-tagged-text.c b/test/pdf-tagged-text.c
index 5c1b82bc2..dd3f4d829 100644
--- a/test/pdf-tagged-text.c
+++ b/test/pdf-tagged-text.c
@@ -135,7 +135,7 @@ layout_paragraph (cairo_t *cr)
 	*end = ' ';
 	if (text_extents.width + 2*MARGIN > PAGE_WIDTH) {
 	    int len = prev_end - begin;
-	    char *s = malloc (len);
+	    char *s = _cairo_malloc (len);
 	    memcpy (s, begin, len);
 	    s[len-1] = 0;
 	    paragraph_text[paragraph_num_lines++] = s;
diff --git a/test/pdiff/lpyramid.c b/test/pdiff/lpyramid.c
index bd402c7da..dba750e5c 100644
--- a/test/pdiff/lpyramid.c
+++ b/test/pdiff/lpyramid.c
@@ -68,7 +68,7 @@ lpyramid_create (float *image, int width, int height)
     lpyramid_t *pyramid;
     int i;
 
-    pyramid = malloc (sizeof (lpyramid_t));
+    pyramid = _cairo_malloc (sizeof (lpyramid_t));
     if (pyramid == NULL) {
 	fprintf (stderr, "Out of memory.\n");
 	exit (1);
@@ -79,7 +79,7 @@ lpyramid_create (float *image, int width, int height)
     /* Make the Laplacian pyramid by successively
      * copying the earlier levels and blurring them */
     for (i=0; i<MAX_PYR_LEVELS; i++) {
-	pyramid->levels[i] = malloc (width * height * sizeof (float));
+	pyramid->levels[i] = _cairo_malloc (width * height * sizeof (float));
 	if (pyramid->levels[i] == NULL) {
 	    fprintf (stderr, "Out of memory.\n");
 	    exit (1);
diff --git a/test/pdiff/pdiff.c b/test/pdiff/pdiff.c
index eb5f15682..0d20ffd65 100644
--- a/test/pdiff/pdiff.c
+++ b/test/pdiff/pdiff.c
@@ -227,7 +227,7 @@ xmalloc (size_t size)
 {
     void *buf;
 
-    buf = malloc (size);
+    buf = _cairo_malloc (size);
     if (buf == NULL) {
 	fprintf (stderr, "Out of memory.\n");
 	exit (1);
diff --git a/test/recordflip.c b/test/recordflip.c
index e923c8a2a..3fbeba1e6 100644
--- a/test/recordflip.c
+++ b/test/recordflip.c
@@ -389,7 +389,7 @@ record_replay (cairo_t *cr, cairo_t *(*func)(cairo_t *), int width, int height)
 	data = cairo_image_surface_get_data (image);
 	stride = cairo_image_surface_get_stride (image);
 
-	tmp = malloc (stride);
+	tmp = _cairo_malloc (stride);
 	if (tmp == NULL)
 	    return CAIRO_TEST_FAILURE;
 
@@ -474,7 +474,7 @@ record_whole_replay (cairo_t *cr, cairo_t *(*func)(cairo_t *), int width, int he
 	data = cairo_image_surface_get_data (image);
 	stride = cairo_image_surface_get_stride (image);
 
-	tmp = malloc (stride);
+	tmp = _cairo_malloc (stride);
 	if (tmp == NULL)
 	    return CAIRO_TEST_FAILURE;
 
diff --git a/test/simple.c b/test/simple.c
index 7ec8a9ac5..bac62ba1a 100644
--- a/test/simple.c
+++ b/test/simple.c
@@ -125,7 +125,7 @@ coverage_create (int width, int height)
     size = sizeof (struct coverage);
     size += width * height * sizeof (int) * 2;
 
-    c = malloc (size);
+    c = _cairo_malloc (size);
     if (c == NULL)
 	return c;
 
diff --git a/test/text-zero-len.c b/test/text-zero-len.c
index 5e89816c8..8b1bc2509 100644
--- a/test/text-zero-len.c
+++ b/test/text-zero-len.c
@@ -31,9 +31,9 @@
  *
  * Moreover, the fallback path in cairo_scaled_font_text_to_glyphs()
  * when handling a zero-sized string, allocates a zero-sized glyph array
- * and when NULL is returned by malloc, recognizes that as an out-of-memory
- * error.  The glibc implementation of malloc() does not return NULL from
- * malloc(0), but I don't think it's a safe assumption.
+ * and when NULL is returned by _cairo_malloc, recognizes that as an out-of-memory
+ * error.  The glibc implementation of _cairo_malloc() does not return NULL from
+ * _cairo_malloc(0), but I don't think it's a safe assumption.
  *
  * By just bailing out on zero-sized text, we fix both issues.
  */
diff --git a/util/backtrace-symbols.c b/util/backtrace-symbols.c
index 9931413de..4fde4d14d 100644
--- a/util/backtrace-symbols.c
+++ b/util/backtrace-symbols.c
@@ -201,7 +201,7 @@ static char** translate_addresses_buf(bfd * abfd, bfd_vma *addr, int naddr)
 	 * the second time we do the actual printing */
 	for (state=Count; state<=Print; state++) {
 	if (state == Print) {
-		ret_buf = malloc(total + sizeof(char*)*naddr);
+		ret_buf = _cairo_malloc(total + sizeof(char*)*naddr);
 		buf = (char*)(ret_buf + naddr);
 		len = total;
 	}
@@ -322,7 +322,7 @@ char **backtrace_symbols(void *const *buffer, int size)
 	char **final;
 	char *f_strings;
 
-	locations = malloc(sizeof(char**) * (stack_depth+1));
+	locations = _cairo_malloc(sizeof(char**) * (stack_depth+1));
 
 	bfd_init();
 	for(x=stack_depth, y=0; x>=0; x--, y++){
@@ -341,7 +341,7 @@ char **backtrace_symbols(void *const *buffer, int size)
 
 	/* allocate the array of char* we are going to return and extra space for
 	 * all of the strings */
-	final = malloc(total + (stack_depth + 1) * sizeof(char*));
+	final = _cairo_malloc(total + (stack_depth + 1) * sizeof(char*));
 	/* get a pointer to the extra space */
 	f_strings = (char*)(final + stack_depth + 1);
 
diff --git a/util/cairo-missing/getline.c b/util/cairo-missing/getline.c
index 8585cfdc2..33afb605f 100644
--- a/util/cairo-missing/getline.c
+++ b/util/cairo-missing/getline.c
@@ -31,7 +31,7 @@
 #include "cairo-missing.h"
 
 #ifndef HAVE_GETLINE
-#include "cairo-malloc-private.h"
+#include "cairo-_cairo_malloc-private.h"
 
 #define GETLINE_MIN_BUFFER_SIZE 128
 ssize_t
diff --git a/util/cairo-missing/strndup.c b/util/cairo-missing/strndup.c
index 280ea3017..b155c371e 100644
--- a/util/cairo-missing/strndup.c
+++ b/util/cairo-missing/strndup.c
@@ -31,7 +31,7 @@
 #include "cairo-missing.h"
 
 #ifndef HAVE_STRNDUP
-#include "cairo-malloc-private.h"
+#include "cairo-_cairo_malloc-private.h"
 
 char *
 strndup (const char *s,
diff --git a/util/cairo-script/cairo-script-interpreter.c b/util/cairo-script/cairo-script-interpreter.c
index a578ec43a..ba0a117f4 100644
--- a/util/cairo-script/cairo-script-interpreter.c
+++ b/util/cairo-script/cairo-script-interpreter.c
@@ -57,7 +57,7 @@ _csi_error (csi_status_t status)
 void *
 _csi_alloc (csi_t *ctx, int size)
 {
-    return malloc (size);
+    return _cairo_malloc (size);
 }
 
 void *
@@ -119,7 +119,7 @@ void *
 _csi_slab_alloc (csi_t *ctx, int size)
 {
 #if CSI_DEBUG_MALLOC
-    return malloc (size);
+    return _cairo_malloc (size);
 #else
     int chunk_size;
     csi_chunk_t *chunk;
@@ -536,7 +536,7 @@ cairo_script_interpreter_create (void)
 {
     csi_t *ctx;
 
-    ctx = malloc (sizeof (csi_t));
+    ctx = _cairo_malloc (sizeof (csi_t));
     if (ctx == NULL)
 	return (csi_t *) &_csi_nil;
 
diff --git a/util/cairo-script/cairo-script-operators.c b/util/cairo-script/cairo-script-operators.c
index e493311e7..61ce64f34 100644
--- a/util/cairo-script/cairo-script-operators.c
+++ b/util/cairo-script/cairo-script-operators.c
@@ -2931,7 +2931,7 @@ _image_read_raw (csi_t *ctx,
 	data = cairo_image_surface_get_data (image);
     } else {
 	stride = cairo_format_stride_for_width (format, width);
-	data = malloc (stride * height);
+	data = _cairo_malloc (stride * height);
 	if (data == NULL)
 	    return CAIRO_STATUS_NO_MEMORY;
 
diff --git a/util/cairo-script/cairo-script-scanner.c b/util/cairo-script/cairo-script-scanner.c
index 3dfb3a9a2..24699dcdf 100644
--- a/util/cairo-script/cairo-script-scanner.c
+++ b/util/cairo-script/cairo-script-scanner.c
@@ -40,7 +40,7 @@
 #include <math.h> /* pow */
 #include <stdio.h> /* EOF */
 #include <stdint.h> /* for {INT,UINT}*_{MIN,MAX} */
-#include <stdlib.h> /* malloc/free */
+#include <stdlib.h> /* _cairo_malloc/free */
 #include <string.h> /* memset */
 #include <assert.h>
 #include <zlib.h>
@@ -1595,8 +1595,8 @@ _translate_string (csi_t *ctx,
 #if HAVE_LZO
     if (method == NONE && buf_len > 16) {
 	unsigned long mem_len = 2*string->len > LZO2A_999_MEM_COMPRESS ? 2*string->len : LZO2A_999_MEM_COMPRESS;
-	void *mem = malloc (mem_len);
-	void *work = malloc(LZO2A_999_MEM_COMPRESS);
+	void *mem = _cairo_malloc (mem_len);
+	void *work = _cairo_malloc(LZO2A_999_MEM_COMPRESS);
 
 	if (lzo2a_999_compress ((lzo_bytep) buf, buf_len,
 				(lzo_bytep) mem, &mem_len,
@@ -1618,7 +1618,7 @@ _translate_string (csi_t *ctx,
 #if HAVE_ZLIB
     if (method == ZLIB) {
 	buf_len = string->deflate;
-	buf = malloc (string->deflate);
+	buf = _cairo_malloc (string->deflate);
 	if (uncompress ((Bytef *) buf, &buf_len,
 			(Bytef *) string->string, string->len) == Z_OK)
 	{
@@ -1628,8 +1628,8 @@ _translate_string (csi_t *ctx,
 		deflate = 0;
 	    } else {
 		unsigned long mem_len = 2*string->deflate;
-		void *mem = malloc (mem_len);
-		void *work = malloc(LZO2A_999_MEM_COMPRESS);
+		void *mem = _cairo_malloc (mem_len);
+		void *work = _cairo_malloc(LZO2A_999_MEM_COMPRESS);
 
 		if (lzo2a_999_compress ((lzo_bytep) buf, buf_len,
 					(lzo_bytep) mem, &mem_len,
diff --git a/util/cairo-script/csi-replay.c b/util/cairo-script/csi-replay.c
index 4c66b7752..07f20767a 100644
--- a/util/cairo-script/csi-replay.c
+++ b/util/cairo-script/csi-replay.c
@@ -65,7 +65,7 @@ static cairo_t *
 _context_create (void *closure, cairo_surface_t *surface)
 {
     cairo_t *cr = cairo_create (surface);
-    struct list *l = malloc (sizeof (*l));
+    struct list *l = _cairo_malloc (sizeof (*l));
     l->next = list;
     l->context = cr;
     l->surface = cairo_surface_reference (surface);
diff --git a/util/cairo-trace/trace.c b/util/cairo-trace/trace.c
index 3c056134e..acdf81ec4 100644
--- a/util/cairo-trace/trace.c
+++ b/util/cairo-trace/trace.c
@@ -1720,7 +1720,7 @@ _emit_image (cairo_surface_t *image,
     }
 #else
     if (stride > ARRAY_LENGTH (row_stack)) {
-	rowdata = malloc (stride);
+    rowdata = malloc (stride);
 	if (rowdata == NULL)
 	    goto BAIL;
     } else
@@ -4439,7 +4439,7 @@ _ft_read_file (FtFaceData *data, const char *path)
     if (file != NULL) {
 	size_t ret;
 	unsigned long int allocated = sizeof (buf);
-	data->data = malloc (allocated);
+    data->data = malloc (allocated);
 	do {
 	    ret = fread (buf, 1, sizeof (buf), file);
 	    if (ret == 0)
@@ -4470,7 +4470,7 @@ FT_New_Face (FT_Library library, const char *pathname, FT_Long index, FT_Face *f
     ret = DLCALL (FT_New_Face, library, pathname, index, face);
     if (ret == 0) {
 	Object *obj = _type_object_create (NONE, *face);
-	FtFaceData *data = malloc (sizeof (FtFaceData));
+    FtFaceData *data = malloc (sizeof (FtFaceData));
 	data->index = index;
 	data->size = 0;
 	data->data = NULL;
@@ -4493,10 +4493,10 @@ FT_New_Memory_Face (FT_Library library, const FT_Byte *mem, FT_Long size, FT_Lon
     ret = DLCALL (FT_New_Memory_Face, library, mem, size, index, face);
     if (ret == 0) {
 	Object *obj = _type_object_create (NONE, *face);
-	FtFaceData *data = malloc (sizeof (FtFaceData));
+    FtFaceData *data = malloc (sizeof (FtFaceData));
 	data->index = index;
 	data->size = size;
-	data->data = malloc (size);
+    data->data = malloc (size);
 	memcpy (data->data, mem, size);
 	obj->data = data;
 	obj->destroy = _ft_face_data_destroy;
@@ -4526,11 +4526,11 @@ FT_Open_Face (FT_Library library, const FT_Open_Args *args, FT_Long index, FT_Fa
 	if (obj == NULL) {
 	    FtFaceData *data;
 
-	    data = malloc (sizeof (FtFaceData));
+        data = malloc (sizeof (FtFaceData));
 	    data->index = index;
 	    if (args->flags & FT_OPEN_MEMORY) {
 		data->size = args->memory_size;
-		data->data = malloc (args->memory_size);
+        data->data = malloc (args->memory_size);
 		memcpy (data->data, args->memory_base, args->memory_size);
 	    } else if (args->flags & FT_OPEN_STREAM) {
 		fprintf (stderr, "FT_Open_Face (stream, %ld) = %p\n",
diff --git a/util/malloc-stats.c b/util/malloc-stats.c
index 55ed51cad..594693c1f 100644
--- a/util/malloc-stats.c
+++ b/util/malloc-stats.c
@@ -44,7 +44,7 @@ struct alloc_stat_t {
 };
 
 struct alloc_stats_t {
-	struct alloc_stat_t malloc, realloc, total;
+    struct alloc_stat_t malloc, realloc, total;
 };
 
 struct func_stat_t {
@@ -66,7 +66,7 @@ static int func_stats_num;
 static void
 alloc_stats_add (struct alloc_stats_t *stats, int is_realloc, size_t size)
 {
-	struct alloc_stat_t *stat = is_realloc ? &stats->realloc : &stats->malloc;
+    struct alloc_stat_t *stat = is_realloc ? &stats->realloc : &stats->malloc;
 
 	stats->total.num++;
 	stats->total.size += size;
@@ -90,7 +90,7 @@ _perm_alloc (size_t size)
 
     size = align (size, 2 * sizeof (void *));
     if (size > rem || rem == 0) {
-	ptr = malloc (SUPERBLOCK_SIZE);
+    ptr = malloc (SUPERBLOCK_SIZE);
 	if (ptr == NULL)
 	    exit (1);
 	rem = SUPERBLOCK_SIZE;
@@ -113,7 +113,7 @@ resolve_addrs (struct func_stat_t *func_stats, int num)
 	void **addrs;
 	char **strings;
 
-	addrs = malloc (num * sizeof (void *));
+    addrs = malloc (num * sizeof (void *));
 	for (i = 0; i < num; i++)
 		addrs[i] = (void *) func_stats[i].addr;
 
@@ -211,7 +211,7 @@ my_malloc(size_t size, const void *caller)
 
 	func_stats_add (caller, 0, size);
 
-	ret = malloc (size);
+    ret = malloc (size);
 	my_hooks ();
 
 	return ret;
@@ -249,8 +249,8 @@ add_alloc_stats (struct alloc_stats_t *a, struct alloc_stats_t *b)
 {
 	a->total.num += b->total.num;
 	a->total.size += b->total.size;
-	a->malloc.num += b->malloc.num;
-	a->malloc.size += b->malloc.size;
+    a->malloc.num += b->malloc.num;
+    a->malloc.size += b->malloc.size;
 	a->realloc.num += b->realloc.num;
 	a->realloc.size += b->realloc.size;
 }
@@ -260,7 +260,7 @@ dump_alloc_stats (struct alloc_stats_t *stats, const char *name)
 {
 	printf ("%8u %'11llu %8u %'11llu %8u %'11llu %s\n",
 		stats->total.num, stats->total.size,
-		stats->malloc.num, stats->malloc.size,
+        stats->malloc.num, stats->malloc.size,
 		stats->realloc.num, stats->realloc.size,
 		name);
 }
@@ -324,7 +324,7 @@ malloc_stats (void)
 	if (! func_stats_num)
 		return;
 
-	sorted_func_stats = malloc (sizeof (struct func_stat_t) * (func_stats_num + 1));
+    sorted_func_stats = malloc (sizeof (struct func_stat_t) * (func_stats_num + 1));
 	if (sorted_func_stats == NULL)
 		return;