diff --git a/src/hb-blob.c b/src/hb-blob.c
index bcdf13418..50bb97300 100644
--- a/src/hb-blob.c
+++ b/src/hb-blob.c
@@ -30,20 +30,22 @@
 #include "hb-refcount-private.h"
 
 struct _hb_blob_t {
+  hb_reference_count_t ref_count;
+
   const char *data;
   unsigned int len;
   hb_memory_mode_t mode;
 
-  hb_reference_count_t ref_count;
   hb_destroy_func_t destroy;
   void *user_data;
 };
 static hb_blob_t _hb_blob_nil = {
+  HB_REFERENCE_COUNT_INVALID,
+
   NULL,
   0,
   HB_MEMORY_MODE_READONLY,
 
-  HB_REFERENCE_COUNT_INVALID,
   NULL,
   NULL
 };
@@ -67,7 +69,7 @@ hb_blob_create (const char        *data,
 {
   hb_blob_t *blob;
 
-  blob = malloc (sizeof (hb_blob_t));
+  blob = calloc (1, sizeof (hb_blob_t));
   if (!blob) {
     if (destroy)
       destroy (user_data);
diff --git a/src/hb-buffer.c b/src/hb-buffer.c
index 3c6fd7ceb..f596c09c4 100644
--- a/src/hb-buffer.c
+++ b/src/hb-buffer.c
@@ -59,7 +59,7 @@ hb_buffer_ensure_separate (hb_buffer_t *buffer, unsigned int size)
   if (buffer->out_string == buffer->in_string)
   {
     if (!buffer->alt_string)
-      buffer->alt_string = malloc (buffer->allocated * sizeof (buffer->alt_string[0]));
+      buffer->alt_string = calloc (buffer->allocated, sizeof (buffer->alt_string[0]));
 
     buffer->out_string = buffer->alt_string;
     memcpy (buffer->out_string, buffer->in_string, buffer->out_length * sizeof (buffer->out_string[0]));
@@ -73,7 +73,7 @@ hb_buffer_new (unsigned int allocation_size)
 {
   hb_buffer_t *buffer;
 
-  buffer = malloc (sizeof (hb_buffer_t));
+  buffer = calloc (1, sizeof (hb_buffer_t));
   if (HB_UNLIKELY (!buffer))
     return NULL;