diff --git a/buffer.c b/buffer.c
index 4599114..ce1cbf8 100644
--- a/buffer.c
+++ b/buffer.c
@@ -63,11 +63,10 @@ static void update_page(Page *p)
 
     /* if the page is read only, copy it */
     if (p->flags & PG_READ_ONLY) {
-        buf = malloc(p->size);
+        buf = qe_malloc_dup(p->data, p->size);
         /* XXX: should return an error */
         if (!buf)
             return;
-        memcpy(buf, p->data, p->size);
         p->data = buf;
         p->flags &= ~PG_READ_ONLY;
     }
@@ -147,7 +146,8 @@ static void eb_insert1(EditBuffer *b, int page_index, const u8 *buf, int size)
             len = size;
         if (len > 0) {
             update_page(p);
-            p->data = realloc(p->data, p->size + len);
+            /* CG: probably faster with qe_malloc + qe_free */
+            qe_realloc(&p->data, p->size + len);
             memmove(p->data + len, p->data, p->size);
             memcpy(p->data, buf + size - len, len);
             size -= len;
@@ -159,18 +159,16 @@ static void eb_insert1(EditBuffer *b, int page_index, const u8 *buf, int size)
     n = (size + MAX_PAGE_SIZE - 1) / MAX_PAGE_SIZE;
     if (n > 0) {
         b->nb_pages += n;
-        b->page_table = realloc(b->page_table, b->nb_pages * sizeof(Page));
+        qe_realloc(&b->page_table, b->nb_pages * sizeof(Page));
         p = b->page_table + page_index;
-        memmove(p + n, p,
-                sizeof(Page) * (b->nb_pages - n - page_index));
+        memmove(p + n, p, sizeof(Page) * (b->nb_pages - n - page_index));
         while (size > 0) {
             len = size;
             if (len > MAX_PAGE_SIZE)
                 len = MAX_PAGE_SIZE;
             p->size = len;
-            p->data = malloc(len);
+            p->data = qe_malloc_dup(buf, len);
             p->flags = 0;
-            memcpy(p->data, buf, len);
             buf += len;
             size -= len;
             p++;
@@ -211,7 +209,7 @@ static void eb_insert_lowlevel(EditBuffer *b, int offset,
             p = b->page_table + page_index;
             update_page(p);
             p->size += len - len_out;
-            p->data = realloc(p->data, p->size);
+            qe_realloc(&p->data, p->size);
             memmove(p->data + offset + len, 
                     p->data + offset, p->size - (offset + len));
             memcpy(p->data + offset, buf, len);
@@ -272,7 +270,7 @@ void eb_insert_buffer(EditBuffer *dest, int dest_offset,
                realloced */
             q = dest->page_table + page_index - 1;
             update_page(q);
-            q->data = realloc(q->data, dest_offset);
+            qe_realloc(&q->data, dest_offset);
             q->size = dest_offset;
         }
     } else {
@@ -294,11 +292,9 @@ void eb_insert_buffer(EditBuffer *dest, int dest_offset,
     if (n > 0) {
         /* add the pages */
         dest->nb_pages += n;
-        dest->page_table = realloc(dest->page_table,
-                                   dest->nb_pages * sizeof(Page));
+        qe_realloc(&dest->page_table, dest->nb_pages * sizeof(Page));
         q = dest->page_table + page_index;
-        memmove(q + n, q, 
-                sizeof(Page) * (dest->nb_pages - n - page_index));
+        memmove(q + n, q, sizeof(Page) * (dest->nb_pages - n - page_index));
         p = p_start;
         while (n > 0) {
             len = p->size;
@@ -310,8 +306,7 @@ void eb_insert_buffer(EditBuffer *dest, int dest_offset,
             } else {
                 /* allocate a new page */
                 q->flags = 0;
-                q->data = malloc(len);
-                memcpy(q->data, p->data, len);
+                q->data = qe_malloc_dup(p->data, len);
             }
             n--;
             p++;
@@ -366,7 +361,7 @@ void eb_delete(EditBuffer *b, int offset, int size)
                 del_start = p;
             /* we cannot free if read only */
             if (!(p->flags & PG_READ_ONLY))
-                free(p->data);
+                qe_free(&p->data);
             p++;
             offset = 0;
             n++;
@@ -375,7 +370,7 @@ void eb_delete(EditBuffer *b, int offset, int size)
             memmove(p->data + offset, p->data + offset + len, 
                     p->size - offset - len);
             p->size -= len;
-            p->data = realloc(p->data, p->size);
+            qe_realloc(&p->data, p->size);
             offset += len;
             if (offset >= p->size) {
                 p++;
@@ -390,7 +385,7 @@ void eb_delete(EditBuffer *b, int offset, int size)
         b->nb_pages -= n;
         memmove(del_start, del_start + n, 
                 (b->page_table + b->nb_pages - del_start) * sizeof(Page));
-        b->page_table = realloc(b->page_table, b->nb_pages * sizeof(Page));
+        qe_realloc(&b->page_table, b->nb_pages * sizeof(Page));
     }
 
     /* the page cache is no longer valid */
@@ -433,10 +428,9 @@ EditBuffer *eb_new(const char *name, int flags)
     QEmacsState *qs = &qe_state;
     EditBuffer *b;
 
-    b = malloc(sizeof(EditBuffer));
+    b = qe_mallocz(EditBuffer);
     if (!b)
         return NULL;
-    memset(b, 0, sizeof(EditBuffer));
 
     pstrcpy(b->name, sizeof(b->name), name);
     b->flags = flags;
@@ -476,7 +470,7 @@ void eb_free(EditBuffer *b)
     /* free each callback */
     for (l = b->first_callback; l != NULL;) {
         l1 = l->next;
-        free(l);
+        qe_free(&l);
         l = l1;
     }
     b->first_callback = NULL;
@@ -502,7 +496,7 @@ void eb_free(EditBuffer *b)
     if (b == trace_buffer)
         trace_buffer = NULL;
 
-    free(b);
+    qe_free(&b);
 }
 
 EditBuffer *eb_find(const char *name)
@@ -613,7 +607,7 @@ int eb_add_callback(EditBuffer *b, EditBufferCallback cb,
 {
     EditBufferCallbackList *l;
 
-    l = malloc(sizeof(EditBufferCallbackList));
+    l = qe_malloc(EditBufferCallbackList);
     if (!l)
         return -1;
     l->callback = cb;
@@ -632,7 +626,7 @@ void eb_free_callback(EditBuffer *b, EditBufferCallback cb,
         l = *pl;
         if (l->callback == cb && l->opaque == opaque) {
             *pl = l->next;
-            free(l);
+            qe_free(&l);
             break;
        }
     }
@@ -1157,14 +1151,13 @@ int load_buffer(EditBuffer *b, const char *filename,
     /* cannot load a buffer if already I/Os or readonly */
     if (b->flags & (BF_LOADING | BF_SAVING | BF_READONLY))
         return -1;
-    s = malloc(sizeof(BufferIOState));
+    s = qe_malloc(BufferIOState);
     if (!s)
         return -1;
     b->io_state = s;
     h = url_new();
     if (!h) {
-        free(b->io_state);
-        b->io_state = NULL;
+        qe_free(&b->io_state);
         return -1;
     }
     s->handle = h;
@@ -1228,8 +1221,7 @@ static void eb_io_stop(EditBuffer *b, int err)
     }
     url_close(s->handle);
     s->completion_cb(s->opaque, err);
-    free(s);
-    b->io_state = NULL;
+    qe_free(&b->io_state);
 }
 #endif
 
@@ -1276,7 +1268,7 @@ int mmap_buffer(EditBuffer *b, const char *filename)
         return -1;
     }
     n = (file_size + MAX_PAGE_SIZE - 1) / MAX_PAGE_SIZE;
-    p = malloc(n * sizeof(Page));
+    p = qe_malloc_array(Page, n);
     if (!p) {
         close(fd);
         return -1;
diff --git a/charset.c b/charset.c
index 327ab4b..023d64f 100644
--- a/charset.c
+++ b/charset.c
@@ -300,7 +300,7 @@ void charset_decode_init(CharsetDecodeState *s, QECharset *charset)
     
     s->table = NULL; /* fail safe */
     if (charset->table_alloc) {
-        table = malloc(256 * sizeof(unsigned short));
+        table = qe_malloc_array(unsigned short, 256);
         if (!table) {
             charset = &charset_8859_1;
         } else {
@@ -317,7 +317,7 @@ void charset_decode_close(CharsetDecodeState *s)
 {
     if (s->charset->table_alloc &&
         s->charset != &charset_8859_1)
-        free(s->table);
+        qe_free(&s->table);
     /* safety */
     memset(s, 0, sizeof(CharsetDecodeState));
 }
diff --git a/dired.c b/dired.c
index cc4b46d..987b299 100644
--- a/dired.c
+++ b/dired.c
@@ -63,7 +63,7 @@ static void dired_free(EditState *s)
     
     /* free opaques */
     for (i = 0; i < ds->items.nb_items; i++) {
-        free(ds->items.items[i]->opaque);
+        qe_free(&ds->items.items[i]->opaque);
     }
 
     free_strings(&ds->items);
@@ -296,7 +296,7 @@ static void build_dired_list(EditState *s, const char *path)
         if (item) {
             DiredItem *dip;
 
-            dip = malloc(sizeof(DiredItem) + strlen(p));
+            dip = qe_malloc_hack(DiredItem, strlen(p));
             dip->state = hs;
             dip->mode = st.st_mode;
             dip->size = st.st_size;
diff --git a/display.c b/display.c
index fb3e3d9..a646dc1 100644
--- a/display.c
+++ b/display.c
@@ -223,23 +223,25 @@ QEBitmap *bmp_alloc(QEditScreen *s, int width, int height, int flags)
 
     if (!s->dpy.dpy_bmp_alloc)
         return NULL;
-    b = malloc(sizeof(QEBitmap));
+    b = qe_malloc(QEBitmap);
     if (!b)
         return NULL;
     b->width = width;
     b->height = height;
     b->flags = flags;
     if (s->dpy.dpy_bmp_alloc(s, b) < 0) {
-        free(b);
+        qe_free(&b);
         return NULL;
     }
     return b;
 }
 
-void bmp_free(QEditScreen *s, QEBitmap *b)
+void bmp_free(QEditScreen *s, QEBitmap **bp)
 {
-    s->dpy.dpy_bmp_free(s, b);
-    free(b);
+    if (*bp) {
+        s->dpy.dpy_bmp_free(s, *bp);
+        qe_free(bp);
+    }
 }
 
 void bmp_draw(QEditScreen *s, QEBitmap *b, 
diff --git a/display.h b/display.h
index 07575fe..e83b8b0 100644
--- a/display.h
+++ b/display.h
@@ -222,7 +222,7 @@ void selection_activate(QEditScreen *s);
 void selection_request(QEditScreen *s);
 
 QEBitmap *bmp_alloc(QEditScreen *s, int width, int height, int flags);
-void bmp_free(QEditScreen *s, QEBitmap *b);
+void bmp_free(QEditScreen *s, QEBitmap **bp);
 void bmp_draw(QEditScreen *s, QEBitmap *b, 
               int dst_x, int dst_y, int dst_w, int dst_h, 
               int offset_x, int offset_y, int flags);
diff --git a/fbfrender.c b/fbfrender.c
index b8ce065..73fe6ff 100644
--- a/fbfrender.c
+++ b/fbfrender.c
@@ -98,10 +98,10 @@ static GlyphCache *add_cached_glyph(QEFont *font, int index, int data_size)
         while (*pp != p) pp = &(*pp)->hash_next;
         *pp = p->hash_next;
 
-        free(p);
+        qe_free(&p);
     }
 
-    p = malloc(sizeof(GlyphCache) + data_size);
+    p = qe_malloc_hack(GlyphCache, data_size);
     if (!p)
         return NULL;
 
@@ -237,7 +237,7 @@ QEFont *fbf_open_font(__unused__ QEditScreen *s, int style, int size)
     UniFontData *fonts[MAX_MATCHES];
     int nb_fonts, i;
 
-    font = malloc(sizeof(QEFont));
+    font = qe_malloc(QEFont);
     if (!font)
         return NULL;
 
@@ -278,17 +278,17 @@ QEFont *fbf_open_font(__unused__ QEditScreen *s, int style, int size)
 
 void fbf_close_font(__unused__ QEditScreen *s, QEFont *font)
 {
-    free(font);
+    qe_free(&font);
 }
 
 static void *my_malloc(__unused__ void *opaque, int size)
 {
-    return malloc(size);
+    return qe_malloc_bytes(size);
 }
 
 static void my_free(__unused__ void *opaque, void *ptr)
 {
-    free(ptr);
+    qe_free(&ptr);
 }
 
 
@@ -322,12 +322,11 @@ static int fbf_load_font_file(const char *filename)
     if (!f) 
         return -1;
 
-    uf = malloc(sizeof(UniFontData));
+    uf = qe_mallocz(UniFontData);
     if (!uf) {
         fclose(f);
         return -1;
     }
-    memset(uf, 0, sizeof(*uf));
 
     /* init memory */
     uf->mem_opaque = NULL;
@@ -341,7 +340,7 @@ static int fbf_load_font_file(const char *filename)
     uf->fbf_getc = my_fbf_getc;
 
     if (fbf_load_font(uf) < 0) {
-        free(uf);
+        qe_free(&uf);
         fclose(f);
         return -1;
     }
@@ -430,19 +429,17 @@ static int fbf_load_font_memory(const unsigned char *data,
     UniFontData *uf;
     MemoryFile *f;
 
-    f = malloc(sizeof(MemoryFile));
+    f = qe_mallocz(MemoryFile);
     if (!f)
         return -1;
     f->base = data;
     f->size = data_size;
-    f->offset = 0;
     
-    uf = malloc(sizeof(UniFontData));
+    uf = qe_mallocz(UniFontData);
     if (!uf) {
-        free(f);
+        qe_free(&f);
         return -1;
     }
-    memset(uf, 0, sizeof(*uf));
 
     /* init memory */
     uf->mem_opaque = NULL;
@@ -456,8 +453,8 @@ static int fbf_load_font_memory(const unsigned char *data,
     uf->fbf_getc = my_fbf_getc;
 
     if (fbf_load_font(uf) < 0) {
-        free(uf);
-        free(f);
+        qe_free(&uf);
+        qe_free(&f);
         return -1;
     }
 
@@ -495,8 +492,8 @@ void fbf_render_cleanup(void)
         /* close font data structures */
         fbf_free_font(uf);
         /* close font file */
-        free(uf->infile);
-        free(uf);
+        qe_free(&uf->infile);
+        qe_free(&uf);
     }
     first_font = NULL;
 }
diff --git a/html2png.c b/html2png.c
index 7572751..56bd8d6 100644
--- a/html2png.c
+++ b/html2png.c
@@ -136,14 +136,11 @@ static QEDisplay ppm_dpy = {
 static int ppm_resize(QEditScreen *s, int w, int h)
 {
     CFBContext *cfb = s->private;
-    unsigned char *data;
     
     /* alloc bitmap */
-    data = realloc(cfb->base, w * h * sizeof(int));
-    if (!data) {
+    if (!qe_realloc(&cfb->base, w * h * sizeof(int))) {
         return -1;
     }
-    cfb->base = data;
     cfb->wrap = w * sizeof(int);
     s->width = w;
     s->height = h;
@@ -161,7 +158,7 @@ static int ppm_init(QEditScreen *s, int w, int h)
 
     memcpy(&s->dpy, &ppm_dpy, sizeof(QEDisplay));
 
-    cfb = malloc(sizeof(CFBContext));
+    cfb = qe_malloc(CFBContext);
     if (!cfb)
         return -1;
 
@@ -173,7 +170,8 @@ static int ppm_init(QEditScreen *s, int w, int h)
 
     if (ppm_resize(s, w, h) < 0) {
     fail:
-        free(cfb);
+        qe_free(&cfb->base);
+        qe_free(&s->private);
         return -1;
     }
     return 0;
@@ -183,8 +181,8 @@ static void ppm_close(QEditScreen *s)
 {
     CFBContext *cfb = s->private;
     
-    free(cfb->base);
-    free(cfb);
+    qe_free(&cfb->base);
+    qe_free(&s->private);
 }
 
 static int ppm_save(QEditScreen *s, const char *filename)
@@ -248,7 +246,7 @@ static int png_save(QEditScreen *s, const char *filename)
     if (!d.info_ptr)
         goto fail;
 
-    d.row_buf = malloc(3 * s->width);
+    d.row_buf = qe_malloc_array(u8, 3 * s->width);
     if (!d.row_buf)
         goto fail;
 
@@ -298,7 +296,7 @@ static int png_save(QEditScreen *s, const char *filename)
             png_destroy_write_struct(&d.png_ptr,
                                      d.info_ptr ? &d.info_ptr : NULL);
         }
-        free(d.row_buf);
+        qe_free(&d.row_buf);
         fclose(d.f);
         return -1;
     }
diff --git a/image.c b/image.c
index 3ae855a..2d9c08e 100644
--- a/image.c
+++ b/image.c
@@ -268,18 +268,17 @@ static ImageBuffer *image_allocate(int pix_fmt, int width, int height)
     int size;
     ImageBuffer *ib;
 
-    ib = malloc(sizeof(ImageBuffer));
+    ib = qe_mallocz(ImageBuffer);
     if (!ib)
         return NULL;
-    memset(ib, 0, sizeof(ImageBuffer));
 
     size = avpicture_get_size(pix_fmt, width, height);
     if (size < 0)
         goto fail;
-    ptr = malloc(size);
+    ptr = qe_malloc_array(u8, size);
     if (!ptr) {
     fail:
-        free(ib);
+        qe_free(&ib);
         return NULL;
     }
 
@@ -292,8 +291,8 @@ static ImageBuffer *image_allocate(int pix_fmt, int width, int height)
 
 static void image_free(ImageBuffer *ib)
 {
-    free(ib->pict.data[0]);
-    free(ib);
+    qe_free(&ib->pict.data[0]);
+    qe_free(&ib);
 }
 
 
@@ -396,7 +395,9 @@ static int image_buffer_save(EditBuffer *b, const char *filename)
 static void image_buffer_close(EditBuffer *b)
 {
     ImageBuffer *ib = b->data;
+
     image_free(ib);
+    b->data = NULL;
 }
 
 
@@ -410,10 +411,7 @@ static void update_bmp(EditState *s)
     int dst_pix_fmt;
     int i;
 
-    if (is->disp_bmp) {
-        bmp_free(s->screen, is->disp_bmp);
-        is->disp_bmp = NULL;
-    }
+    bmp_free(s->screen, &is->disp_bmp);
 
     /* combine with the appropriate background if alpha is present */
     ib1 = NULL;
@@ -577,10 +575,7 @@ static void image_mode_close(EditState *s)
 {
     ImageState *is = s->mode_data;
 
-    if (is->disp_bmp) {
-        bmp_free(s->screen, is->disp_bmp);
-        is->disp_bmp = NULL;
-    }
+    bmp_free(s->screen, &is->disp_bmp);
     eb_free_callback(s->b, image_callback, s);
 }
 
@@ -761,7 +756,7 @@ static void image_convert(EditState *e, const char *pix_fmt_str)
         }
     }
     ib1->alpha_info = img_get_alpha_info(&ib1->pict, ib1->pix_fmt, 
-                                        ib1->width, ib1->height);
+                                         ib1->width, ib1->height);
     set_new_image(b, ib1);
     image_free(ib);
     /* suppress that and use callback */
diff --git a/input.c b/input.c
index 109da03..691a45b 100644
--- a/input.c
+++ b/input.c
@@ -263,7 +263,7 @@ static void load_input_methods(void)
         p += 4;
         if (offset == 0)
             break;
-        m = malloc(sizeof(InputMethod));
+        m = qe_malloc(InputMethod);
         if (m) {
             m->data = file_ptr + offset;
             m->input_match = kmap_input;
diff --git a/libqhtml/css.c b/libqhtml/css.c
index 810eda9..2241505 100644
--- a/libqhtml/css.c
+++ b/libqhtml/css.c
@@ -310,7 +310,7 @@ CSSIdent css_new_ident(const char *str)
         }
         p = p->hash_next;
     }
-    p = malloc(sizeof(CSSIdentEntry) + strlen(str));
+    p = qe_malloc_hack(CSSIdentEntry, strlen(str));
     if (!p)
         return CSS_ID_NIL;
     p->id = table_ident_nb;
@@ -321,12 +321,10 @@ CSSIdent css_new_ident(const char *str)
     /* put ident in table */
     if (table_ident_nb == table_ident_allocated) {
         n = table_ident_allocated + CSS_IDENT_INCR;
-        pp = realloc(table_ident, n * sizeof(CSSIdentEntry *));
-        if (!pp) {
-            free(p);
+        if (!qe_realloc(&table_ident, n * sizeof(CSSIdentEntry *))) {
+            qe_free(&p);
             return CSS_ID_NIL;
         }
-        table_ident = pp;
         table_ident_allocated = n;
     }
     table_ident[table_ident_nb++] = p;
@@ -364,7 +362,7 @@ static void set_counter(CSSContext *s, CSSIdent counter_id, int value)
             p->value = value;
         }
     }
-    p = malloc(sizeof(CSSCounterValue));
+    p = qe_malloc(CSSCounterValue);
     if (!p)
         return;
     p->counter_id = counter_id;
@@ -389,7 +387,7 @@ static void pop_counters(CSSContext *s, CSSCounterValue *p2)
 
     for (p = s->counter_stack_ptr; p != s->counter_stack_base; p = p1) {
         p1 = p->prev;
-        free(p);
+        qe_free(&p);
         p = p1;
     }
     s->counter_stack_ptr = s->counter_stack_base;
@@ -659,7 +657,7 @@ static char *eval_content(CSSContext *s, CSSProperty *p, CSSBox *box)
         value++;
     }
     if (buf[0] != '\0')
-        return strdup(buf);
+        return qe_strdup(buf);
     else
         return NULL;
 }
@@ -840,11 +838,10 @@ static CSSState *allocate_props(CSSContext *s, CSSState *props)
         pp = &p->hash_next;
     }
     /* add new props */
-    p = malloc(sizeof(CSSState));
+    p = qe_malloc_dup(props, sizeof(CSSState));
     if (!p)
         return NULL;
     s->nb_props++;
-    memcpy(p, props, sizeof(CSSState));
     *pp = p;
     p->hash_next = NULL;
     return p;
@@ -853,7 +850,7 @@ static CSSState *allocate_props(CSSContext *s, CSSState *props)
 /* free one CSSState */
 static void free_props(CSSState *props)
 {
-    free(props);
+    qe_free(&props);
 }
 
 static int css_compute_block(CSSContext *s, CSSBox *box, 
@@ -878,7 +875,7 @@ static CSSBox *add_before_after_box(CSSContext *s,
     css_compute_block(s, box1, pelement_props);
     
     css_set_text_string(box1, content);
-    free(content);
+    qe_free(&content);
     /* XXX: make child box */
     return box1;
 }
@@ -1150,10 +1147,9 @@ static void css_box_split(CSSBox *box1, int offset)
     }
 #endif    
 
-    box2 = malloc(sizeof(CSSBox));
+    box2 = qe_mallocz(CSSBox);
     if (!box2) 
         return;
-    memset(box2, 0, sizeof(CSSBox));
     box2->split = 1;
     box2->props = box1->props; /* same properties */
     box2->content_type = box1->content_type;
@@ -1648,7 +1644,7 @@ static int css_layout_float(InlineLayout *s, FloatBlock *b)
 #endif
     /* layout the interior */
     if (css_layout_block(s->ctx, &layout, box)) {
-        free(b);
+        qe_free(&b);
         return -1;
     }
     /* add the float in the float list */
@@ -1856,10 +1852,9 @@ static void css_flush_line(InlineLayout *s,
 
     if (level_max > 0) {
         /* needed to do bidir reordering */
-        box_table = malloc(sizeof(InlineBox) * nb_boxes);
+        box_table = qe_malloc_dup(line_boxes, sizeof(InlineBox) * nb_boxes);
         if (box_table) {
             /* record the logical order of the boxes */
-            memcpy(box_table, line_boxes, nb_boxes * sizeof(InlineBox));
             /* rearrange them to match visual order */
             embed_boxes(box_table, nb_boxes, level_max);
         }
@@ -1939,8 +1934,7 @@ static void css_flush_line(InlineLayout *s,
     y += line_height;
     s->y = y;
 
-    if (box_table)
-        free(box_table);
+    qe_free(&box_table);
     
     /* prepare for next line */
  the_end:
@@ -2445,7 +2439,7 @@ static void allocate_column(TableLayout *s)
     s->nb_cols++;
     if (s->nb_cols > s->nb_cols_allocated) {
         s->nb_cols_allocated = s->nb_cols_allocated + COL_INCR;
-        s->cols = realloc(s->cols, s->nb_cols_allocated * sizeof(ColStruct));
+        qe_realloc(&s->cols, s->nb_cols_allocated * sizeof(ColStruct));
         memset(s->cols + s->nb_cols_allocated - COL_INCR, 0, 
                COL_INCR * sizeof(ColStruct));
     }
@@ -3084,14 +3078,14 @@ static int css_layout_table(CSSContext *s, LayoutOutput *table_layout,
     tl->caption_box = NULL;
     if (layout_table_render(tl, table_box)) {
     fail:
-        free(tl->cols);
+        qe_free(&tl->cols);
         return -1;
     }
     tl->y += tl->border_v;
     /* compute total table height */
     table_box->height = max(tl->y, table_box->height);
 
-    free(tl->cols);
+    qe_free(&tl->cols);
 
     /* handle table caption */
     caption_box = tl->caption_box;
@@ -3152,7 +3146,7 @@ static int css_add_float(InlineLayout *s, CSSBox *box)
 {
     FloatBlock *b, **pb;
 
-    b = malloc(sizeof(FloatBlock));
+    b = qe_malloc(FloatBlock);
     if (!b)
         return 0;
     b->box = box;
@@ -3173,7 +3167,7 @@ static void css_free_floats(FloatBlock *b)
 
     while (b != NULL) {
         b1 = b->next;
-        free(b);
+        qe_free(&b);
         b = b1;
     }
 }
@@ -4360,10 +4354,9 @@ CSSBox *css_new_box(CSSIdent tag, CSSAttribute *attrs)
 {
     CSSBox *box;
 
-    box = malloc(sizeof(CSSBox));
+    box = qe_mallocz(CSSBox);
     if (!box)
         return NULL;
-    memset(box, 0, sizeof(CSSBox));
     box->tag = tag;
     box->attrs = attrs;
     return box;
@@ -4400,26 +4393,26 @@ void css_delete_box(CSSBox *box)
         case CSS_CONTENT_TYPE_STRING:
             /* split boxes never own their content */
             if (!box->split)
-                free((void *)box->u.buffer.start);
+                qe_free((void **)(void *)&box->u.buffer.start);
             break;
         case CSS_CONTENT_TYPE_IMAGE:
-            free(box->u.image.content_alt);
+            qe_free(&box->u.image.content_alt);
             break;
         }
         box1 = box->next;
         a = box->attrs;
         while (a != NULL) {
             a1 = a->next;
-            free(a);
+            qe_free(&a);
             a = a1;
         }
         p = box->properties;
         while (p != NULL) {
             p1 = p->next;
-            free(p);
+            qe_free(&p);
             p = p1;
         }
-        free(box);
+        qe_free(&box);
         box = box1;
     }
 }
@@ -4440,7 +4433,7 @@ void css_set_text_string(CSSBox *box, const char *string)
     char *str;
 
     box->content_type = CSS_CONTENT_TYPE_STRING;
-    str = strdup(string);
+    str = qe_strdup(string);
     len = strlen(string);
     box->u.buffer.start = (unsigned long)str;
     box->u.buffer.end = (unsigned long)str + len;
@@ -4478,10 +4471,9 @@ CSSContext *css_new_document(QEditScreen *screen,
 {
     CSSContext *s;
 
-    s = malloc(sizeof(CSSContext));
+    s = qe_mallocz(CSSContext);
     if (!s)
         return NULL;
-    memset(s, 0, sizeof(CSSContext));
     s->style_sheet = NULL;
     s->screen = screen;
     s->b = b;
@@ -4511,7 +4503,7 @@ void css_delete_document(CSSContext *s)
     if (s->style_sheet) {
         css_free_style_sheet(s->style_sheet);
     }
-    free(s);
+    qe_free(&s);
 }
 
 /* must be called before using any css functions */
diff --git a/libqhtml/cssparse.c b/libqhtml/cssparse.c
index 2688c94..6aa5daa 100644
--- a/libqhtml/cssparse.c
+++ b/libqhtml/cssparse.c
@@ -181,7 +181,7 @@ static char *css_parse_string(const char **pp)
     *q = '\0';
     //    printf("string='%s'\n", buf);
     *pp = p;
-    return strdup(buf);
+    return qe_strdup(buf);
 }
 
 /* add a given number of values */
@@ -191,8 +191,8 @@ void css_add_prop_values(CSSProperty ***last_prop,
 {
     CSSProperty *prop;
 
-    prop = malloc(sizeof(CSSProperty) + 
-                  (nb_values - 1) * sizeof(CSSPropertyValue));
+    prop = qe_malloc_hack(CSSProperty,
+                          (nb_values - 1) * sizeof(CSSPropertyValue));
     if (!prop)
         return;
     prop->property = property_index;
@@ -618,10 +618,9 @@ CSSStyleSheet *css_new_style_sheet(void)
 {
     CSSStyleSheet *s;
 
-    s = malloc(sizeof(CSSStyleSheet));
+    s = qe_mallocz(CSSStyleSheet);
     if (!s)
         return NULL;
-    memset(s, 0, sizeof(*s));
     s->plast_entry = &s->first_entry;
     return s;
 }
@@ -632,7 +631,7 @@ static void free_selector(CSSSimpleSelector *ss)
 
     for (attr = ss->attrs; attr != NULL; attr = attr1) {
         attr1 = attr->next;
-        free(attr);
+        qe_free(&attr);
     }
 }
 
@@ -649,18 +648,18 @@ void css_free_style_sheet(CSSStyleSheet *s)
         for (ss = e->sel.next; ss != NULL; ss = ss1) {
             ss1 = ss->next;
             free_selector(ss);
-            free(ss);
+            qe_free(&ss);
         }
         free_selector(&e->sel);
 
         for (p = e->props; p != NULL; p = p1) {
             p1 = p->next;
-            free(p);
+            qe_free(&p);
         }
-        free(e);
+        qe_free(&e);
     }
     
-    free(s);
+    qe_free(&s);
 }
 
 static int bgetc1(CSSParseState *b)
@@ -758,7 +757,7 @@ void add_attribute(CSSStyleSheetAttributeEntry ***last_attr,
 {
     CSSStyleSheetAttributeEntry *ae;
     
-    ae = malloc(sizeof(CSSStyleSheetAttributeEntry) + strlen(value));
+    ae = qe_malloc_hack(CSSStyleSheetAttributeEntry, strlen(value));
     ae->attr = attr;
     ae->op = op;
     strcpy(ae->value, value);
@@ -776,10 +775,9 @@ CSSStyleSheetEntry *add_style_entry(CSSStyleSheet *s,
     CSSStyleSheetEntry *e, **pp;
     
     /* add the style sheet entry */
-    e = malloc(sizeof(CSSStyleSheetEntry));
+    e = qe_mallocz(CSSStyleSheetEntry);
     if (!e)
         return NULL;
-    memset(e, 0, sizeof(*e));
     e->sel = *ss;
     e->media = media;
     
@@ -837,7 +835,7 @@ void css_merge_style_sheet(CSSStyleSheet *s, CSSStyleSheet *a)
         /* add selector operations */
         pss = &e1->sel.next;
         for (ss = e->sel.next; ss != NULL; ss = ss->next) {
-            ss1 = malloc(sizeof(CSSSimpleSelector));
+            ss1 = qe_malloc(CSSSimpleSelector);
             dup_selector(ss1, ss);
             *pss = ss1;
             pss = &ss1->next;
@@ -1063,9 +1061,8 @@ void css_parse_style_sheet(CSSStyleSheet *s, CSSParseState *b)
                 } else if (isalpha(ch)) {
                     tree_op = CSS_TREE_OP_DESCENDANT;
                 add_tree:
-                    ss1 = malloc(sizeof(CSSSimpleSelector));
+                    ss1 = qe_malloc_dup(ss, sizeof(CSSSimpleSelector));
                     if (ss1) {
-                        memcpy(ss1, ss, sizeof(CSSSimpleSelector));
                         last_ss = ss1;
                     }
                     last_tree_op = tree_op;
diff --git a/libqhtml/xmlparse.c b/libqhtml/xmlparse.c
index fb1b237..617c9cf 100644
--- a/libqhtml/xmlparse.c
+++ b/libqhtml/xmlparse.c
@@ -155,7 +155,7 @@ static inline void strbuf_init(StringBuffer *b)
 static inline void strbuf_reset(StringBuffer *b)
 {
     if (b->buf != b->buf1)
-        free(b->buf);
+        qe_free(&b->buf);
     strbuf_init(b);
 }
 
@@ -168,8 +168,7 @@ static void strbuf_addch1(StringBuffer *b, int ch)
     ptr = b->buf;
     if (b->buf == b->buf1)
         ptr = NULL;
-    ptr = realloc(ptr, size1);
-    if (ptr) {
+    if (qe_realloc(&ptr, size1)) {
         if (b->buf == b->buf1)
             memcpy(ptr, b->buf1, STRING_BUF_SIZE);
         b->buf = ptr;
@@ -211,7 +210,7 @@ static void offsetbuf_init(OffsetBuffer *b)
 
 static void offsetbuf_reset(OffsetBuffer *b)
 {
-    free(b->offsets);
+    qe_free(&b->offsets);
     offsetbuf_init(b);
 }
 
@@ -229,8 +228,7 @@ static void offsetbuf_add(OffsetBuffer *b, unsigned int offset)
             if (!n)
                 n = 1;
             n = n * 2;
-            b->offsets = realloc(b->offsets, n * sizeof(unsigned int));
-            if (!b->offsets)
+            if (!qe_realloc(&b->offsets, n * sizeof(unsigned int)))
                 return;
             b->nb_allocated_offsets = n;
         }
@@ -274,10 +272,9 @@ XMLState *xml_begin(CSSStyleSheet *style_sheet, int flags,
 {
     XMLState *s;
     
-    s = malloc(sizeof(XMLState));
+    s = qe_mallocz(XMLState);
     if (!s)
         return NULL;
-    memset(s, 0, sizeof(*s));
     s->flags = flags;
     s->is_html = flags & XML_HTML;
     s->html_syntax = flags & XML_HTML_SYNTAX;
@@ -302,7 +299,7 @@ static CSSAttribute *box_new_attr(CSSIdent attr_id, const char *value)
 {
     CSSAttribute *attr;
 
-    attr = malloc(sizeof(CSSAttribute) + strlen(value));
+    attr = qe_malloc_hack(CSSAttribute, strlen(value));
     if (!attr)
         return NULL;
     attr->attr = attr_id;
@@ -433,7 +430,7 @@ static void html_eval_tag(XMLState *s, CSSBox *box)
         }
         if (value && value[0] != '\0') {
             arg.type = CSS_VALUE_STRING;
-            arg.u.str = strdup(value);
+            arg.u.str = qe_strdup(value);
             css_add_prop(&last_prop, CSS_content_alt, &arg);
         }
         
@@ -1283,7 +1280,7 @@ CSSBox *xml_end(XMLState *s)
     strbuf_reset(&s->str);
     root_box = s->root_box;
     
-    free(s);
+    qe_free(&s);
     return root_box;
 }
 
diff --git a/qe.c b/qe.c
index 9a09776..c70f7ae 100644
--- a/qe.c
+++ b/qe.c
@@ -100,8 +100,7 @@ void qe_register_mode(ModeDef *m)
         char buf[64], *name;
         int size;
 
-        table = malloc(sizeof(CmdDef) * 2);
-        memset(table, 0, sizeof(CmdDef) * 2);
+        table = qe_mallocz_array(CmdDef, 2);
         table->key = KEY_NONE;
         table->alt_key = KEY_NONE;
 
@@ -112,11 +111,10 @@ void qe_register_mode(ModeDef *m)
         size = strlen(buf) + 1;
         buf[size++] = 'S'; /* constant string parameter */
         buf[size++] = '\0';
-        name = malloc(size);
-        memcpy(name, buf, size);
+        name = qe_malloc_dup(buf, size);
         table->name = name;
         table->action.func = (void*)do_cmd_set_mode;
-        table->val = strdup(m->name);
+        table->val = qe_strdup(m->name);
         qe_register_cmd_table(table, NULL);
     }
 }
@@ -166,7 +164,7 @@ static int qe_register_binding1(unsigned int *keys, int nb_keys,
     KeyDef **lp, *p;
 
     /* add key */
-    p = malloc(sizeof(KeyDef) + (nb_keys - 1) * sizeof(unsigned int));
+    p = qe_malloc_hack(KeyDef, (nb_keys - 1) * sizeof(unsigned int));
     if (!p)
         return -1;
     p->nb_keys = nb_keys;
@@ -1602,8 +1600,7 @@ static void do_set_mode_file(EditState *s, ModeDef *m,
                 saved_data_allocated = 1;
         }
         s->mode->mode_close(s);
-        free(s->mode_data);
-        s->mode_data = NULL;
+        qe_free(&s->mode_data);
         s->mode = NULL;
 
         /* try to remove the raw or mode specific data if it is no
@@ -1656,12 +1653,10 @@ static void do_set_mode_file(EditState *s, ModeDef *m,
                 reload_buffer(s, b, f1);
         }
         if (size > 0) {
-            s->mode_data = malloc(size);
+            s->mode_data = qe_mallocz_array(u8, size);
             /* safe fall back: use text mode */
             if (!s->mode_data)
                 m = &text_mode;
-            else
-                memset(s->mode_data, 0, size);
         }
         s->mode = m;
         
@@ -1672,7 +1667,7 @@ static void do_set_mode_file(EditState *s, ModeDef *m,
             s->offset_top = s->mode->text_backward_offset(s, s->offset_top);
     }
     if (saved_data_allocated)
-        free(saved_data);
+        qe_free(&saved_data);
 }
 
 void do_set_mode(EditState *s, ModeDef *m, ModeSavedData *saved_data)
@@ -2357,8 +2352,8 @@ static void flush_line(DisplayState *s,
             /* realloc shadow */
             int n = e->shadow_nb_lines;
             e->shadow_nb_lines = n + LINE_SHADOW_INCR;
-            e->line_shadow = realloc(e->line_shadow, 
-                                     e->shadow_nb_lines * sizeof(QELineShadow));
+            qe_realloc(&e->line_shadow, 
+                       e->shadow_nb_lines * sizeof(QELineShadow));
             /* put an impossible value so that we redraw */
             memset(&e->line_shadow[n], 0xff, 
                    LINE_SHADOW_INCR * sizeof(QELineShadow));
@@ -2916,7 +2911,6 @@ int get_colorized_line(EditState *s, unsigned int *buf, int buf_size,
 {
     int len, l, line, col, offset;
     int colorize_state;
-    unsigned char *ptr;
     
     /* invalidate cache if needed */
     if (s->colorize_max_valid_offset != MAXINT) {
@@ -2930,10 +2924,8 @@ int get_colorized_line(EditState *s, unsigned int *buf, int buf_size,
     /* realloc line buffer if needed */
     if ((line_num + 2) > s->colorize_nb_lines) {
         s->colorize_nb_lines = line_num + 2 + COLORIZED_LINE_PREALLOC_SIZE;
-        ptr = realloc(s->colorize_states, s->colorize_nb_lines);
-        if (!ptr)
+        if (!qe_realloc(&s->colorize_states, s->colorize_nb_lines))
             return 0;
-        s->colorize_states = ptr;
     }
 
     /* propagate state if needed */
@@ -2988,8 +2980,7 @@ void set_colorize_func(EditState *s, ColorizeFunc colorize_func)
 {
     /* invalidate the previous states & free previous colorizer */
     eb_free_callback(s->b, colorize_callback, s);
-    free(s->colorize_states);
-    s->colorize_states = NULL;
+    qe_free(&s->colorize_states);
     s->colorize_nb_lines = 0;
     s->colorize_nb_valid_lines = 0;
     s->colorize_max_valid_offset = MAXINT;
@@ -3134,8 +3125,7 @@ void generic_text_display(EditState *s)
 
     if (s->display_invalid) {
         /* invalidate the line shadow buffer */
-        free(s->line_shadow);
-        s->line_shadow = NULL;
+        qe_free(&s->line_shadow);
         s->shadow_nb_lines = 0;
         s->display_invalid = 0;
     }
@@ -3419,7 +3409,7 @@ void exec_command(EditState *s, CmdDef *d, int argval)
         }
     }
     
-    es = malloc(sizeof(ExecCmdState));
+    es = qe_malloc(ExecCmdState);
     if (!es)
         return;
 
@@ -3485,7 +3475,7 @@ static void parse_args(ExecCmdState *es)
             if (use_argval && es->argval != NO_ARG) {
                 char buf[32];
                 snprintf(buf, sizeof(buf), "%d", es->argval);
-                es->args[es->nb_args].p = strdup(buf);
+                es->args[es->nb_args].p = qe_strdup(buf);
                 es->argval = NO_ARG;
             } else {
                 es->args[es->nb_args].p = NULL;
@@ -3567,11 +3557,11 @@ static void free_cmd(ExecCmdState *es)
     for (i = 0;i < es->nb_args; i++) {
         switch (es->args_type[i]) {
         case CMD_ARG_STRING:
-            free(es->args[i].p);
+            qe_free(&es->args[i].p);
             break;
         }
     }
-    free(es);
+    qe_free(&es);
 }
 
 /* when the argument has been typed by the user, this callback is
@@ -3585,7 +3575,7 @@ static void arg_edit_cb(void *opaque, char *str)
     if (!str) {
         /* command aborted */
     fail:
-        free(str);
+        qe_free(&str);
         free_cmd(es);
         return;
     }
@@ -3601,8 +3591,8 @@ static void arg_edit_cb(void *opaque, char *str)
         break;
     case CMD_ARG_STRING:
         if (str[0] == '\0' && es->default_input[0] != '\0') {
-            free(str);
-            str = strdup(es->default_input);
+            qe_free(&str);
+            str = qe_strdup(es->default_input);
         }
         es->args[index].p = str; /* will be freed at the of the command */
         break;
@@ -3716,8 +3706,7 @@ void do_start_macro(EditState *s)
         return;
     }
     qs->defining_macro = 1;
-    free(qs->macro_keys);
-    qs->macro_keys = NULL;
+    qe_free(&qs->macro_keys);
     qs->nb_macro_keys = 0;
     qs->macro_keys_size = 0;
     put_status(s, "Defining kbd macro...");
@@ -3794,18 +3783,17 @@ void do_define_kbd_macro(EditState *s, const char *name, const char *keys,
     char *macro_name, *p;
 
     size = strlen(name) + 1;
-    macro_name = malloc(size + 2);
+    macro_name = qe_malloc_array(char, size + 2);
     memcpy(macro_name, name, size);
     p = macro_name + size;
     *p++ = 'S';
     *p++ = '\0';
 
-    def = malloc(2 * sizeof(CmdDef));
-    memset(def, 0, sizeof(CmdDef) * 2);
+    def = qe_mallocz_array(CmdDef, 2);
     def->key = def->alt_key = KEY_NONE;
     def->name = macro_name;
     def->action.func = do_execute_macro_keys;
-    def->val = strdup(keys);
+    def->val = qe_strdup(keys);
 
     qe_register_cmd_table(def, NULL);
     do_global_set_key(s, key_bind, name);
@@ -3816,15 +3804,12 @@ void do_define_kbd_macro(EditState *s, const char *name, const char *keys,
 static void macro_add_key(int key)
 {
     QEmacsState *qs = &qe_state;
-    unsigned short *keys;
     int new_size;
 
     if (qs->nb_macro_keys >= qs->macro_keys_size) {
         new_size = qs->macro_keys_size + MACRO_KEY_INCR;
-        keys = realloc(qs->macro_keys, new_size * sizeof(unsigned short));
-        if (!keys)
+        if (!qe_realloc(&qs->macro_keys, new_size * sizeof(unsigned short)))
             return;
-        qs->macro_keys = keys;
         qs->macro_keys_size = new_size;
     }
     qs->macro_keys[qs->nb_macro_keys++] = key;
@@ -4226,10 +4211,9 @@ EditState *edit_new(EditBuffer *b,
     EditState *s;
     QEmacsState *qs = &qe_state;
     
-    s = malloc(sizeof(EditState));
+    s = qe_mallocz(EditState);
     if (!s)
         return NULL;
-    memset(s, 0, sizeof(EditState));
     s->qe_state = qs;
     s->screen = qs->screen;
     s->x1 = x1;
@@ -4306,8 +4290,8 @@ void edit_close(EditState *s)
     if (qs->active_window == s)
         qs->active_window = qs->first_window;
 
-    free(s->line_shadow);
-    free(s);
+    qe_free(&s->line_shadow);
+    qe_free(&s);
 }
 
 static const char *file_completion_ignore_extensions =
@@ -4370,7 +4354,7 @@ void register_completion(const char *name, CompletionFunc completion_func)
 {
     CompletionEntry **lp, *p;
 
-    p = malloc(sizeof(CompletionEntry));
+    p = qe_malloc(CompletionEntry);
     if (!p)
         return;
     p->name = name;
@@ -4536,10 +4520,9 @@ static StringArray *get_history(const char *name)
             return &p->history;
     }
     /* not found: allocate history list */
-    p = malloc(sizeof(HistoryEntry));
+    p = qe_mallocz(HistoryEntry);
     if (!p)
         return NULL;
-    memset(p, 0, sizeof(HistoryEntry));
     pstrcpy(p->name, sizeof(p->name), name);
     p->next = first_history;
     first_history = p;
@@ -4628,14 +4611,13 @@ void do_minibuffer_exit(EditState *s, int do_abort)
     if (hist && hist->nb_items > 0) {
         /* if null string, do not insert in history */
         hist->nb_items--;
-        free(hist->items[hist->nb_items]);
-        hist->items[hist->nb_items] = NULL;
+        qe_free(&hist->items[hist->nb_items]);
         if (buf[0] != '\0')
             add_string(hist, buf);
     }
 
     /* free prompt */
-    free(s->prompt);
+    qe_free(&s->prompt);
 
     edit_close(s);
     eb_free(b);
@@ -4658,7 +4640,7 @@ void do_minibuffer_exit(EditState *s, int do_abort)
     if (do_abort) {
         cb(opaque, NULL);
     } else {
-        retstr = strdup(buf);
+        retstr = qe_strdup(buf);
         cb(opaque, retstr);
     }
 }
@@ -4692,7 +4674,7 @@ void minibuffer_edit(const char *input, const char *prompt,
                  qs->screen->width, qs->status_height, 0);
     /* Should insert at end of window list */
     do_set_mode(s, &minibuffer_mode, NULL);
-    s->prompt = strdup(prompt);
+    s->prompt = qe_strdup(prompt);
     s->minibuf = 1;
     s->bidir = 0;
     s->default_style = QE_STYLE_MINIBUF;
@@ -4921,10 +4903,11 @@ void do_kill_buffer(EditState *s, const char *bufname)
 static void kill_buffer_confirm_cb(void *opaque, char *reply)
 {
     int yes_replied;
+
     if (!reply)
         return;
     yes_replied = (strcmp(reply, "yes") == 0);
-    free(reply);
+    qe_free(&reply);
     if (!yes_replied)
         return;
     kill_buffer_noconfirm(opaque);
@@ -5205,10 +5188,11 @@ void do_save(EditState *s, int save_as)
 static void save_edit_cb(void *opaque, char *filename)
 {
     EditState *s = opaque;
+
     if (!filename)
         return;
     set_filename(s->b, filename);
-    free(filename);
+    qe_free(&filename);
     save_final(s);
 }
 
@@ -5242,7 +5226,7 @@ void do_quit(EditState *s)
     QEmacsState *qs = s->qe_state;
     QuitState *is;
 
-    is = malloc(sizeof(QuitState));
+    is = qe_malloc(QuitState);
     if (!is)
         return;
     
@@ -5345,7 +5329,7 @@ static void quit_confirm_cb(__unused__ void *opaque, char *reply)
         return;
     if (reply[0] == 'y' || reply[0] == 'Y')
         url_exit();
-    free(reply);
+    qe_free(&reply);
 }
 
 
@@ -5578,7 +5562,7 @@ static void isearch_key(void *opaque, int ch)
             last_search_string_len = j;
         }
         qe_ungrab_keys();
-        free(is);
+        qe_free(&is);
         return;
     case KEY_CTRL('s'):
         is->dir = 1;
@@ -5648,7 +5632,7 @@ void do_isearch(EditState *s, int dir)
 {
     ISearchState *is;
 
-    is = malloc(sizeof(ISearchState));
+    is = qe_malloc(ISearchState);
     if (!is)
         return;
     is->s = s;
@@ -5716,7 +5700,7 @@ static void query_replace_abort(QueryReplaceState *is)
 
     qe_ungrab_keys();
     put_status(NULL, "Replaced %d occurrences", is->nb_reps);
-    free(is);
+    qe_free(&is);
     edit_display(s->qe_state);
     dpy_flush(&global_screen);
 }
@@ -5790,7 +5774,7 @@ static void query_replace(EditState *s,
     if (s->b->flags & BF_READONLY)
         return;
 
-    is = malloc(sizeof(QueryReplaceState));
+    is = qe_malloc(QueryReplaceState);
     if (!is)
         return;
     is->s = s;
@@ -6601,7 +6585,7 @@ ModeSavedData *generic_mode_save_data(EditState *s)
 {
     ModeSavedData *saved_data;
 
-    saved_data = malloc(sizeof(ModeSavedData));
+    saved_data = qe_malloc(ModeSavedData);
     if (!saved_data)
         return NULL;
     saved_data->mode = s->mode;
diff --git a/qe.h b/qe.h
index d63af08..4bfdca0 100644
--- a/qe.h
+++ b/qe.h
@@ -74,6 +74,23 @@
 
 /************************/
 
+/* allocation wrappers and utilities */
+void *qe_malloc_bytes(size_t size);
+void *qe_mallocz_bytes(size_t size);
+void *qe_malloc_dup(const void *src, size_t size);
+char *qe_strdup(const char *str);
+void *qe_realloc(void *pp, size_t size);
+#define qe_malloc(t)            ((t *)qe_malloc_bytes(sizeof(t)))
+#define qe_mallocz(t)           ((t *)qe_mallocz_bytes(sizeof(t)))
+#define qe_malloc_array(t, n)   ((t *)qe_malloc_bytes((n) * sizeof(t)))
+#define qe_mallocz_array(t, n)  ((t *)qe_mallocz_bytes((n) * sizeof(t)))
+#define qe_malloc_hack(t, n)    ((t *)qe_malloc_bytes(sizeof(t) + (n)))
+#define qe_mallocz_hack(t, n)   ((t *)qe_mallocz_bytes(sizeof(t) + (n)))
+#define qe_free(pp)      \
+    do { void *_ = (pp); free(*(void **)_); *(void **)_ = NULL; } while (0)
+
+/************************/
+
 typedef unsigned char u8;
 typedef struct EditState EditState;
 typedef struct EditBuffer EditBuffer;
@@ -204,8 +221,7 @@ static inline void qstrinit(QString *q) {
 }
 
 static inline void qstrfree(QString *q) {
-    free(q->data);
-    q->data = NULL;
+    qe_free(&q->data);
 }
 
 int qmemcat(QString *q, const unsigned char *data1, int len1);
diff --git a/shell.c b/shell.c
index 737ff23..b1cd820 100644
--- a/shell.c
+++ b/shell.c
@@ -1065,7 +1065,7 @@ static void shell_close(EditBuffer *b)
     if (s->pty_fd >= 0) {
         set_read_handler(s->pty_fd, NULL, NULL);
     }
-    free(s);
+    qe_free(&s);
 }
 
 EditBuffer *new_shell_buffer(const char *name, const char *path,
@@ -1080,12 +1080,11 @@ EditBuffer *new_shell_buffer(const char *name, const char *path,
     set_buffer_name(b, name); /* ensure that the name is unique */
     eb_set_charset(b, &charset_vt100);
 
-    s = malloc(sizeof(ShellState));
+    s = qe_mallocz(ShellState);
     if (!s) {
         eb_free(b);
         return NULL;
     }
-    memset(s, 0, sizeof(ShellState));
     b->priv_data = s;
     b->close = shell_close;
     eb_add_callback(b, eb_offset_callback, &s->cur_offset);
@@ -1101,7 +1100,7 @@ EditBuffer *new_shell_buffer(const char *name, const char *path,
         b_color = eb_new("*color*", BF_SYSTEM);
         if (!b_color) {
             eb_free(b);
-            free(s);
+            qe_free(&s);
             return NULL;
         }
         /* no undo info in this color buffer */
diff --git a/tty.c b/tty.c
index c4166af..f2a8599 100644
--- a/tty.c
+++ b/tty.c
@@ -271,8 +271,8 @@ static void tty_resize(__unused__ int sig)
     count = s->width * s->height;
     size = count * sizeof(TTYChar);
     /* screen buffer + shadow buffer + extra slot for loop guard */
-    ts->screen = realloc(ts->screen, size * 2 + 1);
-    ts->line_updated = realloc(ts->line_updated, s->height);
+    qe_realloc(&ts->screen, size * 2 + 1);
+    qe_realloc(&ts->line_updated, s->height);
     ts->screen_size = count;
     
     /* Erase shadow buffer to impossible value */
@@ -569,7 +569,7 @@ static QEFont *tty_term_open_font(__unused__ QEditScreen *s,
 {
     QEFont *font;
 
-    font = malloc(sizeof(QEFont));
+    font = qe_malloc(QEFont);
     if (!font)
         return NULL;
 
@@ -581,7 +581,7 @@ static QEFont *tty_term_open_font(__unused__ QEditScreen *s,
 
 static void tty_term_close_font(__unused__ QEditScreen *s, QEFont *font)
 {
-    free(font);
+    qe_free(&font);
 }
 
 /*
diff --git a/unicode_join.c b/unicode_join.c
index a1952ac..699b7f6 100644
--- a/unicode_join.c
+++ b/unicode_join.c
@@ -45,7 +45,7 @@ static unsigned short *read_array_be16(FILE *f, int n)
     unsigned short *tab;
     int i;
 
-    tab = malloc(n * sizeof(unsigned short));
+    tab = qe_malloc_array(unsigned short, n);
     if (!tab) 
         return NULL;
     for (i = 0; i < n; i++) {
@@ -86,12 +86,9 @@ void load_ligatures(void)
     fclose(f);
     return;
  fail:
-    free(subst1);
-    free(ligature2);
-    free(ligature_long);
-    subst1 = NULL;
-    ligature2 = NULL;
-    ligature_long = NULL;
+    qe_free(&subst1);
+    qe_free(&ligature2);
+    qe_free(&ligature_long);
     subst1_count = 0;
     ligature2_count = 0;
     fclose(f);
diff --git a/unix.c b/unix.c
index 4c22479..f3887bb 100644
--- a/unix.c
+++ b/unix.c
@@ -97,12 +97,12 @@ int set_pid_handler(int pid,
         list_for_each(p, &pid_handlers) {
             if (p->pid == pid) {
                 list_del(p);
-                free(p);
+                qe_free(&p);
                 break;
             }
         }
     } else {
-        p = malloc(sizeof(PidHandler));
+        p = qe_malloc(PidHandler);
         if (!p)
             return -1;
         p->pid = pid;
@@ -121,7 +121,7 @@ void register_bottom_half(void (*cb)(void *opaque), void *opaque)
     BottomHalfEntry *bh;
 
     /* Should not fail */
-    bh = malloc(sizeof(BottomHalfEntry));
+    bh = qe_malloc(BottomHalfEntry);
     bh->cb = cb;
     bh->opaque = opaque;
     list_add(bh, &bottom_halves);
@@ -137,7 +137,7 @@ void unregister_bottom_half(void (*cb)(void *opaque), void *opaque)
     list_for_each_safe(bh, bh1, &bottom_halves) {
         if (bh->cb == cb && bh->opaque == opaque) {
             list_del(bh);
-            free(bh);
+            qe_free(&bh);
         }
     }
 }
@@ -146,7 +146,7 @@ QETimer *qe_add_timer(int delay, void *opaque, void (*cb)(void *opaque))
 {
     QETimer *ti;
 
-    ti = malloc(sizeof(QETimer));
+    ti = qe_malloc(QETimer);
     if (!ti)
         return NULL;
     ti->timeout = get_clock_ms() + delay;
@@ -164,7 +164,7 @@ void qe_kill_timer(QETimer *ti)
     while (*pt != NULL) {
         if (*pt == ti) {
             *pt = ti->next;
-            free(ti);
+            qe_free(&ti);
         } else {
             pt = &(*pt)->next;
         }
@@ -180,7 +180,7 @@ static void __call_bottom_halves(void)
         bh = (BottomHalfEntry *)bottom_halves.prev;
         list_del(bh);
         bh->cb(bh->opaque);
-        free(bh);
+        qe_free(&bh);
     }
 }
 
@@ -209,7 +209,7 @@ static inline int check_timers(int max_delay)
             *pt = ti->next;
             /* warning: a new timer can be added in the callback */
             ti->cb(ti->opaque);
-            free(ti);
+            qe_free(&ti);
             call_bottom_halves();
         } else {
             if ((ti->timeout - timeout) < 0)
diff --git a/util.c b/util.c
index 064cc3b..782e209 100644
--- a/util.c
+++ b/util.c
@@ -49,7 +49,7 @@ FindFileState *find_file_open(const char *path, const char *pattern)
 {
     FindFileState *s;
 
-    s = malloc(sizeof(FindFileState));
+    s = qe_malloc(FindFileState);
     if (!s)
         return NULL;
     pstrcpy(s->path, sizeof(s->path), path);
@@ -108,7 +108,7 @@ void find_file_close(FindFileState *s)
 {
     if (s->dir) 
         closedir(s->dir);
-    free(s);
+    qe_free(&s);
 }
 
 #ifdef WIN32
@@ -695,15 +695,14 @@ int css_define_color(const char *name, const char *value)
 
     /* Make room: reallocate table in chunks of 8 entries */
     if ((nb_custom_colors & 7) == 0) {
-        def = malloc((nb_css_colors + nb_custom_colors + 8) *
-                     sizeof(ColorDef));
+        def = qe_malloc_array(ColorDef, nb_css_colors + nb_custom_colors + 8);
         if (!def)
             return -1;
         memcpy(def, custom_colors,
                (nb_css_colors + nb_custom_colors) * sizeof(ColorDef));
             
         if (custom_colors != css_colors)
-            free(custom_colors);
+            qe_free(&custom_colors);
         custom_colors = def;
     }
     /* Check for redefinition */
@@ -715,7 +714,7 @@ int css_define_color(const char *name, const char *value)
     }
 
     def = &custom_colors[nb_css_colors + nb_custom_colors];
-    def->name = strdup(name);
+    def->name = qe_strdup(name);
     def->color = color;
     nb_custom_colors++;
 
@@ -868,16 +867,17 @@ int get_clock_ms(void)
 StringItem *set_string(StringArray *cs, int index, const char *str)
 {
     StringItem *v;
+
     if (index >= cs->nb_items)
         return NULL;
 
-    v = malloc(sizeof(StringItem) + strlen(str));
+    v = qe_malloc_hack(StringItem, strlen(str));
     if (!v)
         return NULL;
     v->selected = 0;
     strcpy(v->str, str);
     if (cs->items[index])
-        free(cs->items[index]);
+        qe_free(&cs->items[index]);
     cs->items[index] = v;
     return v;
 }
@@ -885,15 +885,12 @@ StringItem *set_string(StringArray *cs, int index, const char *str)
 /* make a generic array alloc */
 StringItem *add_string(StringArray *cs, const char *str)
 {
-    StringItem **tmp;
     int n;
 
     if (cs->nb_items >= cs->nb_allocated) {
         n = cs->nb_allocated + 32;
-        tmp = realloc(cs->items, n * sizeof(StringItem *));
-        if (!tmp)
+        if (!qe_realloc(&cs->items, n * sizeof(StringItem *)))
             return NULL;
-        cs->items = tmp;
         cs->nb_allocated = n;
     }
     cs->items[cs->nb_items++] = NULL;
@@ -905,8 +902,8 @@ void free_strings(StringArray *cs)
     int i;
 
     for (i = 0; i < cs->nb_items; i++)
-        free(cs->items[i]);
-    free(cs->items);
+        qe_free(&cs->items[i]);
+    qe_free(&cs->items);
     memset(cs, 0, sizeof(StringArray));
 }
 
@@ -920,9 +917,7 @@ void free_strings(StringArray *cs)
 int qmemcat(QString *q, const unsigned char *data1, int len1)
 {
     int new_len, len, alloc_size;
-    unsigned char *data;
 
-    data = q->data;
     len = q->len;
     new_len = len + len1;
     /* see if we got a new power of two */
@@ -936,13 +931,11 @@ int qmemcat(QString *q, const unsigned char *data1, int len1)
         alloc_size |= (alloc_size >> 8);
         alloc_size |= (alloc_size >> 16);
         /* allocate one more byte for end of string marker */
-        data = realloc(data, alloc_size + 1);
-        if (!data)
+        if (!qe_realloc(&q->data, alloc_size + 1))
             return -1;
-        q->data = data;
     }
-    memcpy(data + len, data1, len1);
-    data[new_len] = '\0'; /* we force a trailing '\0' */
+    memcpy(q->data + len, data1, len1);
+    q->data[new_len] = '\0'; /* we force a trailing '\0' */
     q->len = new_len;
     return 0;
 }
@@ -1054,3 +1047,45 @@ int strsubst(char *buf, int buf_size, const char *from,
 
     return out.pos;
 }
+
+/*---------------- allocation routines ----------------*/
+
+void *qe_malloc_bytes(size_t size)
+{
+    return malloc(size);
+}
+
+void *qe_mallocz_bytes(size_t size)
+{
+    void *p = malloc(size);
+    if (p)
+        memset(p, 0, size);
+    return p;
+}
+
+void *qe_malloc_dup(const void *src, size_t size)
+{
+    void *p = malloc(size);
+    if (p)
+        memcpy(p, src, size);
+    return p;
+}
+
+char *qe_strdup(const char *str)
+{
+    size_t size = strlen(str) + 1;
+    char *p = malloc(size);
+
+    if (p)
+        memcpy(p, str, size);
+    return p;
+}
+
+void *qe_realloc(void *pp, size_t size)
+{
+    void *p = realloc(*(void **)pp, size);
+    if (p)
+        *(void **)pp = p;
+    return p;
+}
+
diff --git a/video.c b/video.c
index 4bdbe59..f417319 100644
--- a/video.c
+++ b/video.c
@@ -192,7 +192,7 @@ static int packet_queue_get(PacketQueue *q, AVPacket *pkt, int block)
             q->nb_packets--;
             q->size -= pkt1->pkt.size;
             *pkt = pkt1->pkt;
-            free(pkt1);
+            av_free_packet(pkt1);
             ret = 1;
             break;
         } else if (!block) {
@@ -354,8 +354,8 @@ static void alloc_picture(void *opaque)
 
     vp = &is->pictq[is->pictq_windex];
     
-    if (vp->bmp)
-        bmp_free(s->screen, vp->bmp);
+    bmp_free(s->screen, &vp->bmp);
+
     /* XXX: use generic function */
     switch (is->video_st->codec.pix_fmt) {
     case PIX_FMT_YUV420P:
@@ -382,9 +382,7 @@ static void alloc_picture(void *opaque)
         if (vp->bmp->width != is->video_st->codec.width ||
             vp->bmp->height != is->video_st->codec.height) {
             is_yuv = 0;
-            if (vp->bmp)
-                bmp_free(s->screen, vp->bmp);
-            vp->bmp = NULL;
+            bmp_free(s->screen, &vp->bmp);
             goto retry;
         }
     } else {
@@ -839,12 +837,9 @@ static void video_mode_close(EditState *s)
     is->abort_request = 1;
     pthread_join(is->parse_tid, NULL);
     /* free all pictures */
-    for (i = 0; i < VIDEO_PICTURE_QUEUE_SIZE;  i++) {
+    for (i = 0; i < VIDEO_PICTURE_QUEUE_SIZE; i++) {
         vp = &is->pictq[i];
-        if (vp->bmp) {
-            bmp_free(s->screen, vp->bmp);
-            vp->bmp = NULL;
-        }
+        bmp_free(s->screen, &vp->bmp);
     }
 
     if (is->video_timer) {
diff --git a/win32.c b/win32.c
index 0c75ff8..936e5b7 100644
--- a/win32.c
+++ b/win32.c
@@ -52,59 +52,60 @@ WinWindow win_ctx;
 int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInst, 
                    LPSTR lpszCmdLine, int nCmdShow)
 {
-   char **argv;
-   int argc, count;
-   char *command_line, *p;
+    char **argv;
+    int argc, count;
+    char *command_line, *p;
 
-   command_line = malloc(strlen(lpszCmdLine) + sizeof(PROG_NAME) + 1);
-   if (!command_line)
-       return 0;
-   strcpy(command_line, PROG_NAME " ");
-   strcat(command_line, lpszCmdLine);
-   _hPrev = hPrevInst;
-   _hInstance = hInstance;
+    command_line = qe_malloc_array(char, sizeof(PROG_NAME) +
+                                   strlen(lpszCmdLine) + 1);
+    if (!command_line)
+        return 0;
+    strcpy(command_line, PROG_NAME " ");
+    strcat(command_line, lpszCmdLine);
+    _hPrev = hPrevInst;
+    _hInstance = hInstance;
 
-   /* simplistic command line parser */
-   p = command_line;
-   count = 0;
-   for (;;) {
-       skip_spaces((const char **)&p);
-       if (*p == '\0')
-           break;
-       while (*p != '\0' && !css_is_space(*p))
-           p++;
-      count++;
-   }
+    /* simplistic command line parser */
+    p = command_line;
+    count = 0;
+    for (;;) {
+        skip_spaces((const char **)&p);
+        if (*p == '\0')
+            break;
+        while (*p != '\0' && !css_is_space(*p))
+            p++;
+        count++;
+    }
 
-   argv = (char **)malloc((count + 1) * sizeof(char *));
-   if (!argv)
-       return 0;
-   
-   argc = 0;
-   p = command_line;
-   for (;;) {
-       skip_spaces((const char **)&p);
-       if (*p == '\0')
-           break;
-       argv[argc++] = p;
-       while (*p != '\0' && !css_is_space(*p))
-           p++;
-       *p = '\0';
-       p++;
-   }
+    argv = qe_malloc_array(char *, count + 1);
+    if (!argv)
+        return 0;
 
-   argv[argc] = NULL;
+    argc = 0;
+    p = command_line;
+    for (;;) {
+        skip_spaces((const char **)&p);
+        if (*p == '\0')
+            break;
+        argv[argc++] = p;
+        while (*p != '\0' && !css_is_space(*p))
+            p++;
+        *p = '\0';
+        p++;
+    }
+
+    argv[argc] = NULL;
 
 #if 0
-   {
-       int i;
-       for (i = 0; i < argc; i++) {
-           printf("%d: '%s'\n", i, argv[i]);
-       }
-   }
+    {
+        int i;
+        for (i = 0; i < argc; i++) {
+            printf("%d: '%s'\n", i, argv[i]);
+        }
+    }
 #endif
 
-   return main1(argc, argv);
+    return main1(argc, argv);
 }
 
 static int win_probe(void)
@@ -205,7 +206,7 @@ static void push_event(QEEvent *ev)
 {
     QEEventQ *e;
     
-    e = malloc(sizeof(QEEventQ));
+    e = qe_malloc(QEEventQ);
     if (!e)
         return;
     e->ev = *ev;
@@ -260,14 +261,14 @@ LRESULT CALLBACK qe_wnd_proc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
         {
             unsigned int scan;
             int ctrl, shift, alt, key;
-            
+
             ctrl = (GetKeyState(VK_CONTROL) & 0x8000);
             shift = (GetKeyState(VK_SHIFT) & 0x8000);
             alt = (GetKeyState(VK_MENU) & 0x8000);
-            
+
             ignore_wchar_msg = 0;
-            
-            scan = (unsigned int) ((lParam >> 16) & 0x1FF);
+
+            scan = (unsigned int)((lParam >> 16) & 0x1FF);
             switch (scan) {
             case 0x00E:
                 ignore_wchar_msg = 1;
@@ -412,7 +413,7 @@ static int get_unicode_key(QEditScreen *s, QEPollData *pd, QEEvent *ev)
             first_event = e->next;
             if (!first_event)
                 last_event = NULL;
-            free(e);
+            qe_free(&e);
             break;
         }
 
@@ -428,19 +429,19 @@ static int get_unicode_key(QEditScreen *s, QEPollData *pd, QEEvent *ev)
 static void win_fill_rectangle(QEditScreen *s,
                                int x1, int y1, int w, int h, QEColor color)
 {
-   RECT rc;
-   HBRUSH hbr;
-   COLORREF col;
+    RECT rc;
+    HBRUSH hbr;
+    COLORREF col;
 
-   /* XXX: suppress XOR mode */
-   if (color == QECOLOR_XOR)
-       color = QERGB(0xff, 0xff, 0xff);
+    /* XXX: suppress XOR mode */
+    if (color == QECOLOR_XOR)
+        color = QERGB(0xff, 0xff, 0xff);
 
-   SetRect(&rc, x1, y1, x1 + w, y1 + h);
-   col = RGB((color >> 16) & 0xff, (color >> 8) & 0xff, color & 0xff);
-   hbr = CreateSolidBrush(col);
-   FillRect(win_ctx.hdc, &rc, hbr);
-   DeleteObject(hbr);
+    SetRect(&rc, x1, y1, x1 + w, y1 + h);
+    col = RGB((color >> 16) & 0xff, (color >> 8) & 0xff, color & 0xff);
+    hbr = CreateSolidBrush(col);
+    FillRect(win_ctx.hdc, &rc, hbr);
+    DeleteObject(hbr);
 }
 
 static QEFont *win_open_font(QEditScreen *s, int style, int size)
@@ -448,7 +449,7 @@ static QEFont *win_open_font(QEditScreen *s, int style, int size)
     QEFont *font;
     TEXTMETRIC tm;
 
-    font = malloc(sizeof(QEFont));
+    font = qe_malloc(QEFont);
     if (!font)
         return NULL;
     GetTextMetrics(win_ctx.hdc, &tm);
@@ -460,7 +461,7 @@ static QEFont *win_open_font(QEditScreen *s, int style, int size)
 
 static void win_close_font(QEditScreen *s, QEFont *font)
 {
-    free(font);
+    qe_free(&font);
 }
 
 static void win_text_metrics(QEditScreen *s, QEFont *font, 
diff --git a/x11.c b/x11.c
index 0734559..3ae277d3 100644
--- a/x11.c
+++ b/x11.c
@@ -528,7 +528,7 @@ static QEFont *term_open_font(QEditScreen *s, int style, int size)
     XftFont *renderFont;
     QEFont *font;
 
-    font = malloc(sizeof(QEFont));
+    font = qe_malloc(QEFont);
     if (!font)
         return NULL;
 
@@ -558,7 +558,7 @@ static QEFont *term_open_font(QEditScreen *s, int style, int size)
                              0);
     if (!renderFont) {
         /* CG: don't know if this can happen, should try fallback? */
-        free(font);
+        qe_free(&font);
         return NULL;
     }
     font->ascent = renderFont->ascent;
@@ -576,7 +576,7 @@ static void term_close_font(QEditScreen *s, QEFont *font)
      * close_font.
      */
     memset(font, 0, sizeof(*font));
-    free(font);
+    qe_free(&font);
 }
 
 static int term_glyph_width(QEditScreen *s, QEFont *font, unsigned int cc)
@@ -665,7 +665,7 @@ static QEFont *term_open_font(__unused__ QEditScreen *s, int style, int size)
     char **list;
     const char *p;
 
-    font = malloc(sizeof(QEFont));
+    font = qe_malloc(QEFont);
     if (!font)
         return NULL;
     
@@ -684,7 +684,7 @@ static QEFont *term_open_font(__unused__ QEditScreen *s, int style, int size)
         p = strchr(p, ',');
         if (!p) {
             /* no font found */
-            free(font);
+            qe_free(&font);
             return NULL;
         }
         p++;
@@ -768,7 +768,7 @@ static QEFont *term_open_font(__unused__ QEditScreen *s, int style, int size)
     return font;
  fail:
     XFreeFontNames(list);
-    free(font);
+    qe_free(&font);
     return NULL;
 }
 
@@ -781,7 +781,7 @@ static void term_close_font(__unused__ QEditScreen *s, QEFont *font)
      * close_font.
      */
     memset(font, 0, sizeof(*font));
-    free(font);
+    qe_free(&font);
 }
 
 /* get a char struct associated to a char. Return NULL if no glyph
@@ -1152,7 +1152,7 @@ static void selection_send(XSelectionRequestEvent *rq)
         b = qs->yank_buffers[qs->yank_current];
         if (!b) 
             return;
-        buf = malloc(b->total_size);
+        buf = qe_malloc_array(unsigned char, b->total_size);
         if (!buf)
             return;
         eb_read(b, 0, buf, b->total_size);
@@ -1160,7 +1160,7 @@ static void selection_send(XSelectionRequestEvent *rq)
         XChangeProperty(display, rq->requestor, rq->property,
                         XA_STRING, 8, PropModeReplace,
                         buf, b->total_size);
-        free(buf);
+        qe_free(&buf);
     }
     ev.xselection.property = rq->property;
     XSendEvent(display, rq->requestor, False, 0, &ev);
@@ -1410,7 +1410,7 @@ static int x11_bmp_alloc(QEditScreen *s, QEBitmap *b)
 {
     X11Bitmap *xb;
 
-    xb = malloc(sizeof(X11Bitmap));
+    xb = qe_malloc(X11Bitmap);
     if (!xb)
         return -1;
     b->priv_data = xb;
@@ -1452,7 +1452,7 @@ static int x11_bmp_alloc(QEditScreen *s, QEBitmap *b)
             XImage *ximage;
             ximage = XCreateImage(display, None, attr.depth, ZPixmap, 0, 
                                   NULL, b->width, b->height, 8, 0);
-            ximage->data = malloc(b->height * ximage->bytes_per_line);
+            ximage->data = qe_malloc_array(char, b->height * ximage->bytes_per_line);
             xb->u.ximage = ximage;
         }
         break;
@@ -1462,7 +1462,7 @@ static int x11_bmp_alloc(QEditScreen *s, QEBitmap *b)
             XShmSegmentInfo *shm_info;
             
             /* XXX: error testing */
-            shm_info = malloc(sizeof(XShmSegmentInfo));
+            shm_info = qe_malloc(XShmSegmentInfo);
             ximage = XShmCreateImage(display, None, attr.depth, ZPixmap, NULL,
                                      shm_info, b->width, b->height);
             shm_info->shmid = shmget(IPC_PRIVATE,
@@ -1487,7 +1487,7 @@ static int x11_bmp_alloc(QEditScreen *s, QEBitmap *b)
             XvImage *xvimage;
             xvimage = XvCreateImage(display, xv_port, xv_format, 0, 
                                     b->width, b->height);
-            xvimage->data = malloc(xvimage->data_size);
+            xvimage->data = qe_malloc_array(char, xvimage->data_size);
             xb->u.xvimage = xvimage;
         }
         break;
@@ -1496,7 +1496,7 @@ static int x11_bmp_alloc(QEditScreen *s, QEBitmap *b)
             XvImage *xvimage;
             XShmSegmentInfo *shm_info;
 
-            shm_info = malloc(sizeof(XShmSegmentInfo));
+            shm_info = qe_malloc(XShmSegmentInfo);
             xvimage = XvShmCreateImage(display, xv_port, xv_format, 0, 
                                        b->width, b->height, shm_info);
             shm_info->shmid = shmget(IPC_PRIVATE,
@@ -1519,7 +1519,7 @@ static int x11_bmp_alloc(QEditScreen *s, QEBitmap *b)
     }
     return 0;
  fail:
-    free(xb);
+    qe_free(&xb);
     return -1;
 }
 
@@ -1539,11 +1539,11 @@ static void x11_bmp_free(__unused__ QEditScreen *s, QEBitmap *b)
         XShmDetach(display, xb->shm_info);
         XDestroyImage(xb->u.ximage);
         shmdt(xb->shm_info->shmaddr);
-        free(xb->shm_info);
+        qe_free(&xb->shm_info);
         break;
 #ifdef CONFIG_XV
     case BMP_XVIMAGE:
-        free(xb->u.xvimage->data);
+        qe_free(&xb->u.xvimage->data);
         XFree(xb->u.xvimage);
         xv_open_count--;
         break;
@@ -1551,12 +1551,12 @@ static void x11_bmp_free(__unused__ QEditScreen *s, QEBitmap *b)
         XShmDetach(display, xb->shm_info);
         XFree(xb->u.xvimage);
         shmdt(xb->shm_info->shmaddr);
-        free(xb->shm_info);
+        qe_free(&xb->shm_info);
         xv_open_count--;
         break;
 #endif
     }
-    free(xb);
+    qe_free(&b->priv_data);
 }
 
 static void x11_bmp_draw(__unused__ QEditScreen *s, QEBitmap *b, 
@@ -1615,7 +1615,7 @@ static void x11_bmp_lock(__unused__ QEditScreen *s, QEBitmap *b, QEPicture *pict
             XImage *ximage;
             ximage = XCreateImage(display, None, attr.depth, ZPixmap, 0, 
                                   NULL, w1, h1, 8, 0);
-            ximage->data = malloc(h1 * ximage->bytes_per_line);
+            ximage->data = qe_malloc_array(char, h1 * ximage->bytes_per_line);
             pict->data[0] = (unsigned char *)ximage->data;
             pict->linesize[0] = ximage->bytes_per_line;
             xb->ximage_lock = ximage;