If OpenSSL had used calloc() everywhere instead of malloc(), Heartbleed would have still happened.