On many platforms this can depend on the size and timing of the allocation. As soon as a new PAGE has to be allocated (either because the allocation is large, or because the rest of the heap became full), it is zero initialized (pretty sure all OSes do this, to prevent cross-process spying), but if it's just a malloc inside an existing page, it does not clear previous cruft.