You'd probably want an alternative libc implementation rather than a compiler flag. However, calloc everywhere won't save you from smashing the stack or pointe

You'd probably want an alternative libc implementation rather than a compiler flag. However, calloc everywhere won't save you from smashing the stack or pointer type confusion (a common source of JavaScript exploits). Very rarely is leftover data from freed memory the source of an exploit.