diff --git a/channels/urbdrc/common/msusb.h b/channels/urbdrc/common/msusb.h
index 71ea3e625..6ce843f83 100644
--- a/channels/urbdrc/common/msusb.h
+++ b/channels/urbdrc/common/msusb.h
@@ -81,8 +81,12 @@ extern "C"
 	FREERDP_API void msusb_msinterface_free(MSUSB_INTERFACE_DESCRIPTOR* MsInterface);
 
 	/* MSUSB_CONFIG exported functions */
-	FREERDP_API MSUSB_CONFIG_DESCRIPTOR* msusb_msconfig_new(void);
 	FREERDP_API void msusb_msconfig_free(MSUSB_CONFIG_DESCRIPTOR* MsConfig);
+
+	WINPR_ATTR_MALLOC(msusb_msconfig_free, 1)
+	FREERDP_API MSUSB_CONFIG_DESCRIPTOR* msusb_msconfig_new(void);
+
+	WINPR_ATTR_MALLOC(msusb_msconfig_free, 1)
 	FREERDP_API MSUSB_CONFIG_DESCRIPTOR* msusb_msconfig_read(wStream* s, UINT32 NumInterfaces);
 	FREERDP_API BOOL msusb_msconfig_write(MSUSB_CONFIG_DESCRIPTOR* MsConfg, wStream* out);
 	FREERDP_API void msusb_msconfig_dump(MSUSB_CONFIG_DESCRIPTOR* MsConfg);
diff --git a/client/X11/xf_cliprdr.h b/client/X11/xf_cliprdr.h
index 7f571c477..33d75c822 100644
--- a/client/X11/xf_cliprdr.h
+++ b/client/X11/xf_cliprdr.h
@@ -25,9 +25,11 @@
 
 #include <freerdp/client/cliprdr.h>
 
-xfClipboard* xf_clipboard_new(xfContext* xfc, BOOL relieveFilenameRestriction);
 void xf_clipboard_free(xfClipboard* clipboard);
 
+WINPR_ATTR_MALLOC(xf_clipboard_free, 1)
+xfClipboard* xf_clipboard_new(xfContext* xfc, BOOL relieveFilenameRestriction);
+
 void xf_cliprdr_init(xfContext* xfc, CliprdrClientContext* cliprdr);
 void xf_cliprdr_uninit(xfContext* xfc, CliprdrClientContext* cliprdr);
 
diff --git a/client/X11/xf_disp.h b/client/X11/xf_disp.h
index 90625015e..c3c87926a 100644
--- a/client/X11/xf_disp.h
+++ b/client/X11/xf_disp.h
@@ -28,8 +28,11 @@
 FREERDP_API BOOL xf_disp_init(xfDispContext* xfDisp, DispClientContext* disp);
 FREERDP_API BOOL xf_disp_uninit(xfDispContext* xfDisp, DispClientContext* disp);
 
-xfDispContext* xf_disp_new(xfContext* xfc);
 void xf_disp_free(xfDispContext* disp);
+
+WINPR_ATTR_MALLOC(xf_disp_free, 1)
+xfDispContext* xf_disp_new(xfContext* xfc);
+
 BOOL xf_disp_handle_xevent(xfContext* xfc, const XEvent* event);
 BOOL xf_disp_handle_configureNotify(xfContext* xfc, int width, int height);
 void xf_disp_resized(xfDispContext* disp);
diff --git a/client/X11/xf_floatbar.h b/client/X11/xf_floatbar.h
index bf09363a9..1ac7c9160 100644
--- a/client/X11/xf_floatbar.h
+++ b/client/X11/xf_floatbar.h
@@ -22,9 +22,11 @@ typedef struct xf_floatbar xfFloatbar;
 
 #include "xfreerdp.h"
 
-xfFloatbar* xf_floatbar_new(xfContext* xfc, Window window, const char* title, DWORD flags);
 void xf_floatbar_free(xfFloatbar* floatbar);
 
+WINPR_ATTR_MALLOC(xf_floatbar_free, 1)
+xfFloatbar* xf_floatbar_new(xfContext* xfc, Window window, const char* title, DWORD flags);
+
 BOOL xf_floatbar_is_locked(xfFloatbar* floatbar);
 BOOL xf_floatbar_event_process(xfFloatbar* floatbar, const XEvent* event);
 BOOL xf_floatbar_check_event(xfFloatbar* floatbar, const XEvent* event);
diff --git a/client/X11/xf_video.h b/client/X11/xf_video.h
index 83708f0df..385b4eae7 100644
--- a/client/X11/xf_video.h
+++ b/client/X11/xf_video.h
@@ -27,7 +27,9 @@
 void xf_video_control_init(xfContext* xfc, VideoClientContext* video);
 void xf_video_control_uninit(xfContext* xfc, VideoClientContext* video);
 
-xfVideoContext* xf_video_new(xfContext* xfc);
 void xf_video_free(xfVideoContext* context);
 
+WINPR_ATTR_MALLOC(xf_video_free, 1)
+xfVideoContext* xf_video_new(xfContext* xfc);
+
 #endif /* CLIENT_X11_XF_VIDEO_H_ */
diff --git a/include/freerdp/assistance.h b/include/freerdp/assistance.h
index 38ccf3f2f..f6e9aa9f6 100644
--- a/include/freerdp/assistance.h
+++ b/include/freerdp/assistance.h
@@ -55,9 +55,11 @@ extern "C"
 	FREERDP_API BOOL freerdp_assistance_get_encrypted_pass_stub(rdpAssistanceFile* file,
 	                                                            const char** pwd, size_t* size);
 
-	FREERDP_API rdpAssistanceFile* freerdp_assistance_file_new(void);
 	FREERDP_API void freerdp_assistance_file_free(rdpAssistanceFile* file);
 
+	WINPR_ATTR_MALLOC(freerdp_assistance_file_free, 1)
+	FREERDP_API rdpAssistanceFile* freerdp_assistance_file_new(void);
+
 	FREERDP_API void freerdp_assistance_print_file(rdpAssistanceFile* file, wLog* log, DWORD level);
 
 #ifdef __cplusplus
diff --git a/include/freerdp/cache/persistent.h b/include/freerdp/cache/persistent.h
index 037875422..a36595b81 100644
--- a/include/freerdp/cache/persistent.h
+++ b/include/freerdp/cache/persistent.h
@@ -88,9 +88,11 @@ extern "C"
 	                                      BOOL write, UINT32 version);
 	FREERDP_API int persistent_cache_close(rdpPersistentCache* persistent);
 
-	FREERDP_API rdpPersistentCache* persistent_cache_new(void);
 	FREERDP_API void persistent_cache_free(rdpPersistentCache* persistent);
 
+	WINPR_ATTR_MALLOC(persistent_cache_free, 1)
+	FREERDP_API rdpPersistentCache* persistent_cache_new(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/client.h b/include/freerdp/client.h
index 855687965..d30c417ba 100644
--- a/include/freerdp/client.h
+++ b/include/freerdp/client.h
@@ -138,9 +138,11 @@ extern "C"
 
 	/* Common client functions */
 
-	FREERDP_API rdpContext* freerdp_client_context_new(const RDP_CLIENT_ENTRY_POINTS* pEntryPoints);
 	FREERDP_API void freerdp_client_context_free(rdpContext* context);
 
+	WINPR_ATTR_MALLOC(freerdp_client_context_free, 1)
+	FREERDP_API rdpContext* freerdp_client_context_new(const RDP_CLIENT_ENTRY_POINTS* pEntryPoints);
+
 	FREERDP_API int freerdp_client_start(rdpContext* context);
 	FREERDP_API int freerdp_client_stop(rdpContext* context);
 
diff --git a/include/freerdp/client/client_cliprdr_file.h b/include/freerdp/client/client_cliprdr_file.h
index 08cddf621..6dca587f4 100644
--- a/include/freerdp/client/client_cliprdr_file.h
+++ b/include/freerdp/client/client_cliprdr_file.h
@@ -32,9 +32,11 @@ extern "C"
 
 	typedef struct cliprdr_file_context CliprdrFileContext;
 
-	FREERDP_API CliprdrFileContext* cliprdr_file_context_new(void* context);
 	FREERDP_API void cliprdr_file_context_free(CliprdrFileContext* file);
 
+	WINPR_ATTR_MALLOC(cliprdr_file_context_free, 1)
+	FREERDP_API CliprdrFileContext* cliprdr_file_context_new(void* context);
+
 	/**! \brief returns if the implementation supports pasting files in a client file browser.
 	 *
 	 * \param file the file context to query
diff --git a/include/freerdp/client/file.h b/include/freerdp/client/file.h
index 0eb8540b3..30c6543d7 100644
--- a/include/freerdp/client/file.h
+++ b/include/freerdp/client/file.h
@@ -67,10 +67,14 @@ extern "C"
 	FREERDP_API int freerdp_client_rdp_file_get_integer_option(const rdpFile* file,
 	                                                           const char* name);
 
-	FREERDP_API rdpFile* freerdp_client_rdp_file_new(void);
-	FREERDP_API rdpFile* freerdp_client_rdp_file_new_ex(DWORD flags);
 	FREERDP_API void freerdp_client_rdp_file_free(rdpFile* file);
 
+	WINPR_ATTR_MALLOC(freerdp_client_rdp_file_free, 1)
+	FREERDP_API rdpFile* freerdp_client_rdp_file_new(void);
+
+	WINPR_ATTR_MALLOC(freerdp_client_rdp_file_free, 1)
+	FREERDP_API rdpFile* freerdp_client_rdp_file_new_ex(DWORD flags);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/client/rdpgfx.h b/include/freerdp/client/rdpgfx.h
index 32c599f7e..36be6b00c 100644
--- a/include/freerdp/client/rdpgfx.h
+++ b/include/freerdp/client/rdpgfx.h
@@ -177,9 +177,11 @@ extern "C"
 		PROFILER_DEFINE(SurfaceProfiler)
 	};
 
-	FREERDP_API RdpgfxClientContext* rdpgfx_client_context_new(rdpContext* context);
 	FREERDP_API void rdpgfx_client_context_free(RdpgfxClientContext* context);
 
+	WINPR_ATTR_MALLOC(rdpgfx_client_context_free, 1)
+	FREERDP_API RdpgfxClientContext* rdpgfx_client_context_new(rdpContext* context);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/audio.h b/include/freerdp/codec/audio.h
index 8fa163e7b..2a465f697 100644
--- a/include/freerdp/codec/audio.h
+++ b/include/freerdp/codec/audio.h
@@ -212,12 +212,16 @@ extern "C"
 	FREERDP_API BOOL audio_format_copy(const AUDIO_FORMAT* srcFormat, AUDIO_FORMAT* dstFormat);
 	FREERDP_API BOOL audio_format_compatible(const AUDIO_FORMAT* with, const AUDIO_FORMAT* what);
 
-	FREERDP_API AUDIO_FORMAT* audio_format_new(void);
-	FREERDP_API AUDIO_FORMAT* audio_formats_new(size_t count);
-
 	FREERDP_API void audio_format_free(AUDIO_FORMAT* format);
+
+	WINPR_ATTR_MALLOC(audio_format_free, 1)
+	FREERDP_API AUDIO_FORMAT* audio_format_new(void);
+
 	FREERDP_API void audio_formats_free(AUDIO_FORMAT* formats, size_t count);
 
+	WINPR_ATTR_MALLOC(audio_formats_free, 1)
+	FREERDP_API AUDIO_FORMAT* audio_formats_new(size_t count);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/clear.h b/include/freerdp/codec/clear.h
index 3c6456b87..4f6ab2a83 100644
--- a/include/freerdp/codec/clear.h
+++ b/include/freerdp/codec/clear.h
@@ -44,9 +44,11 @@ extern "C"
 
 	FREERDP_API BOOL clear_context_reset(CLEAR_CONTEXT* clear);
 
-	FREERDP_API CLEAR_CONTEXT* clear_context_new(BOOL Compressor);
 	FREERDP_API void clear_context_free(CLEAR_CONTEXT* clear);
 
+	WINPR_ATTR_MALLOC(clear_context_free, 1)
+	FREERDP_API CLEAR_CONTEXT* clear_context_new(BOOL Compressor);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/dsp.h b/include/freerdp/codec/dsp.h
index 69e728db8..8fbdad7bb 100644
--- a/include/freerdp/codec/dsp.h
+++ b/include/freerdp/codec/dsp.h
@@ -32,13 +32,17 @@ extern "C"
 
 	typedef struct S_FREERDP_DSP_CONTEXT FREERDP_DSP_CONTEXT;
 
+	FREERDP_API void freerdp_dsp_context_free(FREERDP_DSP_CONTEXT* context);
+
+	WINPR_ATTR_MALLOC(freerdp_dsp_context_free, 1)
 	FREERDP_API FREERDP_DSP_CONTEXT* freerdp_dsp_context_new(BOOL encoder);
+
 	FREERDP_API BOOL freerdp_dsp_supports_format(const AUDIO_FORMAT* format, BOOL encode);
 	FREERDP_API BOOL freerdp_dsp_encode(FREERDP_DSP_CONTEXT* context, const AUDIO_FORMAT* srcFormat,
 	                                    const BYTE* data, size_t length, wStream* out);
 	FREERDP_API BOOL freerdp_dsp_decode(FREERDP_DSP_CONTEXT* context, const AUDIO_FORMAT* srcFormat,
 	                                    const BYTE* data, size_t length, wStream* out);
-	FREERDP_API void freerdp_dsp_context_free(FREERDP_DSP_CONTEXT* context);
+
 	FREERDP_API BOOL freerdp_dsp_context_reset(FREERDP_DSP_CONTEXT* context,
 	                                           const AUDIO_FORMAT* targetFormat,
 	                                           UINT32 FramesPerPacket);
diff --git a/include/freerdp/codec/h264.h b/include/freerdp/codec/h264.h
index 57a81648d..6ad96f91e 100644
--- a/include/freerdp/codec/h264.h
+++ b/include/freerdp/codec/h264.h
@@ -82,9 +82,11 @@ extern "C"
 
 	FREERDP_API BOOL h264_context_reset(H264_CONTEXT* h264, UINT32 width, UINT32 height);
 
-	FREERDP_API H264_CONTEXT* h264_context_new(BOOL Compressor);
 	FREERDP_API void h264_context_free(H264_CONTEXT* h264);
 
+	WINPR_ATTR_MALLOC(h264_context_free, 1)
+	FREERDP_API H264_CONTEXT* h264_context_new(BOOL Compressor);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/interleaved.h b/include/freerdp/codec/interleaved.h
index 14d9f9a44..964fb0471 100644
--- a/include/freerdp/codec/interleaved.h
+++ b/include/freerdp/codec/interleaved.h
@@ -48,9 +48,11 @@ extern "C"
 
 	FREERDP_API BOOL bitmap_interleaved_context_reset(BITMAP_INTERLEAVED_CONTEXT* interleaved);
 
-	FREERDP_API BITMAP_INTERLEAVED_CONTEXT* bitmap_interleaved_context_new(BOOL Compressor);
 	FREERDP_API void bitmap_interleaved_context_free(BITMAP_INTERLEAVED_CONTEXT* interleaved);
 
+	WINPR_ATTR_MALLOC(bitmap_interleaved_context_free, 1)
+	FREERDP_API BITMAP_INTERLEAVED_CONTEXT* bitmap_interleaved_context_new(BOOL Compressor);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/nsc.h b/include/freerdp/codec/nsc.h
index da5da9b35..a0a266d4a 100644
--- a/include/freerdp/codec/nsc.h
+++ b/include/freerdp/codec/nsc.h
@@ -66,9 +66,11 @@ extern "C"
 
 	FREERDP_API BOOL nsc_context_reset(NSC_CONTEXT* context, UINT32 width, UINT32 height);
 
-	FREERDP_API NSC_CONTEXT* nsc_context_new(void);
 	FREERDP_API void nsc_context_free(NSC_CONTEXT* context);
 
+	WINPR_ATTR_MALLOC(nsc_context_free, 1)
+	FREERDP_API NSC_CONTEXT* nsc_context_new(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/planar.h b/include/freerdp/codec/planar.h
index 204ff8348..e29bce23d 100644
--- a/include/freerdp/codec/planar.h
+++ b/include/freerdp/codec/planar.h
@@ -53,9 +53,11 @@ extern "C"
 	FREERDP_API BOOL freerdp_bitmap_planar_context_reset(BITMAP_PLANAR_CONTEXT* context,
 	                                                     UINT32 width, UINT32 height);
 
+	FREERDP_API void freerdp_bitmap_planar_context_free(BITMAP_PLANAR_CONTEXT* context);
+
+	WINPR_ATTR_MALLOC(freerdp_bitmap_planar_context_free, 1)
 	FREERDP_API BITMAP_PLANAR_CONTEXT* freerdp_bitmap_planar_context_new(DWORD flags, UINT32 width,
 	                                                                     UINT32 height);
-	FREERDP_API void freerdp_bitmap_planar_context_free(BITMAP_PLANAR_CONTEXT* context);
 
 	FREERDP_API void freerdp_planar_switch_bgr(BITMAP_PLANAR_CONTEXT* planar, BOOL bgr);
 	FREERDP_API void freerdp_planar_topdown_image(BITMAP_PLANAR_CONTEXT* planar, BOOL topdown);
diff --git a/include/freerdp/codec/progressive.h b/include/freerdp/codec/progressive.h
index e71cf00f1..6593e63fb 100644
--- a/include/freerdp/codec/progressive.h
+++ b/include/freerdp/codec/progressive.h
@@ -57,10 +57,14 @@ extern "C"
 
 	FREERDP_API BOOL progressive_context_reset(PROGRESSIVE_CONTEXT* progressive);
 
+	FREERDP_API void progressive_context_free(PROGRESSIVE_CONTEXT* progressive);
+
+	WINPR_ATTR_MALLOC(progressive_context_free, 1)
 	FREERDP_API PROGRESSIVE_CONTEXT* progressive_context_new(BOOL Compressor);
+
+	WINPR_ATTR_MALLOC(progressive_context_free, 1)
 	FREERDP_API PROGRESSIVE_CONTEXT* progressive_context_new_ex(BOOL Compressor,
 	                                                            UINT32 ThreadingFlags);
-	FREERDP_API void progressive_context_free(PROGRESSIVE_CONTEXT* progressive);
 
 	FREERDP_API BOOL progressive_rfx_write_message_progressive_simple(
 	    PROGRESSIVE_CONTEXT* progressive, wStream* s, const RFX_MESSAGE* msg);
diff --git a/include/freerdp/codec/rfx.h b/include/freerdp/codec/rfx.h
index 352a2d969..2b122be67 100644
--- a/include/freerdp/codec/rfx.h
+++ b/include/freerdp/codec/rfx.h
@@ -113,10 +113,14 @@ extern "C"
 	FREERDP_API BOOL rfx_write_message(RFX_CONTEXT* context, wStream* s,
 	                                   const RFX_MESSAGE* message);
 
-	FREERDP_API RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags);
-	FREERDP_API RFX_CONTEXT* rfx_context_new(BOOL encoder);
 	FREERDP_API void rfx_context_free(RFX_CONTEXT* context);
 
+	WINPR_ATTR_MALLOC(rfx_context_free, 1)
+	FREERDP_API RFX_CONTEXT* rfx_context_new_ex(BOOL encoder, UINT32 ThreadingFlags);
+
+	WINPR_ATTR_MALLOC(rfx_context_free, 1)
+	FREERDP_API RFX_CONTEXT* rfx_context_new(BOOL encoder);
+
 	FREERDP_API BOOL rfx_context_reset(RFX_CONTEXT* context, UINT32 width, UINT32 height);
 
 	FREERDP_API BOOL rfx_context_set_mode(RFX_CONTEXT* context, RLGR_MODE mode);
diff --git a/include/freerdp/codec/yuv.h b/include/freerdp/codec/yuv.h
index 95906d797..6a1ea17b6 100644
--- a/include/freerdp/codec/yuv.h
+++ b/include/freerdp/codec/yuv.h
@@ -53,9 +53,11 @@ extern "C"
 
 	FREERDP_API BOOL yuv_context_reset(YUV_CONTEXT* context, UINT32 width, UINT32 height);
 
-	FREERDP_API YUV_CONTEXT* yuv_context_new(BOOL encoder, UINT32 ThreadingFlags);
 	FREERDP_API void yuv_context_free(YUV_CONTEXT* context);
 
+	WINPR_ATTR_MALLOC(yuv_context_free, 1)
+	FREERDP_API YUV_CONTEXT* yuv_context_new(BOOL encoder, UINT32 ThreadingFlags);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codec/zgfx.h b/include/freerdp/codec/zgfx.h
index ff476b051..53e211c35 100644
--- a/include/freerdp/codec/zgfx.h
+++ b/include/freerdp/codec/zgfx.h
@@ -49,9 +49,11 @@ extern "C"
 
 	FREERDP_API void zgfx_context_reset(ZGFX_CONTEXT* zgfx, BOOL flush);
 
-	FREERDP_API ZGFX_CONTEXT* zgfx_context_new(BOOL Compressor);
 	FREERDP_API void zgfx_context_free(ZGFX_CONTEXT* zgfx);
 
+	WINPR_ATTR_MALLOC(zgfx_context_free, 1)
+	FREERDP_API ZGFX_CONTEXT* zgfx_context_new(BOOL Compressor);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/codecs.h b/include/freerdp/codecs.h
index aef14145a..1de39b534 100644
--- a/include/freerdp/codecs.h
+++ b/include/freerdp/codecs.h
@@ -71,9 +71,11 @@ extern "C"
 	FREERDP_API BOOL freerdp_client_codecs_reset(rdpCodecs* codecs, UINT32 flags, UINT32 width,
 	                                             UINT32 height);
 
-	FREERDP_API rdpCodecs* codecs_new(rdpContext* context);
 	FREERDP_API void codecs_free(rdpCodecs* codecs);
 
+	WINPR_ATTR_MALLOC(codecs_free, 1)
+	FREERDP_API rdpCodecs* codecs_new(rdpContext* context);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/crypto/certificate.h b/include/freerdp/crypto/certificate.h
index 8294ee891..d16f90334 100644
--- a/include/freerdp/crypto/certificate.h
+++ b/include/freerdp/crypto/certificate.h
@@ -38,13 +38,20 @@ extern "C"
 
 	typedef struct rdp_certificate rdpCertificate;
 
-	FREERDP_API rdpCertificate* freerdp_certificate_new(void);
-	FREERDP_API rdpCertificate* freerdp_certificate_new_from_file(const char* file);
-	FREERDP_API rdpCertificate* freerdp_certificate_new_from_pem(const char* pem);
-	FREERDP_API rdpCertificate* freerdp_certificate_new_from_der(const BYTE* data, size_t length);
-
 	FREERDP_API void freerdp_certificate_free(rdpCertificate* certificate);
 
+	WINPR_ATTR_MALLOC(freerdp_certificate_free, 1)
+	FREERDP_API rdpCertificate* freerdp_certificate_new(void);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_free, 1)
+	FREERDP_API rdpCertificate* freerdp_certificate_new_from_file(const char* file);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_free, 1)
+	FREERDP_API rdpCertificate* freerdp_certificate_new_from_pem(const char* pem);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_free, 1)
+	FREERDP_API rdpCertificate* freerdp_certificate_new_from_der(const BYTE* data, size_t length);
+
 	FREERDP_API BOOL freerdp_certificate_is_rsa(const rdpCertificate* certificate);
 
 	FREERDP_API char* freerdp_certificate_get_hash(const rdpCertificate* certificate,
diff --git a/include/freerdp/crypto/certificate_data.h b/include/freerdp/crypto/certificate_data.h
index 3fb3250de..275d65481 100644
--- a/include/freerdp/crypto/certificate_data.h
+++ b/include/freerdp/crypto/certificate_data.h
@@ -35,17 +35,22 @@ extern "C"
 
 	FREERDP_API char* freerdp_certificate_data_hash(const char* hostname, UINT16 port);
 
+	FREERDP_API void freerdp_certificate_data_free(rdpCertificateData* data);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_data_free, 1)
 	FREERDP_API rdpCertificateData* freerdp_certificate_data_new(const char* hostname, UINT16 port,
 	                                                             const rdpCertificate* xcert);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_data_free, 1)
 	FREERDP_API rdpCertificateData* freerdp_certificate_data_new_from_pem(const char* hostname,
 	                                                                      UINT16 port,
 	                                                                      const char* pem,
 	                                                                      size_t length);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_data_free, 1)
 	FREERDP_API rdpCertificateData*
 	freerdp_certificate_data_new_from_file(const char* hostname, UINT16 port, const char* file);
 
-	FREERDP_API void freerdp_certificate_data_free(rdpCertificateData* data);
-
 	FREERDP_API BOOL freerdp_certificate_data_equal(const rdpCertificateData* a,
 	                                                const rdpCertificateData* b);
 
diff --git a/include/freerdp/crypto/certificate_store.h b/include/freerdp/crypto/certificate_store.h
index d55062387..bc0a0fe5c 100644
--- a/include/freerdp/crypto/certificate_store.h
+++ b/include/freerdp/crypto/certificate_store.h
@@ -40,13 +40,18 @@ extern "C"
 		CERT_STORE_MISMATCH = -1
 	} freerdp_certificate_store_result;
 
-	FREERDP_API rdpCertificateStore* freerdp_certificate_store_new(const rdpSettings* settings);
 	FREERDP_API void freerdp_certificate_store_free(rdpCertificateStore* store);
 
+	WINPR_ATTR_MALLOC(freerdp_certificate_store_free, 1)
+	FREERDP_API rdpCertificateStore* freerdp_certificate_store_new(const rdpSettings* settings);
+
 	FREERDP_API freerdp_certificate_store_result freerdp_certificate_store_contains_data(
 	    rdpCertificateStore* store, const rdpCertificateData* data);
+
+	WINPR_ATTR_MALLOC(freerdp_certificate_store_free, 1)
 	FREERDP_API rdpCertificateData*
 	freerdp_certificate_store_load_data(rdpCertificateStore* store, const char* host, UINT16 port);
+
 	FREERDP_API BOOL freerdp_certificate_store_save_data(rdpCertificateStore* store,
 	                                                     const rdpCertificateData* data);
 	FREERDP_API BOOL freerdp_certificate_store_remove_data(rdpCertificateStore* store,
diff --git a/include/freerdp/crypto/privatekey.h b/include/freerdp/crypto/privatekey.h
index b6cb3e711..58fd94b40 100644
--- a/include/freerdp/crypto/privatekey.h
+++ b/include/freerdp/crypto/privatekey.h
@@ -30,11 +30,17 @@ extern "C"
 
 	typedef struct rdp_private_key rdpPrivateKey;
 
-	FREERDP_API rdpPrivateKey* freerdp_key_new(void);
-	FREERDP_API rdpPrivateKey* freerdp_key_new_from_file(const char* keyfile);
-	FREERDP_API rdpPrivateKey* freerdp_key_new_from_pem(const char* pem);
 	FREERDP_API void freerdp_key_free(rdpPrivateKey* key);
 
+	WINPR_ATTR_MALLOC(freerdp_key_free, 1)
+	FREERDP_API rdpPrivateKey* freerdp_key_new(void);
+
+	WINPR_ATTR_MALLOC(freerdp_key_free, 1)
+	FREERDP_API rdpPrivateKey* freerdp_key_new_from_file(const char* keyfile);
+
+	WINPR_ATTR_MALLOC(freerdp_key_free, 1)
+	FREERDP_API rdpPrivateKey* freerdp_key_new_from_pem(const char* pem);
+
 	FREERDP_API BOOL freerdp_key_is_rsa(const rdpPrivateKey* key);
 
 	FREERDP_API size_t freerdp_key_get_bits(const rdpPrivateKey* key);
diff --git a/include/freerdp/emulate/scard/smartcard_emulate.h b/include/freerdp/emulate/scard/smartcard_emulate.h
index f2e395a1f..c2865b485 100644
--- a/include/freerdp/emulate/scard/smartcard_emulate.h
+++ b/include/freerdp/emulate/scard/smartcard_emulate.h
@@ -34,9 +34,11 @@ extern "C"
 
 	typedef struct smartcard_emulation_context SmartcardEmulationContext;
 
-	FREERDP_API SmartcardEmulationContext* Emulate_New(const rdpSettings* settings);
 	FREERDP_API void Emulate_Free(SmartcardEmulationContext* context);
 
+	WINPR_ATTR_MALLOC(Emulate_Free, 1)
+	FREERDP_API SmartcardEmulationContext* Emulate_New(const rdpSettings* settings);
+
 	FREERDP_API BOOL Emulate_IsConfigured(SmartcardEmulationContext* context);
 
 	FREERDP_API LONG WINAPI Emulate_SCardEstablishContext(SmartcardEmulationContext* smartcard,
diff --git a/include/freerdp/freerdp.h b/include/freerdp/freerdp.h
index efe2fec50..cf0176f3f 100644
--- a/include/freerdp/freerdp.h
+++ b/include/freerdp/freerdp.h
@@ -557,10 +557,12 @@ owned by rdpRdp */
 	};
 	typedef struct rdp_channel_handles rdpChannelHandles;
 
+	FREERDP_API void freerdp_context_free(freerdp* instance);
+
 	FREERDP_API BOOL freerdp_context_new(freerdp* instance);
 	FREERDP_API BOOL freerdp_context_new_ex(freerdp* instance, rdpSettings* settings);
+
 	FREERDP_API BOOL freerdp_context_reset(freerdp* instance);
-	FREERDP_API void freerdp_context_free(freerdp* instance);
 
 	FREERDP_API BOOL freerdp_connect(freerdp* instance);
 
@@ -613,9 +615,11 @@ owned by rdpRdp */
 	FREERDP_API const char* freerdp_get_build_revision(void);
 	FREERDP_API const char* freerdp_get_build_config(void);
 
-	FREERDP_API freerdp* freerdp_new(void);
 	FREERDP_API void freerdp_free(freerdp* instance);
 
+	WINPR_ATTR_MALLOC(freerdp_free, 1)
+	FREERDP_API freerdp* freerdp_new(void);
+
 	FREERDP_API BOOL freerdp_focus_required(freerdp* instance);
 	FREERDP_API void freerdp_set_focus(freerdp* instance);
 
diff --git a/include/freerdp/gdi/video.h b/include/freerdp/gdi/video.h
index 829d31765..a9e50f81c 100644
--- a/include/freerdp/gdi/video.h
+++ b/include/freerdp/gdi/video.h
@@ -41,9 +41,11 @@ extern "C"
 	FREERDP_API void gdi_video_data_init(rdpGdi* gdi, VideoClientContext* video);
 	FREERDP_API void gdi_video_data_uninit(rdpGdi* gdi, VideoClientContext* context);
 
-	FREERDP_API gdiVideoContext* gdi_video_new(rdpGdi* gdi);
 	FREERDP_API void gdi_video_free(gdiVideoContext* context);
 
+	WINPR_ATTR_MALLOC(gdi_video_free, 1)
+	FREERDP_API gdiVideoContext* gdi_video_new(rdpGdi* gdi);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/graphics.h b/include/freerdp/graphics.h
index f356bf8a5..1b98635b2 100644
--- a/include/freerdp/graphics.h
+++ b/include/freerdp/graphics.h
@@ -163,9 +163,11 @@ extern "C"
 	FREERDP_API void graphics_register_pointer(rdpGraphics* graphics, const rdpPointer* pointer);
 	FREERDP_API void graphics_register_glyph(rdpGraphics* graphics, const rdpGlyph* glyph);
 
-	FREERDP_API rdpGraphics* graphics_new(rdpContext* context);
 	FREERDP_API void graphics_free(rdpGraphics* graphics);
 
+	WINPR_ATTR_MALLOC(graphics_free, 1)
+	FREERDP_API rdpGraphics* graphics_new(rdpContext* context);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/listener.h b/include/freerdp/listener.h
index 637fc4bca..56ede560a 100644
--- a/include/freerdp/listener.h
+++ b/include/freerdp/listener.h
@@ -74,9 +74,11 @@ extern "C"
 		psListenerCheckFileDescriptor CheckPeerAcceptRestrictions;
 	};
 
-	FREERDP_API freerdp_listener* freerdp_listener_new(void);
 	FREERDP_API void freerdp_listener_free(freerdp_listener* instance);
 
+	WINPR_ATTR_MALLOC(freerdp_listener_free, 1)
+	FREERDP_API freerdp_listener* freerdp_listener_new(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/metrics.h b/include/freerdp/metrics.h
index 8365c14c1..6d00bfd62 100644
--- a/include/freerdp/metrics.h
+++ b/include/freerdp/metrics.h
@@ -40,9 +40,11 @@ extern "C"
 	FREERDP_API double metrics_write_bytes(rdpMetrics* metrics, UINT32 UncompressedBytes,
 	                                       UINT32 CompressedBytes);
 
-	FREERDP_API rdpMetrics* metrics_new(rdpContext* context);
 	FREERDP_API void metrics_free(rdpMetrics* metrics);
 
+	WINPR_ATTR_MALLOC(metrics_free, 1)
+	FREERDP_API rdpMetrics* metrics_new(rdpContext* context);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/peer.h b/include/freerdp/peer.h
index 92e10b74e..db092281a 100644
--- a/include/freerdp/peer.h
+++ b/include/freerdp/peer.h
@@ -195,15 +195,19 @@ extern "C"
 		ALIGN64 psPeerRemoteCredentials RemoteCredentials;
 	};
 
+	FREERDP_API void freerdp_peer_context_free(freerdp_peer* client);
+
 	FREERDP_API BOOL freerdp_peer_context_new(freerdp_peer* client);
 	FREERDP_API BOOL freerdp_peer_context_new_ex(freerdp_peer* client, const rdpSettings* settings);
-	FREERDP_API void freerdp_peer_context_free(freerdp_peer* client);
 
 	FREERDP_API const char* freerdp_peer_os_major_type_string(freerdp_peer* client);
 	FREERDP_API const char* freerdp_peer_os_minor_type_string(freerdp_peer* client);
 
-	FREERDP_API freerdp_peer* freerdp_peer_new(int sockfd);
 	FREERDP_API void freerdp_peer_free(freerdp_peer* client);
+
+	WINPR_ATTR_MALLOC(freerdp_peer_free, 1)
+	FREERDP_API freerdp_peer* freerdp_peer_new(int sockfd);
+
 	FREERDP_API BOOL freerdp_peer_set_local_and_hostname(freerdp_peer* client,
 	                                                     const struct sockaddr_storage* peer_addr);
 
diff --git a/include/freerdp/redirection.h b/include/freerdp/redirection.h
index 9b4da7936..2f40e1010 100644
--- a/include/freerdp/redirection.h
+++ b/include/freerdp/redirection.h
@@ -52,9 +52,11 @@ extern "C"
 
 	typedef struct rdp_redirection rdpRedirection;
 
-	FREERDP_API rdpRedirection* redirection_new(void);
 	FREERDP_API void redirection_free(rdpRedirection* redirection);
 
+	WINPR_ATTR_MALLOC(redirection_free, 1)
+	FREERDP_API rdpRedirection* redirection_new(void);
+
 	/** \brief This function checks if all necessary settings for a given \b rdpRedirection are
 	 * available.
 	 *
diff --git a/include/freerdp/server/ainput.h b/include/freerdp/server/ainput.h
index bb06c8418..21c47d64b 100644
--- a/include/freerdp/server/ainput.h
+++ b/include/freerdp/server/ainput.h
@@ -112,9 +112,11 @@ extern "C"
 		psAInputChannelIdAssigned ChannelIdAssigned;
 	};
 
-	FREERDP_API ainput_server_context* ainput_server_context_new(HANDLE vcm);
 	FREERDP_API void ainput_server_context_free(ainput_server_context* context);
 
+	WINPR_ATTR_MALLOC(ainput_server_context_free, 1)
+	FREERDP_API ainput_server_context* ainput_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/audin.h b/include/freerdp/server/audin.h
index b54e5bc73..51d83fe12 100644
--- a/include/freerdp/server/audin.h
+++ b/include/freerdp/server/audin.h
@@ -153,9 +153,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API audin_server_context* audin_server_context_new(HANDLE vcm);
 	FREERDP_API void audin_server_context_free(audin_server_context* context);
 
+	WINPR_ATTR_MALLOC(audin_server_context_free, 1)
+	FREERDP_API audin_server_context* audin_server_context_new(HANDLE vcm);
+
 	/** \brief sets the supported audio formats for AUDIN server channel context.
 	 *
 	 *  \param context The context to set the formats for
diff --git a/include/freerdp/server/cliprdr.h b/include/freerdp/server/cliprdr.h
index 1b273fdd5..77ebb008f 100644
--- a/include/freerdp/server/cliprdr.h
+++ b/include/freerdp/server/cliprdr.h
@@ -134,9 +134,11 @@ extern "C"
 		BOOL hasHugeFileSupport;
 	};
 
-	FREERDP_API CliprdrServerContext* cliprdr_server_context_new(HANDLE vcm);
 	FREERDP_API void cliprdr_server_context_free(CliprdrServerContext* context);
 
+	WINPR_ATTR_MALLOC(cliprdr_server_context_free, 1)
+	FREERDP_API CliprdrServerContext* cliprdr_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/disp.h b/include/freerdp/server/disp.h
index f49cbc997..d17c3c299 100644
--- a/include/freerdp/server/disp.h
+++ b/include/freerdp/server/disp.h
@@ -66,9 +66,11 @@ extern "C"
 		psDispChannelIdAssigned ChannelIdAssigned;
 	};
 
-	FREERDP_API DispServerContext* disp_server_context_new(HANDLE vcm);
 	FREERDP_API void disp_server_context_free(DispServerContext* context);
 
+	WINPR_ATTR_MALLOC(disp_server_context_free, 1)
+	FREERDP_API DispServerContext* disp_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/drdynvc.h b/include/freerdp/server/drdynvc.h
index c6848e428..09453f4c9 100644
--- a/include/freerdp/server/drdynvc.h
+++ b/include/freerdp/server/drdynvc.h
@@ -51,9 +51,11 @@ extern "C"
 		DrdynvcServerPrivate* priv;
 	};
 
-	FREERDP_API DrdynvcServerContext* drdynvc_server_context_new(HANDLE vcm);
 	FREERDP_API void drdynvc_server_context_free(DrdynvcServerContext* context);
 
+	WINPR_ATTR_MALLOC(drdynvc_server_context_free, 1)
+	FREERDP_API DrdynvcServerContext* drdynvc_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/echo.h b/include/freerdp/server/echo.h
index 34e6aa29e..609d8c30d 100644
--- a/include/freerdp/server/echo.h
+++ b/include/freerdp/server/echo.h
@@ -90,9 +90,11 @@ extern "C"
 		psEchoServerChannelIdAssigned ChannelIdAssigned;
 	};
 
-	FREERDP_API echo_server_context* echo_server_context_new(HANDLE vcm);
 	FREERDP_API void echo_server_context_free(echo_server_context* context);
 
+	WINPR_ATTR_MALLOC(echo_server_context_free, 1)
+	FREERDP_API echo_server_context* echo_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/encomsp.h b/include/freerdp/server/encomsp.h
index ef20fe154..534fd3e18 100644
--- a/include/freerdp/server/encomsp.h
+++ b/include/freerdp/server/encomsp.h
@@ -92,9 +92,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API EncomspServerContext* encomsp_server_context_new(HANDLE vcm);
 	FREERDP_API void encomsp_server_context_free(EncomspServerContext* context);
 
+	WINPR_ATTR_MALLOC(encomsp_server_context_free, 1)
+	FREERDP_API EncomspServerContext* encomsp_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/gfxredir.h b/include/freerdp/server/gfxredir.h
index 6ddb2811b..9e10cdf99 100644
--- a/include/freerdp/server/gfxredir.h
+++ b/include/freerdp/server/gfxredir.h
@@ -92,6 +92,7 @@ extern "C"
 		UINT32 confirmedCapsVersion;
 	};
 
+	WINPR_ATTR_MALLOC(gfxredir_server_context_free, 1)
 	FREERDP_API GfxRedirServerContext* gfxredir_server_context_new(HANDLE vcm);
 	FREERDP_API void gfxredir_server_context_free(GfxRedirServerContext* context);
 
diff --git a/include/freerdp/server/location.h b/include/freerdp/server/location.h
index 65238bda6..8078878f9 100644
--- a/include/freerdp/server/location.h
+++ b/include/freerdp/server/location.h
@@ -130,9 +130,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API LocationServerContext* location_server_context_new(HANDLE vcm);
 	FREERDP_API void location_server_context_free(LocationServerContext* context);
 
+	WINPR_ATTR_MALLOC(location_server_context_free, 1)
+	FREERDP_API LocationServerContext* location_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/proxy/proxy_context.h b/include/freerdp/server/proxy/proxy_context.h
index 6b22dafa7..0132c666a 100644
--- a/include/freerdp/server/proxy/proxy_context.h
+++ b/include/freerdp/server/proxy/proxy_context.h
@@ -89,6 +89,7 @@ extern "C"
 	};
 	typedef struct p_server_context pServerContext;
 
+	WINPR_ATTR_MALLOC(StaticChannelContext_free, 1)
 	pServerStaticChannelContext* StaticChannelContext_new(pServerContext* ps, const char* name,
 	                                                      UINT32 id);
 
@@ -164,12 +165,16 @@ extern "C"
 
 	FREERDP_API BOOL pf_context_copy_settings(rdpSettings* dst, const rdpSettings* src);
 	FREERDP_API BOOL pf_context_init_server_context(freerdp_peer* client);
+
+	WINPR_ATTR_MALLOC(freerdp_client_context_free, 1)
 	FREERDP_API pClientContext* pf_context_create_client_context(const rdpSettings* clientSettings);
 
+	FREERDP_API void proxy_data_free(proxyData* pdata);
+
+	WINPR_ATTR_MALLOC(proxy_data_free, 1)
 	FREERDP_API proxyData* proxy_data_new(void);
 	FREERDP_API void proxy_data_set_client_context(proxyData* pdata, pClientContext* context);
 	FREERDP_API void proxy_data_set_server_context(proxyData* pdata, pServerContext* context);
-	FREERDP_API void proxy_data_free(proxyData* pdata);
 
 	FREERDP_API BOOL proxy_data_shall_disconnect(proxyData* pdata);
 	FREERDP_API void proxy_data_abort_connect(proxyData* pdata);
diff --git a/include/freerdp/server/proxy/proxy_server.h b/include/freerdp/server/proxy/proxy_server.h
index 184330727..39e738f3e 100644
--- a/include/freerdp/server/proxy/proxy_server.h
+++ b/include/freerdp/server/proxy/proxy_server.h
@@ -31,6 +31,13 @@ extern "C"
 
 	typedef struct proxy_server proxyServer;
 
+	/**
+	 * @brief pf_server_free Cleans up a (stopped) proxy server instance.
+	 *
+	 * @param server The proxy server to clean up. Might be NULL.
+	 */
+	FREERDP_API void pf_server_free(proxyServer* server);
+
 	/**
 	 * @brief pf_server_new Creates a new proxy server instance
 	 *
@@ -38,15 +45,9 @@ extern "C"
 	 *
 	 * @return A new proxy server instance or NULL on failure.
 	 */
+	WINPR_ATTR_MALLOC(pf_server_free, 1)
 	FREERDP_API proxyServer* pf_server_new(const proxyConfig* config);
 
-	/**
-	 * @brief pf_server_free Cleans up a (stopped) proxy server instance.
-	 *
-	 * @param server The proxy server to clean up. Might be NULL.
-	 */
-	FREERDP_API void pf_server_free(proxyServer* server);
-
 	/**
 	 * @brief pf_server_add_module Allows registering proxy modules that are
 	 *                             build-in instead of shipped as separate
diff --git a/include/freerdp/server/rail.h b/include/freerdp/server/rail.h
index 42361733d..0fdd1a3c1 100644
--- a/include/freerdp/server/rail.h
+++ b/include/freerdp/server/rail.h
@@ -142,8 +142,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API RailServerContext* rail_server_context_new(HANDLE vcm);
 	FREERDP_API void rail_server_context_free(RailServerContext* context);
+
+	WINPR_ATTR_MALLOC(rail_server_context_free, 1)
+	FREERDP_API RailServerContext* rail_server_context_new(HANDLE vcm);
+
 	FREERDP_API UINT rail_server_handle_messages(RailServerContext* context);
 	FREERDP_API void rail_server_set_handshake_ex_flags(RailServerContext* context, DWORD flags);
 
diff --git a/include/freerdp/server/rdpdr.h b/include/freerdp/server/rdpdr.h
index 88dd0c242..8f01f1fc5 100644
--- a/include/freerdp/server/rdpdr.h
+++ b/include/freerdp/server/rdpdr.h
@@ -215,8 +215,10 @@ struct s_rdpdr_server_context
 	rdpContext* rdpcontext;
 };
 
-	FREERDP_API RdpdrServerContext* rdpdr_server_context_new(HANDLE vcm);
-	FREERDP_API void rdpdr_server_context_free(RdpdrServerContext* context);
+FREERDP_API void rdpdr_server_context_free(RdpdrServerContext* context);
+
+WINPR_ATTR_MALLOC(rdpdr_server_context_free, 1)
+FREERDP_API RdpdrServerContext* rdpdr_server_context_new(HANDLE vcm);
 
 #ifdef __cplusplus
 }
diff --git a/include/freerdp/server/rdpecam-enumerator.h b/include/freerdp/server/rdpecam-enumerator.h
index 8e372b38a..800caf8a1 100644
--- a/include/freerdp/server/rdpecam-enumerator.h
+++ b/include/freerdp/server/rdpecam-enumerator.h
@@ -125,9 +125,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API CamDevEnumServerContext* cam_dev_enum_server_context_new(HANDLE vcm);
 	FREERDP_API void cam_dev_enum_server_context_free(CamDevEnumServerContext* context);
 
+	WINPR_ATTR_MALLOC(cam_dev_enum_server_context_free, 1)
+	FREERDP_API CamDevEnumServerContext* cam_dev_enum_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/rdpecam.h b/include/freerdp/server/rdpecam.h
index 43f6eeac2..dd1849478 100644
--- a/include/freerdp/server/rdpecam.h
+++ b/include/freerdp/server/rdpecam.h
@@ -272,9 +272,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API CameraDeviceServerContext* camera_device_server_context_new(HANDLE vcm);
 	FREERDP_API void camera_device_server_context_free(CameraDeviceServerContext* context);
 
+	WINPR_ATTR_MALLOC(camera_device_server_context_free, 1)
+	FREERDP_API CameraDeviceServerContext* camera_device_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/rdpei.h b/include/freerdp/server/rdpei.h
index c9dc83bc0..215f7f1e5 100644
--- a/include/freerdp/server/rdpei.h
+++ b/include/freerdp/server/rdpei.h
@@ -58,9 +58,13 @@ extern "C"
 		BOOL (*onChannelIdAssigned)(RdpeiServerContext* context, UINT32 channelId);
 	};
 
-	FREERDP_API RdpeiServerContext* rdpei_server_context_new(HANDLE vcm);
-	FREERDP_API void rdpei_server_context_reset(RdpeiServerContext* context);
 	FREERDP_API void rdpei_server_context_free(RdpeiServerContext* context);
+
+	WINPR_ATTR_MALLOC(rdpei_server_context_free, 1)
+	FREERDP_API RdpeiServerContext* rdpei_server_context_new(HANDLE vcm);
+
+	FREERDP_API void rdpei_server_context_reset(RdpeiServerContext* context);
+
 	FREERDP_API HANDLE rdpei_server_get_event_handle(RdpeiServerContext* context);
 	FREERDP_API UINT rdpei_server_init(RdpeiServerContext* context);
 	FREERDP_API UINT rdpei_server_handle_messages(RdpeiServerContext* context);
diff --git a/include/freerdp/server/rdpemsc.h b/include/freerdp/server/rdpemsc.h
index cbfbd2fc9..f1ce98a1e 100644
--- a/include/freerdp/server/rdpemsc.h
+++ b/include/freerdp/server/rdpemsc.h
@@ -120,9 +120,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API MouseCursorServerContext* mouse_cursor_server_context_new(HANDLE vcm);
 	FREERDP_API void mouse_cursor_server_context_free(MouseCursorServerContext* context);
 
+	WINPR_ATTR_MALLOC(mouse_cursor_server_context_free, 1)
+	FREERDP_API MouseCursorServerContext* mouse_cursor_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/rdpgfx.h b/include/freerdp/server/rdpgfx.h
index 39fadd51f..262bb386c 100644
--- a/include/freerdp/server/rdpgfx.h
+++ b/include/freerdp/server/rdpgfx.h
@@ -139,8 +139,11 @@ extern "C"
 		psRdpgfxServerInitialize Initialize;
 	};
 
-	FREERDP_API RdpgfxServerContext* rdpgfx_server_context_new(HANDLE vcm);
 	FREERDP_API void rdpgfx_server_context_free(RdpgfxServerContext* context);
+
+	WINPR_ATTR_MALLOC(rdpgfx_server_context_free, 1)
+	FREERDP_API RdpgfxServerContext* rdpgfx_server_context_new(HANDLE vcm);
+
 	FREERDP_API BOOL rdpgfx_server_set_own_thread(RdpgfxServerContext* context,
 	                                              BOOL internalThread);
 	FREERDP_API HANDLE rdpgfx_server_get_event_handle(RdpgfxServerContext* context);
diff --git a/include/freerdp/server/rdpsnd.h b/include/freerdp/server/rdpsnd.h
index 6c8355ca7..cbd5eab3d 100644
--- a/include/freerdp/server/rdpsnd.h
+++ b/include/freerdp/server/rdpsnd.h
@@ -179,9 +179,13 @@ extern "C"
 		psRdpsndChannelIdAssigned ChannelIdAssigned;
 	};
 
-	FREERDP_API RdpsndServerContext* rdpsnd_server_context_new(HANDLE vcm);
-	FREERDP_API void rdpsnd_server_context_reset(RdpsndServerContext*);
 	FREERDP_API void rdpsnd_server_context_free(RdpsndServerContext* context);
+
+	WINPR_ATTR_MALLOC(rdpsnd_server_context_free, 1)
+	FREERDP_API RdpsndServerContext* rdpsnd_server_context_new(HANDLE vcm);
+
+	FREERDP_API void rdpsnd_server_context_reset(RdpsndServerContext*);
+
 	FREERDP_API HANDLE rdpsnd_server_get_event_handle(RdpsndServerContext* context);
 	FREERDP_API UINT rdpsnd_server_handle_messages(RdpsndServerContext* context);
 
diff --git a/include/freerdp/server/remdesk.h b/include/freerdp/server/remdesk.h
index ae828fddc..ef4503220 100644
--- a/include/freerdp/server/remdesk.h
+++ b/include/freerdp/server/remdesk.h
@@ -55,9 +55,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API RemdeskServerContext* remdesk_server_context_new(HANDLE vcm);
 	FREERDP_API void remdesk_server_context_free(RemdeskServerContext* context);
 
+	WINPR_ATTR_MALLOC(remdesk_server_context_free, 1)
+	FREERDP_API RemdeskServerContext* remdesk_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/server/shadow.h b/include/freerdp/server/shadow.h
index 8b795a4ae..9ddb8ae9f 100644
--- a/include/freerdp/server/shadow.h
+++ b/include/freerdp/server/shadow.h
@@ -320,9 +320,11 @@ extern "C"
 
 	FREERDP_API UINT32 shadow_enum_monitors(MONITOR_DEF* monitors, UINT32 maxMonitors);
 
-	FREERDP_API rdpShadowServer* shadow_server_new(void);
 	FREERDP_API void shadow_server_free(rdpShadowServer* server);
 
+	WINPR_ATTR_MALLOC(shadow_server_free, 1)
+	FREERDP_API rdpShadowServer* shadow_server_new(void);
+
 	FREERDP_API int shadow_capture_align_clip_rect(RECTANGLE_16* rect, RECTANGLE_16* clip);
 	FREERDP_API int shadow_capture_compare(BYTE* pData1, UINT32 nStep1, UINT32 nWidth,
 	                                       UINT32 nHeight, BYTE* pData2, UINT32 nStep2,
diff --git a/include/freerdp/server/telemetry.h b/include/freerdp/server/telemetry.h
index 905965a0b..0697e7008 100644
--- a/include/freerdp/server/telemetry.h
+++ b/include/freerdp/server/telemetry.h
@@ -99,9 +99,11 @@ extern "C"
 		rdpContext* rdpcontext;
 	};
 
-	FREERDP_API TelemetryServerContext* telemetry_server_context_new(HANDLE vcm);
 	FREERDP_API void telemetry_server_context_free(TelemetryServerContext* context);
 
+	WINPR_ATTR_MALLOC(telemetry_server_context_free, 1)
+	FREERDP_API TelemetryServerContext* telemetry_server_context_new(HANDLE vcm);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/settings.h b/include/freerdp/settings.h
index 4d68aa245..cd89b329f 100644
--- a/include/freerdp/settings.h
+++ b/include/freerdp/settings.h
@@ -169,9 +169,14 @@ typedef struct rdp_settings rdpSettings;
 	FREERDP_API RDPDR_DEVICE* freerdp_device_collection_find_type(rdpSettings* settings,
 	                                                              UINT32 type);
 
-	FREERDP_API RDPDR_DEVICE* freerdp_device_new(UINT32 Type, size_t count, const char* args[]);
-	FREERDP_API RDPDR_DEVICE* freerdp_device_clone(const RDPDR_DEVICE* device);
 	FREERDP_API void freerdp_device_free(RDPDR_DEVICE* device);
+
+	WINPR_ATTR_MALLOC(freerdp_device_free, 1)
+	FREERDP_API RDPDR_DEVICE* freerdp_device_new(UINT32 Type, size_t count, const char* args[]);
+
+	WINPR_ATTR_MALLOC(freerdp_device_free, 1)
+	FREERDP_API RDPDR_DEVICE* freerdp_device_clone(const RDPDR_DEVICE* device);
+
 	FREERDP_API BOOL freerdp_device_equal(const RDPDR_DEVICE* one, const RDPDR_DEVICE* other);
 
 	FREERDP_API void freerdp_device_collection_free(rdpSettings* settings);
diff --git a/include/freerdp/streamdump.h b/include/freerdp/streamdump.h
index 4290d39ac..14bd5fde3 100644
--- a/include/freerdp/streamdump.h
+++ b/include/freerdp/streamdump.h
@@ -48,9 +48,11 @@ extern "C"
 	FREERDP_API BOOL stream_dump_register_handlers(rdpContext* context, CONNECTION_STATE state,
 	                                               BOOL isServer);
 
-	FREERDP_API rdpStreamDumpContext* stream_dump_new(void);
 	FREERDP_API void stream_dump_free(rdpStreamDumpContext* dump);
 
+	WINPR_ATTR_MALLOC(stream_dump_free, 1)
+	FREERDP_API rdpStreamDumpContext* stream_dump_new(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/include/freerdp/utils/smartcard_call.h b/include/freerdp/utils/smartcard_call.h
index 947194a45..5f6e026e8 100644
--- a/include/freerdp/utils/smartcard_call.h
+++ b/include/freerdp/utils/smartcard_call.h
@@ -38,8 +38,11 @@ extern "C"
 
 	typedef struct s_scard_call_context scard_call_context;
 
-	FREERDP_API scard_call_context* smartcard_call_context_new(const rdpSettings* settings);
 	FREERDP_API void smartcard_call_context_free(scard_call_context* ctx);
+
+	WINPR_ATTR_MALLOC(smartcard_call_context_free, 1)
+	FREERDP_API scard_call_context* smartcard_call_context_new(const rdpSettings* settings);
+
 	FREERDP_API BOOL smartcard_call_context_signal_stop(scard_call_context* ctx, BOOL reset);
 	FREERDP_API BOOL smartcard_call_context_add(scard_call_context* ctx, const char* name);
 	FREERDP_API BOOL smartcard_call_cancel_context(scard_call_context* ctx, SCARDCONTEXT context);
diff --git a/libfreerdp/cache/bitmap.h b/libfreerdp/cache/bitmap.h
index 22748a7a5..4e45170f9 100644
--- a/libfreerdp/cache/bitmap.h
+++ b/libfreerdp/cache/bitmap.h
@@ -57,27 +57,37 @@ extern "C"
 
 	FREERDP_LOCAL void bitmap_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpBitmapCache* bitmap_cache_new(rdpContext* context);
 	FREERDP_LOCAL void bitmap_cache_free(rdpBitmapCache* bitmap_cache);
 
-	FREERDP_LOCAL BITMAP_UPDATE* copy_bitmap_update(rdpContext* context,
-	                                                const BITMAP_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(bitmap_cache_free, 1)
+	FREERDP_LOCAL rdpBitmapCache* bitmap_cache_new(rdpContext* context);
+
 	FREERDP_LOCAL void free_bitmap_update(rdpContext* context, BITMAP_UPDATE* pointer);
 
-	FREERDP_LOCAL CACHE_BITMAP_ORDER* copy_cache_bitmap_order(rdpContext* context,
-	                                                          const CACHE_BITMAP_ORDER* order);
+	WINPR_ATTR_MALLOC(free_bitmap_update, 2)
+	FREERDP_LOCAL BITMAP_UPDATE* copy_bitmap_update(rdpContext* context,
+	                                                const BITMAP_UPDATE* pointer);
+
 	FREERDP_LOCAL void free_cache_bitmap_order(rdpContext* context, CACHE_BITMAP_ORDER* order);
 
-	FREERDP_LOCAL CACHE_BITMAP_V2_ORDER*
-	copy_cache_bitmap_v2_order(rdpContext* context, const CACHE_BITMAP_V2_ORDER* order);
+	WINPR_ATTR_MALLOC(free_cache_bitmap_order, 2)
+	FREERDP_LOCAL CACHE_BITMAP_ORDER* copy_cache_bitmap_order(rdpContext* context,
+	                                                          const CACHE_BITMAP_ORDER* order);
+
 	FREERDP_LOCAL void free_cache_bitmap_v2_order(rdpContext* context,
 	                                              CACHE_BITMAP_V2_ORDER* order);
 
-	FREERDP_LOCAL CACHE_BITMAP_V3_ORDER*
-	copy_cache_bitmap_v3_order(rdpContext* context, const CACHE_BITMAP_V3_ORDER* order);
+	WINPR_ATTR_MALLOC(free_cache_bitmap_v2_order, 2)
+	FREERDP_LOCAL CACHE_BITMAP_V2_ORDER*
+	copy_cache_bitmap_v2_order(rdpContext* context, const CACHE_BITMAP_V2_ORDER* order);
+
 	FREERDP_LOCAL void free_cache_bitmap_v3_order(rdpContext* context,
 	                                              CACHE_BITMAP_V3_ORDER* order);
 
+	WINPR_ATTR_MALLOC(free_cache_bitmap_v3_order, 2)
+	FREERDP_LOCAL CACHE_BITMAP_V3_ORDER*
+	copy_cache_bitmap_v3_order(rdpContext* context, const CACHE_BITMAP_V3_ORDER* order);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/libfreerdp/cache/brush.h b/libfreerdp/cache/brush.h
index ff01487d1..101c2374f 100644
--- a/libfreerdp/cache/brush.h
+++ b/libfreerdp/cache/brush.h
@@ -39,12 +39,16 @@ extern "C"
 
 	FREERDP_LOCAL void brush_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpBrushCache* brush_cache_new(rdpContext* context);
 	FREERDP_LOCAL void brush_cache_free(rdpBrushCache* brush);
 
+	WINPR_ATTR_MALLOC(brush_cache_free, 1)
+	FREERDP_LOCAL rdpBrushCache* brush_cache_new(rdpContext* context);
+
+	FREERDP_LOCAL void free_cache_brush_order(rdpContext* context, CACHE_BRUSH_ORDER* order);
+
+	WINPR_ATTR_MALLOC(free_cache_brush_order, 1)
 	FREERDP_LOCAL CACHE_BRUSH_ORDER* copy_cache_brush_order(rdpContext* context,
 	                                                        const CACHE_BRUSH_ORDER* order);
-	FREERDP_LOCAL void free_cache_brush_order(rdpContext* context, CACHE_BRUSH_ORDER* order);
 
 #ifdef __cplusplus
 }
diff --git a/libfreerdp/cache/cache.h b/libfreerdp/cache/cache.h
index 81c4987da..614f1a9af 100644
--- a/libfreerdp/cache/cache.h
+++ b/libfreerdp/cache/cache.h
@@ -48,17 +48,23 @@ extern "C"
 {
 #endif
 
-	FREERDP_LOCAL rdpCache* cache_new(rdpContext* context);
 	FREERDP_LOCAL void cache_free(rdpCache* cache);
 
-	FREERDP_LOCAL CACHE_COLOR_TABLE_ORDER*
-	copy_cache_color_table_order(rdpContext* context, const CACHE_COLOR_TABLE_ORDER* order);
+	WINPR_ATTR_MALLOC(cache_free, 1)
+	FREERDP_LOCAL rdpCache* cache_new(rdpContext* context);
+
 	FREERDP_LOCAL void free_cache_color_table_order(rdpContext* context,
 	                                                CACHE_COLOR_TABLE_ORDER* order);
 
+	WINPR_ATTR_MALLOC(free_cache_color_table_order, 2)
+	FREERDP_LOCAL CACHE_COLOR_TABLE_ORDER*
+	copy_cache_color_table_order(rdpContext* context, const CACHE_COLOR_TABLE_ORDER* order);
+
+	FREERDP_LOCAL void free_surface_bits_command(rdpContext* context, SURFACE_BITS_COMMAND* order);
+
+	WINPR_ATTR_MALLOC(free_surface_bits_command, 2)
 	FREERDP_LOCAL SURFACE_BITS_COMMAND*
 	copy_surface_bits_command(rdpContext* context, const SURFACE_BITS_COMMAND* order);
-	FREERDP_LOCAL void free_surface_bits_command(rdpContext* context, SURFACE_BITS_COMMAND* order);
 
 #ifdef __cplusplus
 }
diff --git a/libfreerdp/cache/glyph.h b/libfreerdp/cache/glyph.h
index ba8ede8b3..50e57aa37 100644
--- a/libfreerdp/cache/glyph.h
+++ b/libfreerdp/cache/glyph.h
@@ -58,9 +58,11 @@ extern "C"
 
 	FREERDP_LOCAL void glyph_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpGlyphCache* glyph_cache_new(rdpContext* context);
 	FREERDP_LOCAL void glyph_cache_free(rdpGlyphCache* glyph);
 
+	WINPR_ATTR_MALLOC(glyph_cache_free, 1)
+	FREERDP_LOCAL rdpGlyphCache* glyph_cache_new(rdpContext* context);
+
 	FREERDP_LOCAL CACHE_GLYPH_ORDER* copy_cache_glyph_order(rdpContext* context,
 	                                                        const CACHE_GLYPH_ORDER* glyph);
 	FREERDP_LOCAL void free_cache_glyph_order(rdpContext* context, CACHE_GLYPH_ORDER* glyph);
diff --git a/libfreerdp/cache/nine_grid.h b/libfreerdp/cache/nine_grid.h
index d89f7d09b..4f0ce0290 100644
--- a/libfreerdp/cache/nine_grid.h
+++ b/libfreerdp/cache/nine_grid.h
@@ -38,9 +38,11 @@ extern "C"
 
 	FREERDP_LOCAL void nine_grid_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpNineGridCache* nine_grid_cache_new(rdpContext* context);
 	FREERDP_LOCAL void nine_grid_cache_free(rdpNineGridCache* nine_grid);
 
+	WINPR_ATTR_MALLOC(nine_grid_cache_free, 1)
+	FREERDP_LOCAL rdpNineGridCache* nine_grid_cache_new(rdpContext* context);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/libfreerdp/cache/offscreen.h b/libfreerdp/cache/offscreen.h
index 744f78083..bdc89cce9 100644
--- a/libfreerdp/cache/offscreen.h
+++ b/libfreerdp/cache/offscreen.h
@@ -38,9 +38,11 @@ extern "C"
 
 	FREERDP_LOCAL void offscreen_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpOffscreenCache* offscreen_cache_new(rdpContext* context);
 	FREERDP_LOCAL void offscreen_cache_free(rdpOffscreenCache* offscreen);
 
+	WINPR_ATTR_MALLOC(offscreen_cache_free, 1)
+	FREERDP_LOCAL rdpOffscreenCache* offscreen_cache_new(rdpContext* context);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/libfreerdp/cache/palette.h b/libfreerdp/cache/palette.h
index fcd9f2d72..fb5be6a75 100644
--- a/libfreerdp/cache/palette.h
+++ b/libfreerdp/cache/palette.h
@@ -47,12 +47,16 @@ extern "C"
 
 	FREERDP_LOCAL void palette_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpPaletteCache* palette_cache_new(rdpContext* context);
 	FREERDP_LOCAL void palette_cache_free(rdpPaletteCache* palette_cache);
 
+	WINPR_ATTR_MALLOC(palette_cache_free, 1)
+	FREERDP_LOCAL rdpPaletteCache* palette_cache_new(rdpContext* context);
+
+	FREERDP_LOCAL void free_palette_update(rdpContext* context, PALETTE_UPDATE* pointer);
+
+	WINPR_ATTR_MALLOC(free_palette_update, 2)
 	FREERDP_LOCAL PALETTE_UPDATE* copy_palette_update(rdpContext* context,
 	                                                  const PALETTE_UPDATE* pointer);
-	FREERDP_LOCAL void free_palette_update(rdpContext* context, PALETTE_UPDATE* pointer);
 
 #ifdef __cplusplus
 }
diff --git a/libfreerdp/cache/pointer.h b/libfreerdp/cache/pointer.h
index 6498aef0c..c54e4f66c 100644
--- a/libfreerdp/cache/pointer.h
+++ b/libfreerdp/cache/pointer.h
@@ -42,38 +42,52 @@ extern "C"
 
 	FREERDP_LOCAL void pointer_cache_register_callbacks(rdpUpdate* update);
 
-	FREERDP_LOCAL rdpPointerCache* pointer_cache_new(rdpContext* context);
 	FREERDP_LOCAL void pointer_cache_free(rdpPointerCache* pointer_cache);
 
-	FREERDP_LOCAL POINTER_COLOR_UPDATE*
-	copy_pointer_color_update(rdpContext* context, const POINTER_COLOR_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(pointer_cache_free, 1)
+	FREERDP_LOCAL rdpPointerCache* pointer_cache_new(rdpContext* context);
+
 	FREERDP_LOCAL void free_pointer_color_update(rdpContext* context,
 	                                             POINTER_COLOR_UPDATE* pointer);
 
-	FREERDP_LOCAL POINTER_LARGE_UPDATE*
-	copy_pointer_large_update(rdpContext* context, const POINTER_LARGE_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(free_pointer_color_update, 1)
+	FREERDP_LOCAL POINTER_COLOR_UPDATE*
+	copy_pointer_color_update(rdpContext* context, const POINTER_COLOR_UPDATE* pointer);
+
 	FREERDP_LOCAL void free_pointer_large_update(rdpContext* context,
 	                                             POINTER_LARGE_UPDATE* pointer);
 
-	FREERDP_LOCAL POINTER_NEW_UPDATE* copy_pointer_new_update(rdpContext* context,
-	                                                          const POINTER_NEW_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(free_pointer_large_update, 1)
+	FREERDP_LOCAL POINTER_LARGE_UPDATE*
+	copy_pointer_large_update(rdpContext* context, const POINTER_LARGE_UPDATE* pointer);
+
 	FREERDP_LOCAL void free_pointer_new_update(rdpContext* context, POINTER_NEW_UPDATE* pointer);
 
-	FREERDP_LOCAL POINTER_CACHED_UPDATE*
-	copy_pointer_cached_update(rdpContext* context, const POINTER_CACHED_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(free_pointer_new_update, 1)
+	FREERDP_LOCAL POINTER_NEW_UPDATE* copy_pointer_new_update(rdpContext* context,
+	                                                          const POINTER_NEW_UPDATE* pointer);
+
 	FREERDP_LOCAL void free_pointer_cached_update(rdpContext* context,
 	                                              POINTER_CACHED_UPDATE* pointer);
 
-	FREERDP_LOCAL POINTER_POSITION_UPDATE*
-	copy_pointer_position_update(rdpContext* context, const POINTER_POSITION_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(free_pointer_cached_update, 1)
+	FREERDP_LOCAL POINTER_CACHED_UPDATE*
+	copy_pointer_cached_update(rdpContext* context, const POINTER_CACHED_UPDATE* pointer);
+
 	FREERDP_LOCAL void free_pointer_position_update(rdpContext* context,
 	                                                POINTER_POSITION_UPDATE* pointer);
 
-	FREERDP_LOCAL POINTER_SYSTEM_UPDATE*
-	copy_pointer_system_update(rdpContext* context, const POINTER_SYSTEM_UPDATE* pointer);
+	WINPR_ATTR_MALLOC(free_pointer_position_update, 1)
+	FREERDP_LOCAL POINTER_POSITION_UPDATE*
+	copy_pointer_position_update(rdpContext* context, const POINTER_POSITION_UPDATE* pointer);
+
 	FREERDP_LOCAL void free_pointer_system_update(rdpContext* context,
 	                                              POINTER_SYSTEM_UPDATE* pointer);
 
+	WINPR_ATTR_MALLOC(free_pointer_system_update, 1)
+	FREERDP_LOCAL POINTER_SYSTEM_UPDATE*
+	copy_pointer_system_update(rdpContext* context, const POINTER_SYSTEM_UPDATE* pointer);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/libfreerdp/codec/bulk.h b/libfreerdp/codec/bulk.h
index 94dc230ef..4c8540613 100644
--- a/libfreerdp/codec/bulk.h
+++ b/libfreerdp/codec/bulk.h
@@ -37,7 +37,9 @@ FREERDP_LOCAL int bulk_compress(rdpBulk* bulk, const BYTE* pSrcData, UINT32 SrcS
 
 FREERDP_LOCAL void bulk_reset(rdpBulk* bulk);
 
-FREERDP_LOCAL rdpBulk* bulk_new(rdpContext* context);
 FREERDP_LOCAL void bulk_free(rdpBulk* bulk);
 
+WINPR_ATTR_MALLOC(bulk_free, 1)
+FREERDP_LOCAL rdpBulk* bulk_new(rdpContext* context);
+
 #endif /* FREERDP_LIB_CORE_BULK_H */
diff --git a/libfreerdp/codec/dsp_ffmpeg.h b/libfreerdp/codec/dsp_ffmpeg.h
index d9d057fd4..973e3716e 100644
--- a/libfreerdp/codec/dsp_ffmpeg.h
+++ b/libfreerdp/codec/dsp_ffmpeg.h
@@ -32,13 +32,16 @@
     "DSP module requires libavcodec version >= 57.48.101. Upgrade or set WITH_DSP_FFMPEG=OFF to continue"
 #endif
 
+void freerdp_dsp_ffmpeg_context_free(FREERDP_DSP_CONTEXT* context);
+
+WINPR_ATTR_MALLOC(freerdp_dsp_ffmpeg_context_free, 1)
 FREERDP_DSP_CONTEXT* freerdp_dsp_ffmpeg_context_new(BOOL encode);
 BOOL freerdp_dsp_ffmpeg_supports_format(const AUDIO_FORMAT* format, BOOL encode);
 BOOL freerdp_dsp_ffmpeg_encode(FREERDP_DSP_CONTEXT* context, const AUDIO_FORMAT* srcFormat,
                                const BYTE* data, size_t length, wStream* out);
 BOOL freerdp_dsp_ffmpeg_decode(FREERDP_DSP_CONTEXT* context, const AUDIO_FORMAT* srcFormat,
                                const BYTE* data, size_t length, wStream* out);
-void freerdp_dsp_ffmpeg_context_free(FREERDP_DSP_CONTEXT* context);
+
 BOOL freerdp_dsp_ffmpeg_context_reset(FREERDP_DSP_CONTEXT* context,
                                       const AUDIO_FORMAT* targetFormat);
 
diff --git a/libfreerdp/core/aad.h b/libfreerdp/core/aad.h
index 88785b958..3b93e6688 100644
--- a/libfreerdp/core/aad.h
+++ b/libfreerdp/core/aad.h
@@ -51,9 +51,11 @@ FREERDP_LOCAL int aad_recv(rdpAad* aad, wStream* s);
 
 FREERDP_LOCAL AAD_STATE aad_get_state(rdpAad* aad);
 
-FREERDP_LOCAL rdpAad* aad_new(rdpContext* context, rdpTransport* transport);
 FREERDP_LOCAL void aad_free(rdpAad* aad);
 
+WINPR_ATTR_MALLOC(aad_free, 1)
+FREERDP_LOCAL rdpAad* aad_new(rdpContext* context, rdpTransport* transport);
+
 #if defined(USE_CJSON_COMPAT)
 FREERDP_API cJSON* cJSON_ParseWithLength(const char* value, size_t buffer_length);
 #endif
diff --git a/libfreerdp/core/autodetect.h b/libfreerdp/core/autodetect.h
index bc54ef593..77da5ac8b 100644
--- a/libfreerdp/core/autodetect.h
+++ b/libfreerdp/core/autodetect.h
@@ -32,8 +32,11 @@
 
 #include "state.h"
 
-FREERDP_LOCAL rdpAutoDetect* autodetect_new(rdpContext* context);
 FREERDP_LOCAL void autodetect_free(rdpAutoDetect* autodetect);
+
+WINPR_ATTR_MALLOC(autodetect_free, 1)
+FREERDP_LOCAL rdpAutoDetect* autodetect_new(rdpContext* context);
+
 FREERDP_LOCAL state_run_t autodetect_recv_request_packet(rdpAutoDetect* autodetect,
                                                          RDP_TRANSPORT_TYPE transport, wStream* s);
 FREERDP_LOCAL state_run_t autodetect_recv_response_packet(rdpAutoDetect* autodetect,
diff --git a/libfreerdp/core/client.h b/libfreerdp/core/client.h
index 861d249c8..f10e9592e 100644
--- a/libfreerdp/core/client.h
+++ b/libfreerdp/core/client.h
@@ -109,11 +109,16 @@ struct rdp_channels
 	CRITICAL_SECTION channelsLock;
 };
 
+FREERDP_LOCAL void freerdp_channels_free(rdpChannels* channels);
+
+WINPR_ATTR_MALLOC(freerdp_channels_free, 1)
 FREERDP_LOCAL rdpChannels* freerdp_channels_new(freerdp* instance);
+
 FREERDP_LOCAL UINT freerdp_channels_disconnect(rdpChannels* channels, freerdp* instance);
 FREERDP_LOCAL void freerdp_channels_close(rdpChannels* channels, freerdp* instance);
-FREERDP_LOCAL void freerdp_channels_free(rdpChannels* channels);
+
 FREERDP_LOCAL void freerdp_channels_register_instance(rdpChannels* channels, freerdp* instance);
 FREERDP_LOCAL UINT freerdp_channels_pre_connect(rdpChannels* channels, freerdp* instance);
 FREERDP_LOCAL UINT freerdp_channels_post_connect(rdpChannels* channels, freerdp* instance);
+
 #endif /* FREERDP_LIB_CORE_CLIENT_H */
diff --git a/libfreerdp/core/credssp_auth.h b/libfreerdp/core/credssp_auth.h
index 54b108ed5..101c164be 100644
--- a/libfreerdp/core/credssp_auth.h
+++ b/libfreerdp/core/credssp_auth.h
@@ -31,7 +31,11 @@ typedef struct rdp_credssp_auth rdpCredsspAuth;
 #include <winpr/tchar.h>
 #include <winpr/sspi.h>
 
+FREERDP_LOCAL void credssp_auth_free(rdpCredsspAuth* auth);
+
+WINPR_ATTR_MALLOC(credssp_auth_free, 1)
 FREERDP_LOCAL rdpCredsspAuth* credssp_auth_new(const rdpContext* context);
+
 FREERDP_LOCAL BOOL credssp_auth_init(rdpCredsspAuth* auth, TCHAR* pkg_name,
                                      SecPkgContext_Bindings* bindings);
 FREERDP_LOCAL BOOL credssp_auth_setup_client(rdpCredsspAuth* auth, const char* target_service,
@@ -57,6 +61,5 @@ FREERDP_LOCAL BOOL credssp_auth_is_complete(rdpCredsspAuth* auth);
 FREERDP_LOCAL const char* credssp_auth_pkg_name(rdpCredsspAuth* auth);
 FREERDP_LOCAL size_t credssp_auth_trailer_size(rdpCredsspAuth* auth);
 FREERDP_LOCAL UINT32 credssp_auth_sspi_error(rdpCredsspAuth* auth);
-FREERDP_LOCAL void credssp_auth_free(rdpCredsspAuth* auth);
 
 #endif /* FREERDP_LIB_CORE_CREDSSP_AUTH_H */
diff --git a/libfreerdp/core/fastpath.h b/libfreerdp/core/fastpath.h
index 9a2115922..999decc79 100644
--- a/libfreerdp/core/fastpath.h
+++ b/libfreerdp/core/fastpath.h
@@ -139,7 +139,10 @@ FREERDP_LOCAL BOOL fastpath_send_multiple_input_pdu(rdpFastPath* fastpath, wStre
                                                     size_t iEventCount);
 FREERDP_LOCAL BOOL fastpath_send_input_pdu(rdpFastPath* fastpath, wStream* s);
 
+WINPR_ATTR_MALLOC(Stream_Release, 1)
 FREERDP_LOCAL wStream* fastpath_update_pdu_init(rdpFastPath* fastpath);
+
+WINPR_ATTR_MALLOC(Stream_Free, 1)
 FREERDP_LOCAL wStream* fastpath_update_pdu_init_new(rdpFastPath* fastpath);
 FREERDP_LOCAL BOOL fastpath_send_update_pdu(rdpFastPath* fastpath, BYTE updateCode, wStream* s,
                                             BOOL skipCompression);
diff --git a/libfreerdp/core/gateway/http.h b/libfreerdp/core/gateway/http.h
index ee9cabd77..311c8f730 100644
--- a/libfreerdp/core/gateway/http.h
+++ b/libfreerdp/core/gateway/http.h
@@ -53,9 +53,11 @@ typedef struct
 /* HTTP context */
 typedef struct s_http_context HttpContext;
 
-FREERDP_LOCAL HttpContext* http_context_new(void);
 FREERDP_LOCAL void http_context_free(HttpContext* context);
 
+WINPR_ATTR_MALLOC(http_context_free, 1)
+FREERDP_LOCAL HttpContext* http_context_new(void);
+
 FREERDP_LOCAL BOOL http_context_set_method(HttpContext* context, const char* Method);
 FREERDP_LOCAL const char* http_context_get_uri(HttpContext* context);
 FREERDP_LOCAL BOOL http_context_set_uri(HttpContext* context, const char* URI);
@@ -83,9 +85,11 @@ FREERDP_LOCAL BOOL http_context_is_websocket_upgrade_enabled(HttpContext* contex
 /* HTTP request */
 typedef struct s_http_request HttpRequest;
 
-FREERDP_LOCAL HttpRequest* http_request_new(void);
 FREERDP_LOCAL void http_request_free(HttpRequest* request);
 
+WINPR_ATTR_MALLOC(http_request_free, 1)
+FREERDP_LOCAL HttpRequest* http_request_new(void);
+
 FREERDP_LOCAL BOOL http_request_set_method(HttpRequest* request, const char* Method);
 FREERDP_LOCAL BOOL http_request_set_content_type(HttpRequest* request, const char* ContentType);
 FREERDP_LOCAL SSIZE_T http_request_get_content_length(HttpRequest* request);
@@ -103,9 +107,11 @@ FREERDP_LOCAL wStream* http_request_write(HttpContext* context, HttpRequest* req
 /* HTTP response */
 typedef struct s_http_response HttpResponse;
 
-FREERDP_LOCAL HttpResponse* http_response_new(void);
 FREERDP_LOCAL void http_response_free(HttpResponse* response);
 
+WINPR_ATTR_MALLOC(http_response_free, 1)
+FREERDP_LOCAL HttpResponse* http_response_new(void);
+
 FREERDP_LOCAL HttpResponse* http_response_recv(rdpTls* tls, BOOL readContentLength);
 
 FREERDP_LOCAL long http_response_get_status_code(const HttpResponse* response);
diff --git a/libfreerdp/core/gateway/rdg.h b/libfreerdp/core/gateway/rdg.h
index 5b0249cdc..29d1a220a 100644
--- a/libfreerdp/core/gateway/rdg.h
+++ b/libfreerdp/core/gateway/rdg.h
@@ -22,15 +22,18 @@
 
 #include <winpr/wtypes.h>
 #include <winpr/stream.h>
+#include <winpr/winpr.h>
 
 /* needed for BIO */
 #include <openssl/ssl.h>
 
 typedef struct rdp_rdg rdpRdg;
 
-FREERDP_LOCAL rdpRdg* rdg_new(rdpContext* context);
 FREERDP_LOCAL void rdg_free(rdpRdg* rdg);
 
+WINPR_ATTR_MALLOC(rdg_free, 1)
+FREERDP_LOCAL rdpRdg* rdg_new(rdpContext* context);
+
 FREERDP_LOCAL BIO* rdg_get_front_bio_and_take_ownership(rdpRdg* rdg);
 
 FREERDP_LOCAL BOOL rdg_connect(rdpRdg* rdg, DWORD timeout, BOOL* rpcFallback);
diff --git a/libfreerdp/core/gateway/rpc.h b/libfreerdp/core/gateway/rpc.h
index 22662bf7f..73b999889 100644
--- a/libfreerdp/core/gateway/rpc.h
+++ b/libfreerdp/core/gateway/rpc.h
@@ -773,6 +773,7 @@ FREERDP_LOCAL SSIZE_T rpc_channel_read(RpcChannel* channel, wStream* s, size_t l
 
 FREERDP_LOCAL void rpc_channel_free(RpcChannel* channel);
 
+WINPR_ATTR_MALLOC(rpc_channel_free, 1)
 FREERDP_LOCAL RpcOutChannel* rpc_out_channel_new(rdpRpc* rpc, const GUID* guid);
 FREERDP_LOCAL int rpc_out_channel_replacement_connect(RpcOutChannel* outChannel, int timeout);
 
@@ -787,7 +788,9 @@ FREERDP_LOCAL BOOL rpc_virtual_connection_transition_to_state(rdpRpc* rpc,
 
 FREERDP_LOCAL BOOL rpc_connect(rdpRpc* rpc, UINT32 timeout);
 
-FREERDP_LOCAL rdpRpc* rpc_new(rdpTransport* transport);
 FREERDP_LOCAL void rpc_free(rdpRpc* rpc);
 
+WINPR_ATTR_MALLOC(rpc_free, 1)
+FREERDP_LOCAL rdpRpc* rpc_new(rdpTransport* transport);
+
 #endif /* FREERDP_LIB_CORE_GATEWAY_RPC_H */
diff --git a/libfreerdp/core/gateway/rpc_client.h b/libfreerdp/core/gateway/rpc_client.h
index 7b509def0..4e075b8a7 100644
--- a/libfreerdp/core/gateway/rpc_client.h
+++ b/libfreerdp/core/gateway/rpc_client.h
@@ -28,9 +28,11 @@
 
 FREERDP_LOCAL RpcClientCall* rpc_client_call_find_by_id(RpcClient* client, UINT32 CallId);
 
-FREERDP_LOCAL RpcClientCall* rpc_client_call_new(UINT32 CallId, UINT32 OpNum);
 FREERDP_LOCAL void rpc_client_call_free(RpcClientCall* client_call);
 
+WINPR_ATTR_MALLOC(rpc_client_call_free, 1)
+FREERDP_LOCAL RpcClientCall* rpc_client_call_new(UINT32 CallId, UINT32 OpNum);
+
 FREERDP_LOCAL int rpc_in_channel_send_pdu(RpcInChannel* inChannel, const BYTE* buffer,
                                           size_t length);
 
@@ -41,7 +43,9 @@ FREERDP_LOCAL int rpc_client_receive_pipe_read(RpcClient* client, BYTE* buffer,
 
 FREERDP_LOCAL BOOL rpc_client_write_call(rdpRpc* rpc, wStream* s, UINT16 opnum);
 
-FREERDP_LOCAL RpcClient* rpc_client_new(rdpContext* context, UINT32 max_recv_frag);
 FREERDP_LOCAL void rpc_client_free(RpcClient* client);
 
+WINPR_ATTR_MALLOC(rpc_client_free, 1)
+FREERDP_LOCAL RpcClient* rpc_client_new(rdpContext* context, UINT32 max_recv_frag);
+
 #endif /* FREERDP_LIB_CORE_GATEWAY_RPC_CLIENT_H */
diff --git a/libfreerdp/core/gateway/tsg.h b/libfreerdp/core/gateway/tsg.h
index b1616cafc..626a7aca5 100644
--- a/libfreerdp/core/gateway/tsg.h
+++ b/libfreerdp/core/gateway/tsg.h
@@ -99,9 +99,11 @@ typedef enum
 #define E_PROXY_REAUTH_NAP_FAILED 0x00005A00
 #define E_PROXY_CONNECTIONABORTED 0x000004D4
 
-FREERDP_LOCAL rdpTsg* tsg_new(rdpTransport* transport);
 FREERDP_LOCAL void tsg_free(rdpTsg* tsg);
 
+WINPR_ATTR_MALLOC(tsg_free, 1)
+FREERDP_LOCAL rdpTsg* tsg_new(rdpTransport* transport);
+
 FREERDP_LOCAL BOOL tsg_proxy_begin(rdpTsg* tsg);
 
 FREERDP_LOCAL BOOL tsg_connect(rdpTsg* tsg, const char* hostname, UINT16 port, DWORD timeout);
diff --git a/libfreerdp/core/gateway/wst.h b/libfreerdp/core/gateway/wst.h
index ecfeed664..e0f2f7aa2 100644
--- a/libfreerdp/core/gateway/wst.h
+++ b/libfreerdp/core/gateway/wst.h
@@ -22,15 +22,18 @@
 
 #include <winpr/wtypes.h>
 #include <winpr/stream.h>
+#include <winpr/winpr.h>
 
 /* needed for BIO */
 #include <openssl/ssl.h>
 
 typedef struct rdp_wst rdpWst;
 
-FREERDP_LOCAL rdpWst* wst_new(rdpContext* context);
 FREERDP_LOCAL void wst_free(rdpWst* wst);
 
+WINPR_ATTR_MALLOC(wst_free, 1)
+FREERDP_LOCAL rdpWst* wst_new(rdpContext* context);
+
 FREERDP_LOCAL BIO* wst_get_front_bio_and_take_ownership(rdpWst* wst);
 
 FREERDP_LOCAL BOOL wst_connect(rdpWst* wst, DWORD timeout);
diff --git a/libfreerdp/core/heartbeat.h b/libfreerdp/core/heartbeat.h
index 56ebc41cf..5fc6a1200 100644
--- a/libfreerdp/core/heartbeat.h
+++ b/libfreerdp/core/heartbeat.h
@@ -33,9 +33,11 @@
 
 FREERDP_LOCAL state_run_t rdp_recv_heartbeat_packet(rdpRdp* rdp, wStream* s);
 
-FREERDP_LOCAL rdpHeartbeat* heartbeat_new(void);
 FREERDP_LOCAL void heartbeat_free(rdpHeartbeat* heartbeat);
 
+WINPR_ATTR_MALLOC(heartbeat_free, 1)
+FREERDP_LOCAL rdpHeartbeat* heartbeat_new(void);
+
 #define HEARTBEAT_TAG FREERDP_TAG("core.heartbeat")
 
 #endif /* FREERDP_LIB_CORE_HEARTBEET_H */
diff --git a/libfreerdp/core/input.h b/libfreerdp/core/input.h
index b8ad111a4..c67153b28 100644
--- a/libfreerdp/core/input.h
+++ b/libfreerdp/core/input.h
@@ -60,7 +60,9 @@ FREERDP_LOCAL BOOL input_recv(rdpInput* input, wStream* s);
 FREERDP_LOCAL int input_process_events(rdpInput* input);
 FREERDP_LOCAL BOOL input_register_client_callbacks(rdpInput* input);
 
-FREERDP_LOCAL rdpInput* input_new(rdpRdp* rdp);
 FREERDP_LOCAL void input_free(rdpInput* input);
 
+WINPR_ATTR_MALLOC(input_free, 1)
+FREERDP_LOCAL rdpInput* input_new(rdpRdp* rdp);
+
 #endif /* FREERDP_LIB_CORE_INPUT_H */
diff --git a/libfreerdp/core/license.h b/libfreerdp/core/license.h
index ecf6d2e7c..f8770bd8b 100644
--- a/libfreerdp/core/license.h
+++ b/libfreerdp/core/license.h
@@ -64,9 +64,11 @@ FREERDP_LOCAL state_run_t license_recv(rdpLicense* license, wStream* s);
 FREERDP_LOCAL BOOL license_server_configure(rdpLicense* license);
 FREERDP_LOCAL BOOL license_server_send_request(rdpLicense* license);
 
-FREERDP_LOCAL rdpLicense* license_new(rdpRdp* rdp);
 FREERDP_LOCAL void license_free(rdpLicense* license);
 
+WINPR_ATTR_MALLOC(license_free, 1)
+FREERDP_LOCAL rdpLicense* license_new(rdpRdp* rdp);
+
 #define LICENSE_TAG FREERDP_TAG("core.license")
 #ifdef WITH_DEBUG_LICENSE
 #define DEBUG_LICENSE(...) WLog_INFO(LICENSE_TAG, __VA_ARGS__)
diff --git a/libfreerdp/core/mcs.h b/libfreerdp/core/mcs.h
index b7365d3f0..6f78b7da9 100644
--- a/libfreerdp/core/mcs.h
+++ b/libfreerdp/core/mcs.h
@@ -179,7 +179,9 @@ FREERDP_LOCAL BOOL mcs_write_domain_mcspdu_header(wStream* s, DomainMCSPDU domai
 
 FREERDP_LOCAL BOOL mcs_client_begin(rdpMcs* mcs);
 
-FREERDP_LOCAL rdpMcs* mcs_new(rdpTransport* transport);
 FREERDP_LOCAL void mcs_free(rdpMcs* mcs);
 
+WINPR_ATTR_MALLOC(mcs_free, 1)
+FREERDP_LOCAL rdpMcs* mcs_new(rdpTransport* transport);
+
 #endif /* FREERDP_LIB_CORE_MCS_H */
diff --git a/libfreerdp/core/message.h b/libfreerdp/core/message.h
index cb77ebf78..a29486594 100644
--- a/libfreerdp/core/message.h
+++ b/libfreerdp/core/message.h
@@ -133,9 +133,11 @@ FREERDP_LOCAL int update_message_queue_free_message(wMessage* message);
 
 FREERDP_LOCAL int update_message_queue_process_pending_messages(rdpUpdate* update);
 
-FREERDP_LOCAL rdpUpdateProxy* update_message_proxy_new(rdpUpdate* update);
 FREERDP_LOCAL void update_message_proxy_free(rdpUpdateProxy* message);
 
+WINPR_ATTR_MALLOC(update_message_proxy_free, 1)
+FREERDP_LOCAL rdpUpdateProxy* update_message_proxy_new(rdpUpdate* update);
+
 /**
  * Input Message Queue
  */
diff --git a/libfreerdp/core/multitransport.h b/libfreerdp/core/multitransport.h
index edcf42d7c..4d312384a 100644
--- a/libfreerdp/core/multitransport.h
+++ b/libfreerdp/core/multitransport.h
@@ -51,7 +51,9 @@ FREERDP_LOCAL state_run_t multitransport_recv_response(rdpMultitransport* multi,
 FREERDP_LOCAL BOOL multitransport_client_send_response(rdpMultitransport* multi, UINT32 reqId,
                                                        HRESULT hr);
 
-FREERDP_LOCAL rdpMultitransport* multitransport_new(rdpRdp* rdp, UINT16 protocol);
 FREERDP_LOCAL void multitransport_free(rdpMultitransport* multi);
 
+WINPR_ATTR_MALLOC(multitransport_free, 1)
+FREERDP_LOCAL rdpMultitransport* multitransport_new(rdpRdp* rdp, UINT16 protocol);
+
 #endif /* FREERDP_LIB_CORE_MULTITRANSPORT_H */
diff --git a/libfreerdp/core/nego.h b/libfreerdp/core/nego.h
index 18a072e02..13a5135fe 100644
--- a/libfreerdp/core/nego.h
+++ b/libfreerdp/core/nego.h
@@ -106,9 +106,11 @@ FREERDP_LOCAL BOOL nego_read_request(rdpNego* nego, wStream* s);
 FREERDP_LOCAL BOOL nego_send_negotiation_request(rdpNego* nego);
 FREERDP_LOCAL BOOL nego_send_negotiation_response(rdpNego* nego);
 
-FREERDP_LOCAL rdpNego* nego_new(rdpTransport* transport);
 FREERDP_LOCAL void nego_free(rdpNego* nego);
 
+WINPR_ATTR_MALLOC(nego_free, 1)
+FREERDP_LOCAL rdpNego* nego_new(rdpTransport* transport);
+
 FREERDP_LOCAL void nego_init(rdpNego* nego);
 FREERDP_LOCAL BOOL nego_set_target(rdpNego* nego, const char* hostname, UINT16 port);
 FREERDP_LOCAL void nego_set_negotiation_enabled(rdpNego* nego, BOOL NegotiateSecurityLayer);
diff --git a/libfreerdp/core/nla.h b/libfreerdp/core/nla.h
index fd5fb2f70..cb30e12b3 100644
--- a/libfreerdp/core/nla.h
+++ b/libfreerdp/core/nla.h
@@ -69,8 +69,11 @@ FREERDP_LOCAL BOOL nla_sspi_module_init(rdpNla* nla);
 FREERDP_LOCAL BOOL nla_impersonate(rdpNla* nla);
 FREERDP_LOCAL BOOL nla_revert_to_self(rdpNla* nla);
 
-FREERDP_LOCAL rdpNla* nla_new(rdpContext* context, rdpTransport* transport);
 FREERDP_LOCAL void nla_free(rdpNla* nla);
+
+WINPR_ATTR_MALLOC(nla_free, 1)
+FREERDP_LOCAL rdpNla* nla_new(rdpContext* context, rdpTransport* transport);
+
 FREERDP_LOCAL void nla_set_early_user_auth(rdpNla* nla, BOOL earlyUserAuth);
 
 #endif /* FREERDP_LIB_CORE_NLA_H */
diff --git a/libfreerdp/core/rdp.h b/libfreerdp/core/rdp.h
index d4f1e44b8..a4eaf47f3 100644
--- a/libfreerdp/core/rdp.h
+++ b/libfreerdp/core/rdp.h
@@ -250,9 +250,11 @@ FREERDP_LOCAL state_run_t rdp_recv_callback(rdpTransport* transport, wStream* s,
 
 FREERDP_LOCAL int rdp_check_fds(rdpRdp* rdp);
 
+FREERDP_LOCAL void rdp_free(rdpRdp* rdp);
+
+WINPR_ATTR_MALLOC(rdp_free, 1)
 FREERDP_LOCAL rdpRdp* rdp_new(rdpContext* context);
 FREERDP_LOCAL BOOL rdp_reset(rdpRdp* rdp);
-FREERDP_LOCAL void rdp_free(rdpRdp* rdp);
 
 FREERDP_LOCAL BOOL rdp_io_callback_set_event(rdpRdp* rdp, BOOL reset);
 
diff --git a/libfreerdp/core/rdstls.h b/libfreerdp/core/rdstls.h
index 3b078d885..952f469a1 100644
--- a/libfreerdp/core/rdstls.h
+++ b/libfreerdp/core/rdstls.h
@@ -26,9 +26,11 @@ typedef struct rdp_rdstls rdpRdstls;
 
 FREERDP_LOCAL SSIZE_T rdstls_parse_pdu(wLog* log, wStream* s);
 
-FREERDP_LOCAL rdpRdstls* rdstls_new(rdpContext* context, rdpTransport* transport);
 FREERDP_LOCAL void rdstls_free(rdpRdstls* rdstls);
 
+WINPR_ATTR_MALLOC(rdstls_free, 1)
+FREERDP_LOCAL rdpRdstls* rdstls_new(rdpContext* context, rdpTransport* transport);
+
 FREERDP_LOCAL int rdstls_authenticate(rdpRdstls* rdstls);
 
 #endif /* FREERDP_LIB_CORE_RDSTLS_H */
diff --git a/libfreerdp/core/server.h b/libfreerdp/core/server.h
index cbafa4d90..ccd4bd335 100644
--- a/libfreerdp/core/server.h
+++ b/libfreerdp/core/server.h
@@ -265,9 +265,11 @@ FREERDP_LOCAL BOOL WINAPI FreeRDP_WTSLogoffUser(HANDLE hServer);
 FREERDP_LOCAL BOOL WINAPI FreeRDP_WTSLogonUser(HANDLE hServer, LPCSTR username, LPCSTR password,
                                                LPCSTR domain);
 
+FREERDP_LOCAL void server_channel_common_free(rdpPeerChannel*);
+
+WINPR_ATTR_MALLOC(server_channel_common_free, 1)
 FREERDP_LOCAL rdpPeerChannel* server_channel_common_new(freerdp_peer* client, UINT16 index,
                                                         UINT32 channelId, size_t chunkSize,
                                                         const wObject* callback, const char* name);
-FREERDP_LOCAL void server_channel_common_free(rdpPeerChannel*);
 
 #endif /* FREERDP_LIB_CORE_SERVER_H */
diff --git a/libfreerdp/core/transport.h b/libfreerdp/core/transport.h
index 490d94416..8b5c5c695 100644
--- a/libfreerdp/core/transport.h
+++ b/libfreerdp/core/transport.h
@@ -131,9 +131,11 @@ FREERDP_LOCAL BOOL transport_set_recv_callbacks(rdpTransport* transport, Transpo
 FREERDP_LOCAL int transport_tcp_connect(rdpTransport* transport, const char* hostname, int port,
                                         DWORD timeout);
 
-FREERDP_LOCAL rdpTransport* transport_new(rdpContext* context);
 FREERDP_LOCAL void transport_free(rdpTransport* transport);
 
+WINPR_ATTR_MALLOC(transport_free, 1)
+FREERDP_LOCAL rdpTransport* transport_new(rdpContext* context);
+
 FREERDP_LOCAL void transport_set_early_user_auth_mode(rdpTransport* transport, BOOL EUAMode);
 
 #endif /* FREERDP_LIB_CORE_TRANSPORT_H */
diff --git a/libfreerdp/core/update.h b/libfreerdp/core/update.h
index b651bf347..360aae684 100644
--- a/libfreerdp/core/update.h
+++ b/libfreerdp/core/update.h
@@ -167,8 +167,11 @@ static INLINE rdp_secondary_update_internal* secondary_update_cast(rdpSecondaryU
 	return cnv.internal;
 }
 
-FREERDP_LOCAL rdpUpdate* update_new(rdpRdp* rdp);
 FREERDP_LOCAL void update_free(rdpUpdate* update);
+
+WINPR_ATTR_MALLOC(update_free, 1)
+FREERDP_LOCAL rdpUpdate* update_new(rdpRdp* rdp);
+
 FREERDP_LOCAL void update_reset_state(rdpUpdate* update);
 FREERDP_LOCAL BOOL update_post_connect(rdpUpdate* update);
 FREERDP_LOCAL void update_post_disconnect(rdpUpdate* update);
diff --git a/libfreerdp/crypto/certificate.h b/libfreerdp/crypto/certificate.h
index 1a0cf36ba..ead71f8ee 100644
--- a/libfreerdp/crypto/certificate.h
+++ b/libfreerdp/crypto/certificate.h
@@ -40,6 +40,7 @@
 #define BB_RSA_KEY_BLOB 6
 #define BB_RSA_SIGNATURE_BLOB 8
 
+WINPR_ATTR_MALLOC(freerdp_certificate_free, 1)
 FREERDP_LOCAL rdpCertificate* freerdp_certificate_new_from_x509(const X509* xcert,
                                                                 const STACK_OF(X509) * chain);
 
diff --git a/libfreerdp/crypto/tls.h b/libfreerdp/crypto/tls.h
index 92a2b3a18..efc62a165 100644
--- a/libfreerdp/crypto/tls.h
+++ b/libfreerdp/crypto/tls.h
@@ -119,9 +119,11 @@ extern "C"
 
 	FREERDP_LOCAL int freerdp_tls_set_alert_code(rdpTls* tls, int level, int description);
 
-	FREERDP_LOCAL rdpTls* freerdp_tls_new(rdpSettings* settings);
 	FREERDP_LOCAL void freerdp_tls_free(rdpTls* tls);
 
+	WINPR_ATTR_MALLOC(freerdp_tls_free, 1)
+	FREERDP_LOCAL rdpTls* freerdp_tls_new(rdpSettings* settings);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/server/proxy/channels/pf_channel_rdpdr.h b/server/proxy/channels/pf_channel_rdpdr.h
index f479ab437..dbc2e7506 100644
--- a/server/proxy/channels/pf_channel_rdpdr.h
+++ b/server/proxy/channels/pf_channel_rdpdr.h
@@ -25,18 +25,20 @@
 
 BOOL pf_channel_setup_rdpdr(pServerContext* ps, pServerStaticChannelContext* channel);
 
-BOOL pf_channel_rdpdr_client_new(pClientContext* pc);
 void pf_channel_rdpdr_client_free(pClientContext* pc);
 
+BOOL pf_channel_rdpdr_client_new(pClientContext* pc);
+
 BOOL pf_channel_rdpdr_client_reset(pClientContext* pc);
 
 BOOL pf_channel_rdpdr_client_handle(pClientContext* pc, UINT16 channelId, const char* channel_name,
                                     const BYTE* xdata, size_t xsize, UINT32 flags,
                                     size_t totalSize);
 
-BOOL pf_channel_rdpdr_server_new(pServerContext* ps);
 void pf_channel_rdpdr_server_free(pServerContext* ps);
 
+BOOL pf_channel_rdpdr_server_new(pServerContext* ps);
+
 BOOL pf_channel_rdpdr_server_announce(pServerContext* ps);
 BOOL pf_channel_rdpdr_server_handle(pServerContext* ps, UINT16 channelId, const char* channel_name,
                                     const BYTE* xdata, size_t xsize, UINT32 flags,
diff --git a/server/proxy/pf_channel.h b/server/proxy/pf_channel.h
index 4498bd420..9e0da7e0f 100644
--- a/server/proxy/pf_channel.h
+++ b/server/proxy/pf_channel.h
@@ -33,11 +33,12 @@ typedef struct _ChannelStateTracker ChannelStateTracker;
 typedef PfChannelResult (*ChannelTrackerPeekFn)(ChannelStateTracker* tracker, BOOL first,
                                                 BOOL lastPacket);
 
+void channelTracker_free(ChannelStateTracker* t);
+
+WINPR_ATTR_MALLOC(channelTracker_free, 1)
 ChannelStateTracker* channelTracker_new(pServerStaticChannelContext* channel,
                                         ChannelTrackerPeekFn fn, void* data);
 
-void channelTracker_free(ChannelStateTracker* t);
-
 BOOL channelTracker_setMode(ChannelStateTracker* tracker, ChannelTrackerMode mode);
 ChannelTrackerMode channelTracker_getMode(ChannelStateTracker* tracker);
 
diff --git a/server/shadow/shadow_capture.h b/server/shadow/shadow_capture.h
index 37d9563a7..31de5505d 100644
--- a/server/shadow/shadow_capture.h
+++ b/server/shadow/shadow_capture.h
@@ -22,6 +22,7 @@
 #include <freerdp/server/shadow.h>
 
 #include <winpr/crt.h>
+#include <winpr/winpr.h>
 #include <winpr/synch.h>
 
 struct rdp_shadow_capture
@@ -39,9 +40,11 @@ extern "C"
 {
 #endif
 
-	rdpShadowCapture* shadow_capture_new(rdpShadowServer* server);
 	void shadow_capture_free(rdpShadowCapture* capture);
 
+	WINPR_ATTR_MALLOC(shadow_capture_free, 1)
+	rdpShadowCapture* shadow_capture_new(rdpShadowServer* server);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/server/shadow/shadow_encoder.h b/server/shadow/shadow_encoder.h
index 2b55ee999..dfe00f3ba 100644
--- a/server/shadow/shadow_encoder.h
+++ b/server/shadow/shadow_encoder.h
@@ -69,9 +69,11 @@ extern "C"
 	int shadow_encoder_prepare(rdpShadowEncoder* encoder, UINT32 codecs);
 	UINT32 shadow_encoder_create_frame_id(rdpShadowEncoder* encoder);
 
-	rdpShadowEncoder* shadow_encoder_new(rdpShadowClient* client);
 	void shadow_encoder_free(rdpShadowEncoder* encoder);
 
+	WINPR_ATTR_MALLOC(shadow_encoder_free, 1)
+	rdpShadowEncoder* shadow_encoder_new(rdpShadowClient* client);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/server/shadow/shadow_mcevent.h b/server/shadow/shadow_mcevent.h
index 08ef6f350..c78b9206f 100644
--- a/server/shadow/shadow_mcevent.h
+++ b/server/shadow/shadow_mcevent.h
@@ -36,8 +36,11 @@ extern "C"
 {
 #endif
 
-	rdpShadowMultiClientEvent* shadow_multiclient_new(void);
 	void shadow_multiclient_free(rdpShadowMultiClientEvent* event);
+
+	WINPR_ATTR_MALLOC(shadow_multiclient_free, 1)
+	rdpShadowMultiClientEvent* shadow_multiclient_new(void);
+
 	void shadow_multiclient_publish(rdpShadowMultiClientEvent* event);
 	void shadow_multiclient_wait(rdpShadowMultiClientEvent* event);
 	void shadow_multiclient_publish_and_wait(rdpShadowMultiClientEvent* event);
diff --git a/server/shadow/shadow_screen.h b/server/shadow/shadow_screen.h
index 5049a50a7..a7bf7894b 100644
--- a/server/shadow/shadow_screen.h
+++ b/server/shadow/shadow_screen.h
@@ -43,9 +43,11 @@ extern "C"
 {
 #endif
 
-	rdpShadowScreen* shadow_screen_new(rdpShadowServer* server);
 	void shadow_screen_free(rdpShadowScreen* screen);
 
+	WINPR_ATTR_MALLOC(shadow_screen_free, 1)
+	rdpShadowScreen* shadow_screen_new(rdpShadowServer* server);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/server/shadow/shadow_subsystem.h b/server/shadow/shadow_subsystem.h
index 5702e471c..206dfddb6 100644
--- a/server/shadow/shadow_subsystem.h
+++ b/server/shadow/shadow_subsystem.h
@@ -29,9 +29,11 @@ extern "C"
 {
 #endif
 
-	rdpShadowSubsystem* shadow_subsystem_new(void);
 	void shadow_subsystem_free(rdpShadowSubsystem* subsystem);
 
+	WINPR_ATTR_MALLOC(shadow_subsystem_free, 1)
+	rdpShadowSubsystem* shadow_subsystem_new(void);
+
 	int shadow_subsystem_init(rdpShadowSubsystem* subsystem, rdpShadowServer* server);
 	void shadow_subsystem_uninit(rdpShadowSubsystem* subsystem);
 
diff --git a/server/shadow/shadow_surface.h b/server/shadow/shadow_surface.h
index e376be9a5..277df0a2c 100644
--- a/server/shadow/shadow_surface.h
+++ b/server/shadow/shadow_surface.h
@@ -29,9 +29,12 @@ extern "C"
 {
 #endif
 
+	void shadow_surface_free(rdpShadowSurface* surface);
+
+	WINPR_ATTR_MALLOC(shadow_surface_free, 1)
 	rdpShadowSurface* shadow_surface_new(rdpShadowServer* server, UINT16 x, UINT16 y, UINT32 width,
 	                                     UINT32 height);
-	void shadow_surface_free(rdpShadowSurface* surface);
+
 	BOOL shadow_surface_resize(rdpShadowSurface* surface, UINT16 x, UINT16 y, UINT32 width,
 	                           UINT32 height);
 
diff --git a/winpr/include/winpr/asn1.h b/winpr/include/winpr/asn1.h
index 89eb1648a..dd6817f85 100644
--- a/winpr/include/winpr/asn1.h
+++ b/winpr/include/winpr/asn1.h
@@ -158,7 +158,11 @@ extern "C"
 
 	/* encoder functions */
 
+	WINPR_API void WinPrAsn1Encoder_Free(WinPrAsn1Encoder** penc);
+
+	WINPR_ATTR_MALLOC(WinPrAsn1Encoder_Free, 1)
 	WINPR_API WinPrAsn1Encoder* WinPrAsn1Encoder_New(WinPrAsn1EncodingRule encoding);
+
 	WINPR_API void WinPrAsn1Encoder_Reset(WinPrAsn1Encoder* enc);
 
 	WINPR_API BOOL WinPrAsn1EncAppContainer(WinPrAsn1Encoder* enc, WinPrAsn1_tagId tagId);
@@ -203,8 +207,6 @@ extern "C"
 	WINPR_API BOOL WinPrAsn1EncStreamSize(WinPrAsn1Encoder* enc, size_t* s);
 	WINPR_API BOOL WinPrAsn1EncToStream(WinPrAsn1Encoder* enc, wStream* s);
 
-	WINPR_API void WinPrAsn1Encoder_Free(WinPrAsn1Encoder** penc);
-
 #ifdef __cplusplus
 }
 #endif /* __cplusplus */
diff --git a/winpr/include/winpr/bitstream.h b/winpr/include/winpr/bitstream.h
index c2302c3f7..4a8327eee 100644
--- a/winpr/include/winpr/bitstream.h
+++ b/winpr/include/winpr/bitstream.h
@@ -174,9 +174,11 @@ extern "C"
 
 	WINPR_API void BitStream_Attach(wBitStream* bs, const BYTE* buffer, UINT32 capacity);
 
-	WINPR_API wBitStream* BitStream_New(void);
 	WINPR_API void BitStream_Free(wBitStream* bs);
 
+	WINPR_ATTR_MALLOC(BitStream_Free, 1)
+	WINPR_API wBitStream* BitStream_New(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/winpr/include/winpr/collections.h b/winpr/include/winpr/collections.h
index b2fbd53d7..921176013 100644
--- a/winpr/include/winpr/collections.h
+++ b/winpr/include/winpr/collections.h
@@ -155,18 +155,19 @@ extern "C"
 	 */
 	WINPR_API void Queue_Discard(wQueue* queue);
 
-	/** @brief Creates a new queue
-	 *
-	 *  @return A newly allocated queue or \b NULL in case of failure
-	 */
-	WINPR_API wQueue* Queue_New(BOOL synchronized, SSIZE_T capacity, SSIZE_T growthFactor);
-
 	/** @brief Clean up a queue, free all resources (e.g. calls \b Queue_Clear)
 	 *
 	 *  @param queue The queue to free, may be \b NULL
 	 */
 	WINPR_API void Queue_Free(wQueue* queue);
 
+	/** @brief Creates a new queue
+	 *
+	 *  @return A newly allocated queue or \b NULL in case of failure
+	 */
+	WINPR_ATTR_MALLOC(Queue_Free, 1)
+	WINPR_API wQueue* Queue_New(BOOL synchronized, SSIZE_T capacity, SSIZE_T growthFactor);
+
 	/* System.Collections.Stack */
 
 	typedef struct s_wStack wStack;
@@ -184,9 +185,11 @@ extern "C"
 
 	WINPR_API void* Stack_Peek(wStack* stack);
 
-	WINPR_API wStack* Stack_New(BOOL synchronized);
 	WINPR_API void Stack_Free(wStack* stack);
 
+	WINPR_ATTR_MALLOC(Stack_Free, 1)
+	WINPR_API wStack* Stack_New(BOOL synchronized);
+
 	/* System.Collections.ArrayList */
 
 	typedef struct s_wArrayList wArrayList;
@@ -229,9 +232,11 @@ extern "C"
 	WINPR_API SSIZE_T ArrayList_LastIndexOf(wArrayList* arrayList, const void* obj,
 	                                        SSIZE_T startIndex, SSIZE_T count);
 
-	WINPR_API wArrayList* ArrayList_New(BOOL synchronized);
 	WINPR_API void ArrayList_Free(wArrayList* arrayList);
 
+	WINPR_ATTR_MALLOC(ArrayList_Free, 1)
+	WINPR_API wArrayList* ArrayList_New(BOOL synchronized);
+
 	/* System.Collections.DictionaryBase */
 
 	/* System.Collections.Specialized.ListDictionary */
@@ -362,20 +367,21 @@ extern "C"
 	WINPR_API BOOL ListDictionary_SetItemValue(wListDictionary* listDictionary, const void* key,
 	                                           const void* value);
 
+	/** @brief Free memory allocated by a dictionary. Calls \b ListDictionary_Clear
+	 *
+	 *  @param listDictionary A dictionary to query, may be \b NULL
+	 */
+	WINPR_API void ListDictionary_Free(wListDictionary* listDictionary);
+
 	/** @brief allocate a new dictionary
 	 *
 	 *  @param synchronized Create the dictionary with automatic mutex lock
 	 *
 	 *  @return A newly allocated dictionary or \b NULL in case of failure
 	 */
+	WINPR_ATTR_MALLOC(ListDictionary_Free, 1)
 	WINPR_API wListDictionary* ListDictionary_New(BOOL synchronized);
 
-	/** @brief Free memory allocated by a dictionary. Calls \b ListDictionary_Clear
-	 *
-	 *  @param listDictionary A dictionary to query, may be \b NULL
-	 */
-	WINPR_API void ListDictionary_Free(wListDictionary* listDictionary);
-
 	/* System.Collections.Generic.LinkedList<T> */
 
 	typedef struct s_wLinkedList wLinkedList;
@@ -490,18 +496,19 @@ extern "C"
 	 */
 	WINPR_API BOOL LinkedList_Enumerator_MoveNext(wLinkedList* list);
 
-	/** @brief Allocate a linked list
-	 *
-	 * @return A pointer to the newly allocated linked list or \b NULL in case of failure
-	 */
-	WINPR_API wLinkedList* LinkedList_New(void);
-
 	/** @brief Free a linked list
 	 *
 	 *  @param list A pointer to the list, may be \b NULL
 	 */
 	WINPR_API void LinkedList_Free(wLinkedList* list);
 
+	/** @brief Allocate a linked list
+	 *
+	 * @return A pointer to the newly allocated linked list or \b NULL in case of failure
+	 */
+	WINPR_ATTR_MALLOC(LinkedList_Free, 1)
+	WINPR_API wLinkedList* LinkedList_New(void);
+
 	/** @brief Return the \b wObject function pointers for list elements
 	 *
 	 *  @param list A pointer to the list, must not be \b NULL
@@ -573,20 +580,21 @@ extern "C"
 	 */
 	WINPR_API void CountdownEvent_Reset(wCountdownEvent* countdown, size_t count);
 
+	/** @brief Free a CountdownEvent
+	 *
+	 *  @param countdown A pointer to a CountdownEvent, may be \b NULL
+	 */
+	WINPR_API void CountdownEvent_Free(wCountdownEvent* countdown);
+
 	/** @brief Allocte a CountdownEvent with \b initialCount
 	 *
 	 *  @param initialCount The initial value of the event
 	 *
 	 *  @return The newly allocated event or \b NULL in case of failure
 	 */
+	WINPR_ATTR_MALLOC(CountdownEvent_Free, 1)
 	WINPR_API wCountdownEvent* CountdownEvent_New(size_t initialCount);
 
-	/** @brief Free a CountdownEvent
-	 *
-	 *  @param countdown A pointer to a CountdownEvent, may be \b NULL
-	 */
-	WINPR_API void CountdownEvent_Free(wCountdownEvent* countdown);
-
 	/* Hash Table */
 
 	typedef UINT32 (*HASH_TABLE_HASH_FN)(const void* key);
@@ -621,8 +629,11 @@ extern "C"
 	WINPR_API void* HashTable_StringClone(const void* str);
 	WINPR_API void HashTable_StringFree(void* str);
 
-	WINPR_API wHashTable* HashTable_New(BOOL synchronized);
 	WINPR_API void HashTable_Free(wHashTable* table);
+
+	WINPR_ATTR_MALLOC(HashTable_Free, 1)
+	WINPR_API wHashTable* HashTable_New(BOOL synchronized);
+
 	WINPR_API void HashTable_Lock(wHashTable* table);
 	WINPR_API void HashTable_Unlock(wHashTable* table);
 
@@ -645,9 +656,11 @@ extern "C"
 	WINPR_API BOOL BufferPool_Return(wBufferPool* pool, void* buffer);
 	WINPR_API void BufferPool_Clear(wBufferPool* pool);
 
-	WINPR_API wBufferPool* BufferPool_New(BOOL synchronized, SSIZE_T fixedSize, DWORD alignment);
 	WINPR_API void BufferPool_Free(wBufferPool* pool);
 
+	WINPR_ATTR_MALLOC(BufferPool_Free, 1)
+	WINPR_API wBufferPool* BufferPool_New(BOOL synchronized, SSIZE_T fixedSize, DWORD alignment);
+
 	/* ObjectPool */
 
 	typedef struct s_wObjectPool wObjectPool;
@@ -658,9 +671,11 @@ extern "C"
 
 	WINPR_API wObject* ObjectPool_Object(wObjectPool* pool);
 
-	WINPR_API wObjectPool* ObjectPool_New(BOOL synchronized);
 	WINPR_API void ObjectPool_Free(wObjectPool* pool);
 
+	WINPR_ATTR_MALLOC(ObjectPool_Free, 1)
+	WINPR_API wObjectPool* ObjectPool_New(BOOL synchronized);
+
 	/* Message Queue */
 
 	typedef struct s_wMessage wMessage;
@@ -706,20 +721,6 @@ extern "C"
 	 */
 	WINPR_API int MessageQueue_Clear(wMessageQueue* queue);
 
-	/*! \brief Creates a new message queue.
-	 * 				 If 'callback' is null, no custom cleanup will be done
-	 * 				 on message queue deallocation.
-	 * 				 If the 'callback' argument contains valid uninit or
-	 * 				 free functions those will be called by
-	 * 				 'MessageQueue_Clear'.
-	 *
-	 * \param callback a pointer to custom initialization / cleanup functions.
-	 * 								 Can be NULL if not used.
-	 *
-	 * \return A pointer to a newly allocated MessageQueue or NULL.
-	 */
-	WINPR_API wMessageQueue* MessageQueue_New(const wObject* callback);
-
 	/*! \brief Frees resources allocated by a message queue.
 	 * 				 This function will only free resources allocated
 	 *				 internally.
@@ -733,6 +734,21 @@ extern "C"
 	 */
 	WINPR_API void MessageQueue_Free(wMessageQueue* queue);
 
+	/*! \brief Creates a new message queue.
+	 * 				 If 'callback' is null, no custom cleanup will be done
+	 * 				 on message queue deallocation.
+	 * 				 If the 'callback' argument contains valid uninit or
+	 * 				 free functions those will be called by
+	 * 				 'MessageQueue_Clear'.
+	 *
+	 * \param callback a pointer to custom initialization / cleanup functions.
+	 * 								 Can be NULL if not used.
+	 *
+	 * \return A pointer to a newly allocated MessageQueue or NULL.
+	 */
+	WINPR_ATTR_MALLOC(MessageQueue_Free, 1)
+	WINPR_API wMessageQueue* MessageQueue_New(const wObject* callback);
+
 	/* Message Pipe */
 
 	typedef struct
@@ -743,9 +759,11 @@ extern "C"
 
 	WINPR_API void MessagePipe_PostQuit(wMessagePipe* pipe, int nExitCode);
 
-	WINPR_API wMessagePipe* MessagePipe_New(void);
 	WINPR_API void MessagePipe_Free(wMessagePipe* pipe);
 
+	WINPR_ATTR_MALLOC(MessagePipe_Free, 1)
+	WINPR_API wMessagePipe* MessagePipe_New(void);
+
 	/* Publisher/Subscriber Pattern */
 
 	typedef struct
@@ -836,9 +854,11 @@ extern "C"
 	WINPR_API int PubSub_OnEvent(wPubSub* pubSub, const char* EventName, void* context,
 	                             const wEventArgs* e);
 
-	WINPR_API wPubSub* PubSub_New(BOOL synchronized);
 	WINPR_API void PubSub_Free(wPubSub* pubSub);
 
+	WINPR_ATTR_MALLOC(PubSub_Free, 1)
+	WINPR_API wPubSub* PubSub_New(BOOL synchronized);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/winpr/include/winpr/custom-crypto.h b/winpr/include/winpr/custom-crypto.h
index f747b348a..32ff5d4c2 100644
--- a/winpr/include/winpr/custom-crypto.h
+++ b/winpr/include/winpr/custom-crypto.h
@@ -77,12 +77,15 @@ extern "C"
 	WINPR_API WINPR_MD_TYPE winpr_md_type_from_string(const char* name);
 	WINPR_API const char* winpr_md_type_to_string(WINPR_MD_TYPE md);
 
+	WINPR_API void winpr_HMAC_Free(WINPR_HMAC_CTX* ctx);
+
+	WINPR_ATTR_MALLOC(winpr_HMAC_Free, 1)
 	WINPR_API WINPR_HMAC_CTX* winpr_HMAC_New(void);
 	WINPR_API BOOL winpr_HMAC_Init(WINPR_HMAC_CTX* ctx, WINPR_MD_TYPE md, const void* key,
 	                               size_t keylen);
 	WINPR_API BOOL winpr_HMAC_Update(WINPR_HMAC_CTX* ctx, const void* input, size_t ilen);
 	WINPR_API BOOL winpr_HMAC_Final(WINPR_HMAC_CTX* ctx, void* output, size_t ilen);
-	WINPR_API void winpr_HMAC_Free(WINPR_HMAC_CTX* ctx);
+
 	WINPR_API BOOL winpr_HMAC(WINPR_MD_TYPE md, const void* key, size_t keylen, const void* input,
 	                          size_t ilen, void* output, size_t olen);
 
@@ -101,12 +104,15 @@ extern "C"
 {
 #endif
 
+	WINPR_API void winpr_Digest_Free(WINPR_DIGEST_CTX* ctx);
+
+	WINPR_ATTR_MALLOC(winpr_Digest_Free, 1)
 	WINPR_API WINPR_DIGEST_CTX* winpr_Digest_New(void);
 	WINPR_API BOOL winpr_Digest_Init_Allow_FIPS(WINPR_DIGEST_CTX* ctx, WINPR_MD_TYPE md);
 	WINPR_API BOOL winpr_Digest_Init(WINPR_DIGEST_CTX* ctx, WINPR_MD_TYPE md);
 	WINPR_API BOOL winpr_Digest_Update(WINPR_DIGEST_CTX* ctx, const void* input, size_t ilen);
 	WINPR_API BOOL winpr_Digest_Final(WINPR_DIGEST_CTX* ctx, void* output, size_t ilen);
-	WINPR_API void winpr_Digest_Free(WINPR_DIGEST_CTX* ctx);
+
 	WINPR_API BOOL winpr_Digest_Allow_FIPS(WINPR_MD_TYPE md, const void* input, size_t ilen,
 	                                       void* output, size_t olen);
 	WINPR_API BOOL winpr_Digest(WINPR_MD_TYPE md, const void* input, size_t ilen, void* output,
@@ -147,11 +153,15 @@ extern "C"
 {
 #endif
 
+	WINPR_API void winpr_RC4_Free(WINPR_RC4_CTX* ctx);
+
+	WINPR_ATTR_MALLOC(winpr_RC4_Free, 1)
 	WINPR_API WINPR_RC4_CTX* winpr_RC4_New_Allow_FIPS(const void* key, size_t keylen);
+
+	WINPR_ATTR_MALLOC(winpr_RC4_Free, 1)
 	WINPR_API WINPR_RC4_CTX* winpr_RC4_New(const void* key, size_t keylen);
 	WINPR_API BOOL winpr_RC4_Update(WINPR_RC4_CTX* ctx, size_t length, const void* input,
 	                                void* output);
-	WINPR_API void winpr_RC4_Free(WINPR_RC4_CTX* ctx);
 
 #ifdef __cplusplus
 }
@@ -225,13 +235,15 @@ extern "C"
 {
 #endif
 
+	WINPR_API void winpr_Cipher_Free(WINPR_CIPHER_CTX* ctx);
+
+	WINPR_ATTR_MALLOC(winpr_Cipher_Free, 1)
 	WINPR_API WINPR_CIPHER_CTX* winpr_Cipher_New(int cipher, int op, const void* key,
 	                                             const void* iv);
 	WINPR_API BOOL winpr_Cipher_SetPadding(WINPR_CIPHER_CTX* ctx, BOOL enabled);
 	WINPR_API BOOL winpr_Cipher_Update(WINPR_CIPHER_CTX* ctx, const void* input, size_t ilen,
 	                                   void* output, size_t* olen);
 	WINPR_API BOOL winpr_Cipher_Final(WINPR_CIPHER_CTX* ctx, void* output, size_t* olen);
-	WINPR_API void winpr_Cipher_Free(WINPR_CIPHER_CTX* ctx);
 
 #ifdef __cplusplus
 }
diff --git a/winpr/include/winpr/image.h b/winpr/include/winpr/image.h
index b101a063b..371020f1f 100644
--- a/winpr/include/winpr/image.h
+++ b/winpr/include/winpr/image.h
@@ -92,9 +92,11 @@ extern "C"
 
 	WINPR_API int winpr_image_read_buffer(wImage* image, const BYTE* buffer, size_t size);
 
-	WINPR_API wImage* winpr_image_new(void);
 	WINPR_API void winpr_image_free(wImage* image, BOOL bFreeBuffer);
 
+	WINPR_ATTR_MALLOC(winpr_image_free, 1)
+	WINPR_API wImage* winpr_image_new(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/winpr/include/winpr/ini.h b/winpr/include/winpr/ini.h
index a32fc41d5..6deefaeed 100644
--- a/winpr/include/winpr/ini.h
+++ b/winpr/include/winpr/ini.h
@@ -129,18 +129,19 @@ extern "C"
 	WINPR_API int IniFile_SetKeyValueInt(wIniFile* ini, const char* section, const char* key,
 	                                     int value);
 
-	/** @brief Create a new ini instance
-	 *
-	 *  @return The newly allocated instance or \b NULL if failed.
-	 */
-	WINPR_API wIniFile* IniFile_New(void);
-
 	/** @brief Free a ini instance
 	 *
 	 *  @param ini The instance to free, may be \b NULL
 	 */
 	WINPR_API void IniFile_Free(wIniFile* ini);
 
+	/** @brief Create a new ini instance
+	 *
+	 *  @return The newly allocated instance or \b NULL if failed.
+	 */
+	WINPR_ATTR_MALLOC(IniFile_Free, 1)
+	WINPR_API wIniFile* IniFile_New(void);
+
 	/** @brief Clone a ini instance
 	 *
 	 *  @param ini The instance to free, may be \b NULL
diff --git a/winpr/include/winpr/stream.h b/winpr/include/winpr/stream.h
index 054fed4f4..6dd5a0ee4 100644
--- a/winpr/include/winpr/stream.h
+++ b/winpr/include/winpr/stream.h
@@ -89,10 +89,12 @@ extern "C"
 	                                                          size_t nmemb, size_t size,
 	                                                          const char* fmt, va_list args);
 
+	WINPR_API void Stream_Free(wStream* s, BOOL bFreeBuffer);
+
+	WINPR_ATTR_MALLOC(Stream_Free, 1)
 	WINPR_API wStream* Stream_New(BYTE* buffer, size_t size);
 	WINPR_API wStream* Stream_StaticConstInit(wStream* s, const BYTE* buffer, size_t size);
 	WINPR_API wStream* Stream_StaticInit(wStream* s, BYTE* buffer, size_t size);
-	WINPR_API void Stream_Free(wStream* s, BOOL bFreeBuffer);
 
 #define Stream_CheckAndLogRequiredLengthOfSize(tag, s, nmemb, size)                         \
 	Stream_CheckAndLogRequiredLengthEx(tag, WLOG_WARN, s, nmemb, size, "%s(%s:%" PRIuz ")", \
@@ -815,9 +817,10 @@ extern "C"
 
 	/* StreamPool */
 
-	WINPR_API wStream* StreamPool_Take(wStreamPool* pool, size_t size);
 	WINPR_API void StreamPool_Return(wStreamPool* pool, wStream* s);
 
+	WINPR_API wStream* StreamPool_Take(wStreamPool* pool, size_t size);
+
 	WINPR_API void Stream_AddRef(wStream* s);
 	WINPR_API void Stream_Release(wStream* s);
 
@@ -825,9 +828,11 @@ extern "C"
 
 	WINPR_API void StreamPool_Clear(wStreamPool* pool);
 
-	WINPR_API wStreamPool* StreamPool_New(BOOL synchronized, size_t defaultSize);
 	WINPR_API void StreamPool_Free(wStreamPool* pool);
 
+	WINPR_ATTR_MALLOC(StreamPool_Free, 1)
+	WINPR_API wStreamPool* StreamPool_New(BOOL synchronized, size_t defaultSize);
+
 	WINPR_API char* StreamPool_GetStatistics(wStreamPool* pool, char* buffer, size_t size);
 
 #ifdef __cplusplus
diff --git a/winpr/include/winpr/tools/makecert.h b/winpr/include/winpr/tools/makecert.h
index 2c04f3e50..8a6d30fdb 100644
--- a/winpr/include/winpr/tools/makecert.h
+++ b/winpr/include/winpr/tools/makecert.h
@@ -38,9 +38,11 @@ extern "C"
 	WINPR_API int makecert_context_output_private_key_file(MAKECERT_CONTEXT* context,
 	                                                       const char* path);
 
-	WINPR_API MAKECERT_CONTEXT* makecert_context_new(void);
 	WINPR_API void makecert_context_free(MAKECERT_CONTEXT* context);
 
+	WINPR_ATTR_MALLOC(makecert_context_free, 1)
+	WINPR_API MAKECERT_CONTEXT* makecert_context_new(void);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/winpr/include/winpr/winpr.h b/winpr/include/winpr/winpr.h
index d9558d862..04311d8d7 100644
--- a/winpr/include/winpr/winpr.h
+++ b/winpr/include/winpr/winpr.h
@@ -47,6 +47,15 @@
 #define WINPR_API
 #endif
 
+#if defined(__clang__) || defined(__GNUC__) && (__GNUC__ <= 10)
+#define WINPR_ATTR_MALLOC(deallocator, ptrindex) __attribute__((malloc, warn_unused_result))
+#elif defined(__GNUC__)
+#define WINPR_ATTR_MALLOC(deallocator, ptrindex) \
+	__attribute__((malloc(deallocator, ptrindex), warn_unused_result))
+#else
+#define WINPR_ATTR_MALLOC(deallocator, ptrindex)
+#endif
+
 #if defined(__GNUC__) || defined(__clang__)
 #define WINPR_ATTR_FORMAT_ARG(pos, args) __attribute__((__format__(__printf__, pos, args)))
 #define WINPR_FORMAT_ARG /**/
diff --git a/winpr/libwinpr/crypto/rc4.h b/winpr/libwinpr/crypto/rc4.h
index 173628c76..c7ced802d 100644
--- a/winpr/libwinpr/crypto/rc4.h
+++ b/winpr/libwinpr/crypto/rc4.h
@@ -21,9 +21,11 @@
 #define WINPR_RC4_H
 
 #include <winpr/wtypes.h>
+#include <winpr/winpr.h>
 
 typedef struct winpr_int_rc4_ctx winpr_int_RC4_CTX;
 
+WINPR_ATTR_MALLOC(winpr_int_rc4_free, 1)
 winpr_int_RC4_CTX* winpr_int_rc4_new(const BYTE* key, size_t keylength);
 BOOL winpr_int_rc4_update(winpr_int_RC4_CTX* ctx, size_t length, const BYTE* input, BYTE* output);
 void winpr_int_rc4_free(winpr_int_RC4_CTX* ctx);
diff --git a/winpr/libwinpr/ncrypt/ncrypt.h b/winpr/libwinpr/ncrypt/ncrypt.h
index c1b1de6ee..222f65536 100644
--- a/winpr/libwinpr/ncrypt/ncrypt.h
+++ b/winpr/libwinpr/ncrypt/ncrypt.h
@@ -79,9 +79,11 @@ typedef struct
 } NCryptBaseProvider;
 
 SECURITY_STATUS checkNCryptHandle(NCRYPT_HANDLE handle, NCryptHandleType matchType);
+
+SECURITY_STATUS winpr_NCryptDefault_dtor(NCRYPT_HANDLE handle);
+
 void* ncrypt_new_handle(NCryptHandleType kind, size_t len, NCryptGetPropertyFn getProp,
                         NCryptReleaseFn dtor);
-SECURITY_STATUS winpr_NCryptDefault_dtor(NCRYPT_HANDLE handle);
 
 #if defined(WITH_PKCS11)
 SECURITY_STATUS NCryptOpenP11StorageProviderEx(NCRYPT_PROV_HANDLE* phProvider,
diff --git a/winpr/libwinpr/sspi/Schannel/schannel_openssl.h b/winpr/libwinpr/sspi/Schannel/schannel_openssl.h
index 589b2a497..31993e9ad 100644
--- a/winpr/libwinpr/sspi/Schannel/schannel_openssl.h
+++ b/winpr/libwinpr/sspi/Schannel/schannel_openssl.h
@@ -44,7 +44,9 @@ SECURITY_STATUS schannel_openssl_encrypt_message(SCHANNEL_OPENSSL* context,
 SECURITY_STATUS schannel_openssl_decrypt_message(SCHANNEL_OPENSSL* context,
                                                  PSecBufferDesc pMessage);
 
-SCHANNEL_OPENSSL* schannel_openssl_new(void);
 void schannel_openssl_free(SCHANNEL_OPENSSL* context);
 
+WINPR_ATTR_MALLOC(schannel_openssl_free, 1)
+SCHANNEL_OPENSSL* schannel_openssl_new(void);
+
 #endif /* WINPR_SSPI_SCHANNEL_OPENSSL_H */
diff --git a/winpr/libwinpr/utils/wlog/Appender.h b/winpr/libwinpr/utils/wlog/Appender.h
index 61dac377f..00f81196f 100644
--- a/winpr/libwinpr/utils/wlog/Appender.h
+++ b/winpr/libwinpr/utils/wlog/Appender.h
@@ -22,6 +22,8 @@
 
 #include "wlog.h"
 
+void WLog_Appender_Free(wLog* log, wLogAppender* appender);
+
 #include "FileAppender.h"
 #include "ConsoleAppender.h"
 #include "BinaryAppender.h"
@@ -34,6 +36,4 @@
 #endif
 #include "UdpAppender.h"
 
-void WLog_Appender_Free(wLog* log, wLogAppender* appender);
-
 #endif /* WINPR_WLOG_APPENDER_PRIVATE_H */
diff --git a/winpr/libwinpr/utils/wlog/BinaryAppender.h b/winpr/libwinpr/utils/wlog/BinaryAppender.h
index 31a9341f8..fb65d9fa7 100644
--- a/winpr/libwinpr/utils/wlog/BinaryAppender.h
+++ b/winpr/libwinpr/utils/wlog/BinaryAppender.h
@@ -22,6 +22,7 @@
 
 #include "wlog.h"
 
+WINPR_ATTR_MALLOC(WLog_Appender_Free, 2)
 wLogAppender* WLog_BinaryAppender_New(wLog* log);
 
 #endif /* WINPR_WLOG_BINARY_APPENDER_PRIVATE_H */
diff --git a/winpr/libwinpr/utils/wlog/CallbackAppender.h b/winpr/libwinpr/utils/wlog/CallbackAppender.h
index 2a7f7822c..cd10f7d3f 100644
--- a/winpr/libwinpr/utils/wlog/CallbackAppender.h
+++ b/winpr/libwinpr/utils/wlog/CallbackAppender.h
@@ -22,6 +22,7 @@
 
 #include "wlog.h"
 
+WINPR_ATTR_MALLOC(WLog_Appender_Free, 2)
 wLogAppender* WLog_CallbackAppender_New(wLog* log);
 
 #endif /* WINPR_WLOG_CALLBACK_APPENDER_PRIVATE_H */
diff --git a/winpr/libwinpr/utils/wlog/ConsoleAppender.h b/winpr/libwinpr/utils/wlog/ConsoleAppender.h
index e6ff1185c..f6a1405ca 100644
--- a/winpr/libwinpr/utils/wlog/ConsoleAppender.h
+++ b/winpr/libwinpr/utils/wlog/ConsoleAppender.h
@@ -22,6 +22,7 @@
 
 #include "wlog.h"
 
+WINPR_ATTR_MALLOC(WLog_Appender_Free, 2)
 wLogAppender* WLog_ConsoleAppender_New(wLog* log);
 
 #endif /* WINPR_WLOG_CONSOLE_APPENDER_PRIVATE_H */
diff --git a/winpr/libwinpr/utils/wlog/FileAppender.h b/winpr/libwinpr/utils/wlog/FileAppender.h
index 6f2f96eac..8938488c0 100644
--- a/winpr/libwinpr/utils/wlog/FileAppender.h
+++ b/winpr/libwinpr/utils/wlog/FileAppender.h
@@ -22,6 +22,7 @@
 
 #include "wlog.h"
 
+WINPR_ATTR_MALLOC(WLog_Appender_Free, 2)
 wLogAppender* WLog_FileAppender_New(wLog* log);
 
 #endif /* WINPR_WLOG_FILE_APPENDER_PRIVATE_H */
diff --git a/winpr/libwinpr/utils/wlog/Layout.h b/winpr/libwinpr/utils/wlog/Layout.h
index 80d41a9d8..8698077a0 100644
--- a/winpr/libwinpr/utils/wlog/Layout.h
+++ b/winpr/libwinpr/utils/wlog/Layout.h
@@ -33,7 +33,9 @@ struct s_wLogLayout
 	LPSTR FormatString;
 };
 
-wLogLayout* WLog_Layout_New(wLog* log);
 void WLog_Layout_Free(wLog* log, wLogLayout* layout);
 
+WINPR_ATTR_MALLOC(WLog_Layout_Free, 2)
+wLogLayout* WLog_Layout_New(wLog* log);
+
 #endif /* WINPR_WLOG_LAYOUT_PRIVATE_H */
diff --git a/winpr/libwinpr/utils/wlog/SyslogAppender.h b/winpr/libwinpr/utils/wlog/SyslogAppender.h
index be6b872be..bbb30d5c8 100644
--- a/winpr/libwinpr/utils/wlog/SyslogAppender.h
+++ b/winpr/libwinpr/utils/wlog/SyslogAppender.h
@@ -26,6 +26,7 @@
 
 #include "wlog.h"
 
+WINPR_ATTR_MALLOC(WLog_Appender_Free, 2)
 wLogAppender* WLog_SyslogAppender_New(wLog* log);
 
 #endif /* WINPR_LIBWINPR_UTILS_WLOG_SYSLOGAPPENDER_H_ */
diff --git a/winpr/libwinpr/utils/wlog/UdpAppender.h b/winpr/libwinpr/utils/wlog/UdpAppender.h
index f2b891a04..eda98b99b 100644
--- a/winpr/libwinpr/utils/wlog/UdpAppender.h
+++ b/winpr/libwinpr/utils/wlog/UdpAppender.h
@@ -28,6 +28,7 @@
 
 #include "wlog.h"
 
+WINPR_ATTR_MALLOC(WLog_Appender_Free, 2)
 wLogAppender* WLog_UdpAppender_New(wLog* log);
 
 #endif /* WINPR_LIBWINPR_UTILS_WLOG_UDPAPPENDER_H_ */