diff --git a/‎src/openssl.c‎
Lines changed: 53 additions & 13 deletions b/‎src/openssl.c‎
Lines changed: 53 additions & 13 deletions
@@ -798,6 +798,9 @@ _libssh2_ecdsa_curve_name_with_octal_new(libssh2_ecdsa_ctx ** ec_ctx,
     char *group_name = NULL;
     unsigned char *data = NULL;
 
+    if(!ctx)
+        return -1;
+
     if(n) {
         group_name = OPENSSL_zalloc(strlen(n) + 1);
     }
@@ -822,17 +825,22 @@ _libssh2_ecdsa_curve_name_with_octal_new(libssh2_ecdsa_ctx ** ec_ctx,
 
         params[2] = OSSL_PARAM_construct_end();
 
-        if(EVP_PKEY_fromdata_init(ctx) > 0) {
+        if(EVP_PKEY_fromdata_init(ctx) > 0)
             ret = EVP_PKEY_fromdata(ctx, ec_ctx, EVP_PKEY_PUBLIC_KEY,
                                     params);
-        }
+        else
+            ret = -1;
+    }
+    else
+        ret = -1;
 
-        if(group_name)
-            OPENSSL_clear_free(group_name, strlen(n));
+    if(group_name)
+        OPENSSL_clear_free(group_name, strlen(n));
 
-        if(data)
-            OPENSSL_clear_free(data, k_len);
-    }
+    if(data)
+        OPENSSL_clear_free(data, k_len);
+
+    EVP_PKEY_CTX_free(ctx);
 #else
     EC_KEY *ec_key = EC_KEY_new_by_curve_name(curve);
 
@@ -842,15 +850,26 @@ _libssh2_ecdsa_curve_name_with_octal_new(libssh2_ecdsa_ctx ** ec_ctx,
 
         ec_group = EC_KEY_get0_group(ec_key);
         point = EC_POINT_new(ec_group);
-        ret = EC_POINT_oct2point(ec_group, point, k, k_len, NULL);
-        ret = EC_KEY_set_public_key(ec_key, point);
 
-        if(point)
+        if(point) {
+            ret = EC_POINT_oct2point(ec_group, point, k, k_len, NULL);
+            if(ret == 1)
+                ret = EC_KEY_set_public_key(ec_key, point);
+
             EC_POINT_free(point);
+        }
+        else
+            ret = -1;
 
-        if(ec_ctx)
+        if(ret == 1 && ec_ctx)
             *ec_ctx = ec_key;
+        else {
+            EC_KEY_free(ec_key);
+            ret = -1;
+        }
     }
+    else
+        ret = -1;
 #endif
 
     return (ret == 1) ? 0 : -1;
@@ -916,7 +935,16 @@ _libssh2_ecdsa_verify(libssh2_ecdsa_ctx * ecdsa_ctx,
 
 #ifdef USE_OPENSSL_3
     ctx = EVP_PKEY_CTX_new(ecdsa_ctx, NULL);
+    if(!ctx) {
+        ret = -1;
+        goto cleanup;
+    }
+
     der_len = i2d_ECDSA_SIG(ecdsa_sig, &der);
+    if(der_len <= 0) {
+        ret = -1;
+        goto cleanup;
+    }
 #endif
 
     if(type == LIBSSH2_EC_CURVE_NISTP256) {
@@ -929,12 +957,24 @@ _libssh2_ecdsa_verify(libssh2_ecdsa_ctx * ecdsa_ctx,
         LIBSSH2_ECDSA_VERIFY(512);
     }
 
+#ifdef USE_OPENSSL_3
+cleanup:
+
+    if(ctx)
+        EVP_PKEY_CTX_free(ctx);
+
+    if(der)
+        OPENSSL_free(der);
+#endif
+
 #ifdef HAVE_OPAQUE_STRUCTS
     if(ecdsa_sig)
         ECDSA_SIG_free(ecdsa_sig);
 #else
-    BN_clear_free(ecdsa_sig_.s);
-    BN_clear_free(ecdsa_sig_.r);
+    if(ecdsa_sig_.s)
+        BN_clear_free(ecdsa_sig_.s);
+    if(ecdsa_sig_.r)
+        BN_clear_free(ecdsa_sig_.r);
 #endif
 
     return (ret == 1) ? 0 : -1;