diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index eefe93ed1..ce144c2d7 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -3381,7 +3381,11 @@ static int tls_decrypt_ticket(SSL *s, const unsigned char *etick, int eticklen,
 		}
 	EVP_DecryptUpdate(&ctx, sdec, &slen, p, eticklen);
 	if (EVP_DecryptFinal(&ctx, sdec + slen, &mlen) <= 0)
+		{
+		EVP_CIPHER_CTX_cleanup(&ctx);
+		OPENSSL_free(sdec);
 		return 2;
+		}
 	slen += mlen;
 	EVP_CIPHER_CTX_cleanup(&ctx);
 	p = sdec;