diff --git a/pkcs7/authEnvelopedData-kari.c b/pkcs7/authEnvelopedData-kari.c
index 849f340e..f1dec0f7 100644
--- a/pkcs7/authEnvelopedData-kari.c
+++ b/pkcs7/authEnvelopedData-kari.c
@@ -75,6 +75,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -94,9 +95,10 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
         return -1;
 
     ret = wc_InitRng(&rng);
-    if(ret != 0){
-       printf("wc_InitRng() failed, ret = %d\n", ret);
-       return -1;
+    if (ret != 0) {
+        printf("wc_InitRng() failed, ret = %d\n", ret);
+        wc_PKCS7_Free(pkcs7);
+        return -1;
     }
 
     pkcs7->content     = (byte*)data;
@@ -104,7 +106,7 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
     pkcs7->contentOID  = DATA;
     pkcs7->encryptOID  = AES256GCMb;
     pkcs7->rng         = &rng;
-    
+
     /* add recipient using ECC certificate (KARI type) */
     ret = wc_PKCS7_AddRecipient_KARI(pkcs7, cert, certSz, AES256_WRAP,
                                      dhSinglePass_stdDH_sha256kdf_scheme,
@@ -112,6 +114,7 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
     if (ret < 0) {
         printf("wc_PKCS7_AddRecipient_KARI() failed, ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     }
 
@@ -120,6 +123,7 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
     if (ret <= 0) {
         printf("wc_PKCS7_EncodeAuthEnvelopedData() failed, ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
 
     } else {
@@ -128,6 +132,8 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileKARI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
+            wc_FreeRng(&rng);
             return -1;
         }
     }
@@ -151,9 +157,10 @@ static int authEnvelopedData_decrypt(byte* in, word32 inSz, byte* cert,
         return -1;
 
     ret = wc_InitRng(&rng);
-    if(ret != 0){
-       printf("wc_InitRng() failed, ret = %d\n", ret);
-       return -1;
+    if (ret != 0) {
+        printf("wc_InitRng() failed, ret = %d\n", ret);
+        wc_PKCS7_Free(pkcs7);
+        return -1;
     }
 
     /* init with recipient cert */
@@ -161,6 +168,7 @@ static int authEnvelopedData_decrypt(byte* in, word32 inSz, byte* cert,
     if (ret != 0) {
         printf("ERROR: wc_PKCS7_InitWithCert(), ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     }
 
@@ -169,6 +177,7 @@ static int authEnvelopedData_decrypt(byte* in, word32 inSz, byte* cert,
     if (ret != 0) {
         printf("ERROR: wc_PKCS7_SetKey(), ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     }
 
@@ -179,6 +188,7 @@ static int authEnvelopedData_decrypt(byte* in, word32 inSz, byte* cert,
     if (ret <= 0 || (ret != sizeof(data)) || (XMEMCMP(out, data, ret) != 0)) {
         printf("ERROR: wc_PKCS7_DecodeAuthEnvelopedData(), ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
 
     } else {
diff --git a/pkcs7/authEnvelopedData-kekri.c b/pkcs7/authEnvelopedData-kekri.c
index 44669f93..ffa06212 100644
--- a/pkcs7/authEnvelopedData-kekri.c
+++ b/pkcs7/authEnvelopedData-kekri.c
@@ -58,6 +58,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -108,6 +109,7 @@ static int authEnvelopedData_encrypt(byte* out, word32 outSz)
 
         if (write_file_buffer(encodedFileKEKRI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/authEnvelopedData-ktri.c b/pkcs7/authEnvelopedData-ktri.c
index 6f656e09..b45b2a46 100644
--- a/pkcs7/authEnvelopedData-ktri.c
+++ b/pkcs7/authEnvelopedData-ktri.c
@@ -71,6 +71,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -115,6 +116,7 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileKTRI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/authEnvelopedData-ori.c b/pkcs7/authEnvelopedData-ori.c
index 6a42d92c..9ee9b69a 100644
--- a/pkcs7/authEnvelopedData-ori.c
+++ b/pkcs7/authEnvelopedData-ori.c
@@ -78,6 +78,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -194,6 +195,7 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileORI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/authEnvelopedData-pwri.c b/pkcs7/authEnvelopedData-pwri.c
index cebe8d17..179c0398 100644
--- a/pkcs7/authEnvelopedData-pwri.c
+++ b/pkcs7/authEnvelopedData-pwri.c
@@ -78,6 +78,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -131,6 +132,7 @@ static int authEnvelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFilePWRI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/compressedData.c b/pkcs7/compressedData.c
index 41a831fc..1b6b7275 100644
--- a/pkcs7/compressedData.c
+++ b/pkcs7/compressedData.c
@@ -48,6 +48,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -79,6 +80,7 @@ static int compressedData_encode(byte* out, word32 outSz)
 
         if (write_file_buffer(compressedFile, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/encryptedData.c b/pkcs7/encryptedData.c
index 0d812b06..c4f58ac2 100644
--- a/pkcs7/encryptedData.c
+++ b/pkcs7/encryptedData.c
@@ -52,6 +52,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -86,6 +87,7 @@ static int encryptedData_encrypt(byte* out, word32 outSz)
 
         if (write_file_buffer(encryptedFile, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/envelopedData-kari.c b/pkcs7/envelopedData-kari.c
index d34d4420..169f0098 100644
--- a/pkcs7/envelopedData-kari.c
+++ b/pkcs7/envelopedData-kari.c
@@ -75,6 +75,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -94,9 +95,10 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
         return -1;
 
     ret = wc_InitRng(&rng);
-    if(ret != 0){
-       printf("wc_InitRng() failed, ret = %d\n", ret);
-       return -1;
+    if (ret != 0) {
+        printf("wc_InitRng() failed, ret = %d\n", ret);
+        wc_PKCS7_Free(pkcs7);
+        return -1;
     }
 
     pkcs7->content     = (byte*)data;
@@ -104,7 +106,7 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
     pkcs7->contentOID  = DATA;
     pkcs7->encryptOID  = AES256CBCb;
     pkcs7->rng         = &rng;
-   
+
     /* add recipient using ECC certificate (KARI type) */
     ret = wc_PKCS7_AddRecipient_KARI(pkcs7, cert, certSz, AES256_WRAP,
                                      dhSinglePass_stdDH_sha256kdf_scheme,
@@ -112,6 +114,7 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
     if (ret < 0) {
         printf("wc_PKCS7_AddRecipient_KARI() failed, ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     }
 
@@ -120,6 +123,7 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
     if (ret <= 0) {
         printf("wc_PKCS7_EncodeEnvelopedData() failed, ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
 
     } else {
@@ -128,11 +132,13 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileKARI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
+            wc_FreeRng(&rng);
             return -1;
         }
     }
 
-    wc_FreeRng(&rng); 
+    wc_FreeRng(&rng);
     wc_PKCS7_Free(pkcs7);
 
     return ret;
@@ -145,22 +151,25 @@ static int envelopedData_decrypt(byte* in, word32 inSz, byte* cert,
     int ret;
     PKCS7* pkcs7;
     WC_RNG rng;
-   
+
     ret = wc_InitRng(&rng);
-    if(ret != 0){
-       printf("wc_InitRng() failed, ret = %d\n", ret);
-       return -1;
+    if (ret != 0) {
+        printf("wc_InitRng() failed, ret = %d\n", ret);
+        return -1;
     }
 
     pkcs7 = wc_PKCS7_New(NULL, INVALID_DEVID);
-    if (pkcs7 == NULL)
+    if (pkcs7 == NULL) {
+        wc_FreeRng(&rng);
         return -1;
- 
+    }
+
     /* init with recipient cert */
     ret = wc_PKCS7_InitWithCert(pkcs7, cert, certSz);
     if (ret != 0) {
         printf("ERROR: wc_PKCS7_InitWithCert(), ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     }
 
@@ -169,6 +178,7 @@ static int envelopedData_decrypt(byte* in, word32 inSz, byte* cert,
     if (ret != 0) {
         printf("ERROR: wc_PKCS7_SetKey(), ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     }
 
@@ -179,6 +189,7 @@ static int envelopedData_decrypt(byte* in, word32 inSz, byte* cert,
     if (ret <= 0 || (ret != sizeof(data)) || (XMEMCMP(out, data, ret) != 0)) {
         printf("ERROR: wc_PKCS7_DecodeEnvelopedData(), ret = %d\n", ret);
         wc_PKCS7_Free(pkcs7);
+        wc_FreeRng(&rng);
         return -1;
     } else {
         printf("Successfully decoded EnvelopedData bundle (%s)\n",
diff --git a/pkcs7/envelopedData-kekri.c b/pkcs7/envelopedData-kekri.c
index 3646e929..46efd25c 100644
--- a/pkcs7/envelopedData-kekri.c
+++ b/pkcs7/envelopedData-kekri.c
@@ -58,6 +58,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -104,6 +105,7 @@ static int envelopedData_encrypt(byte* out, word32 outSz)
 
         if (write_file_buffer(encodedFileKEKRI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/envelopedData-ktri.c b/pkcs7/envelopedData-ktri.c
index b3060470..10bf1cb0 100644
--- a/pkcs7/envelopedData-ktri.c
+++ b/pkcs7/envelopedData-ktri.c
@@ -71,6 +71,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -119,6 +120,7 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileKTRI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/envelopedData-ori.c b/pkcs7/envelopedData-ori.c
index ed63df9d..181698af 100644
--- a/pkcs7/envelopedData-ori.c
+++ b/pkcs7/envelopedData-ori.c
@@ -78,6 +78,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -194,6 +195,7 @@ static int envelopedData_encrypt(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileORI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/envelopedData-pwri.c b/pkcs7/envelopedData-pwri.c
index 5b2e3b73..e8853668 100644
--- a/pkcs7/envelopedData-pwri.c
+++ b/pkcs7/envelopedData-pwri.c
@@ -48,6 +48,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -100,6 +101,7 @@ static int envelopedData_encrypt(byte* out, word32 outSz)
 
         if (write_file_buffer(encodedFilePWRI, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
     }
diff --git a/pkcs7/signedData-CompressedFirmwarePkgData.c b/pkcs7/signedData-CompressedFirmwarePkgData.c
index fd7afb53..07aaba8c 100644
--- a/pkcs7/signedData-CompressedFirmwarePkgData.c
+++ b/pkcs7/signedData-CompressedFirmwarePkgData.c
@@ -86,6 +86,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -132,6 +133,7 @@ static int signedData_sign_noattrs(byte* cert, word32 certSz, byte* privateKey,
 
         if (write_file_buffer(encodedFileNoAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
@@ -194,6 +196,7 @@ static int signedData_sign_attrs(byte* cert, word32 certSz, byte* privateKey,
 
         if (write_file_buffer(encodedFileAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
diff --git a/pkcs7/signedData-DetachedSignature.c b/pkcs7/signedData-DetachedSignature.c
index ad358a63..be1c42b1 100644
--- a/pkcs7/signedData-DetachedSignature.c
+++ b/pkcs7/signedData-DetachedSignature.c
@@ -75,6 +75,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -150,6 +151,8 @@ static int signedData_sign_noattrs(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileNoAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
+            wc_FreeRng(&rng);
             return -1;
         }
     }
@@ -239,6 +242,8 @@ static int signedData_sign_attrs(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
+            wc_FreeRng(&rng);
             return -1;
         }
 
diff --git a/pkcs7/signedData-EncryptedCompressedFirmwarePkgData.c b/pkcs7/signedData-EncryptedCompressedFirmwarePkgData.c
index 02510ff8..df14f7aa 100644
--- a/pkcs7/signedData-EncryptedCompressedFirmwarePkgData.c
+++ b/pkcs7/signedData-EncryptedCompressedFirmwarePkgData.c
@@ -96,6 +96,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -147,6 +148,7 @@ static int signedData_sign_noattrs(byte* cert, word32 certSz, byte* privateKey,
 
         if (write_file_buffer(encodedFileNoAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
@@ -214,6 +216,7 @@ static int signedData_sign_attrs(byte* cert, word32 certSz, byte* privateKey,
 
         if (write_file_buffer(encodedFileAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
diff --git a/pkcs7/signedData-EncryptedFirmwareCB.c b/pkcs7/signedData-EncryptedFirmwareCB.c
index caf267be..17a370de 100644
--- a/pkcs7/signedData-EncryptedFirmwareCB.c
+++ b/pkcs7/signedData-EncryptedFirmwareCB.c
@@ -82,6 +82,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -387,6 +388,7 @@ static int generateBundle(byte* out, word32 *outSz, const byte* encryptKey,
         *outSz = ret;
         if (write_file_buffer(fileName, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
@@ -438,7 +440,8 @@ static int getFirmwareKey(PKCS7* pkcs7, byte* key, word32 keySz)
             wc_PKCS7_Init(envPkcs7, NULL, 0);
             if (wc_PKCS7_SetWrapCEKCb(envPkcs7, myCEKwrapFunc) != 0) {
                 printf("\tIssue setting CEK wrap callback\n");
-                return ret;
+                wc_PKCS7_Free(envPkcs7);
+                return BAD_FUNC_ARG;
             }
             envPkcs7->contentOID = FIRMWARE_PKG_DATA; /* expected content */
             ret = wc_PKCS7_DecodeEnvelopedData(envPkcs7, atr, ret,
diff --git a/pkcs7/signedData-EncryptedFirmwarePkgData.c b/pkcs7/signedData-EncryptedFirmwarePkgData.c
index 5309ea82..ddf26559 100644
--- a/pkcs7/signedData-EncryptedFirmwarePkgData.c
+++ b/pkcs7/signedData-EncryptedFirmwarePkgData.c
@@ -90,6 +90,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -140,6 +141,7 @@ static int signedData_sign_noattrs(byte* cert, word32 certSz, byte* privateKey,
 
         if (write_file_buffer(encodedFileNoAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
@@ -207,6 +209,7 @@ static int signedData_sign_attrs(byte* cert, word32 certSz, byte* privateKey,
 
         if (write_file_buffer(encodedFileAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
diff --git a/pkcs7/signedData-FirmwarePkgData.c b/pkcs7/signedData-FirmwarePkgData.c
index 3d861a99..cf8b822d 100644
--- a/pkcs7/signedData-FirmwarePkgData.c
+++ b/pkcs7/signedData-FirmwarePkgData.c
@@ -79,6 +79,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -125,6 +126,7 @@ static int signedData_sign_noattrs(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileNoAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
@@ -186,6 +188,7 @@ static int signedData_sign_attrs(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
             return -1;
         }
 
diff --git a/pkcs7/signedData-cryptocb.c b/pkcs7/signedData-cryptocb.c
index a811cec4..56e040ab 100644
--- a/pkcs7/signedData-cryptocb.c
+++ b/pkcs7/signedData-cryptocb.c
@@ -27,6 +27,7 @@
 #include <wolfssl/wolfcrypt/error-crypt.h>
 #include <wolfssl/wolfcrypt/logging.h>
 #include <wolfssl/wolfcrypt/cryptocb.h>
+#include <wolfssl/wolfcrypt/memory.h>
 #ifdef USE_PSA
 #include <wolfssl/wolfcrypt/port/psa/psa.h>
 #include <psa/crypto.h>
@@ -124,6 +125,7 @@ static int write_file(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -244,6 +246,8 @@ static int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
 
                     ret = wc_InitRsaKey_ex(&rsaPriv, NULL, INVALID_DEVID);
                     if (ret != 0) {
+                        wc_ForceZero(der, derSz);
+                        free(der);
                         return ret;
                     }
                     ret = wc_RsaPrivateKeyDecode(der, &idx, &rsaPriv, derSz);
@@ -255,8 +259,10 @@ static int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
                             info->pk.rsa.type, &rsaPriv, info->pk.rsa.rng);
                     }
                     wc_FreeRsaKey(&rsaPriv);
-                    if (der != NULL)
+                    if (der != NULL) {
+                        wc_ForceZero(der, derSz);
                         free(der);
+                    }
                     break;
                 }
             }
@@ -306,6 +312,8 @@ static int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
 
             ret = wc_ecc_init_ex(&eccPriv, NULL, INVALID_DEVID);
             if (ret != 0) {
+                wc_ForceZero(der, derSz);
+                free(der);
                 return ret;
             }
             ret = wc_EccPrivateKeyDecode(der, &idx, &eccPriv, derSz);
@@ -316,8 +324,10 @@ static int myCryptoCb(int devIdArg, wc_CryptoInfo* info, void* ctx)
                     info->pk.eccsign.rng, &eccPriv);
             }
             wc_ecc_free(&eccPriv);
-            if (der != NULL)
+            if (der != NULL) {
+                wc_ForceZero(der, derSz);
                 free(der);
+            }
         #endif
         }
         else if (info->pk.type == WC_PK_TYPE_ECDSA_VERIFY) {
diff --git a/pkcs7/signedData-p7b.c b/pkcs7/signedData-p7b.c
index 2735046b..380de0ce 100644
--- a/pkcs7/signedData-p7b.c
+++ b/pkcs7/signedData-p7b.c
@@ -56,6 +56,7 @@ int main(int argc, char** argv)
     word32 singleCertDerSz;     /* tmp size of one DER cert in decoded PKCS7 */
     byte*  singleCertPem;
     word32 singleCertPemSz;
+    int    pemRet;
     FILE* file;
 
 #ifdef DEBUG_WOLFSSL
@@ -114,14 +115,15 @@ int main(int argc, char** argv)
         XMEMSET(singleCertPem, 0, singleCertPemSz);
 
         /* convert DER to PEM */
-        singleCertPemSz = wc_DerToPem(singleCertDer, singleCertDerSz,
+        pemRet = wc_DerToPem(singleCertDer, singleCertDerSz,
                                       singleCertPem, singleCertPemSz,
                                       CERT_TYPE);
-        if (singleCertPemSz < 0) {
-            printf("Error converting DER to PEM, ret = %d\n", singleCertPemSz);
+        if (pemRet < 0) {
+            printf("Error converting DER to PEM, ret = %d\n", pemRet);
             XFREE(singleCertPem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             break;
         }
+        singleCertPemSz = (word32)pemRet;
         printf("converted DER to PEM, pemSz = %d\n", singleCertPemSz);
         printf("CERT [%d] PEM:\n", i);
 
diff --git a/pkcs7/signedData-stream.c b/pkcs7/signedData-stream.c
index ba853561..10beec10 100644
--- a/pkcs7/signedData-stream.c
+++ b/pkcs7/signedData-stream.c
@@ -345,6 +345,7 @@ int main(int argc, char** argv)
     }
     if (encryptedSz <= 0) {
         printf("error reading file %s\n", encodedFile);
+        ret = -1;
         goto out;
     }
     printf("read %d bytes from file\n", encryptedSz);
@@ -352,8 +353,10 @@ int main(int argc, char** argv)
     decryptedSz = signedData_verify(encrypted, encryptedSz,
                                     cert, certSz, key, keySz,
                                     decrypted, decryptedSz);
-    if (decryptedSz < 0)
-        return -1;
+    if (decryptedSz < 0) {
+        ret = -1;
+        goto out;
+    }
 #endif
 out:
 
diff --git a/pkcs7/signedData-verifyFile.c b/pkcs7/signedData-verifyFile.c
index 5f4c6197..89046d80 100644
--- a/pkcs7/signedData-verifyFile.c
+++ b/pkcs7/signedData-verifyFile.c
@@ -55,6 +55,7 @@ static int VerifySignedData(byte* bundleBytes, word32 bundleSz,
 #ifdef WOLFSSL_DER_TO_PEM
     byte*  singleCertPem;
     word32 singleCertPemSz;
+    int    pemRet;
 #endif
     (void)singleCertDer;
 
@@ -115,14 +116,15 @@ static int VerifySignedData(byte* bundleBytes, word32 bundleSz,
         XMEMSET(singleCertPem, 0, singleCertPemSz);
 
         /* convert DER to PEM */
-        singleCertPemSz = wc_DerToPem(singleCertDer, singleCertDerSz,
+        pemRet = wc_DerToPem(singleCertDer, singleCertDerSz,
                                       singleCertPem, singleCertPemSz,
                                       CERT_TYPE);
-        if (singleCertPemSz < 0) {
-            printf("Error converting DER to PEM, ret = %d\n", singleCertPemSz);
+        if (pemRet < 0) {
+            printf("Error converting DER to PEM, ret = %d\n", pemRet);
             XFREE(singleCertPem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             break;
         }
+        singleCertPemSz = (word32)pemRet;
         printf("converted DER to PEM, pemSz = %d\n", singleCertPemSz);
         printf("CERT [%d] PEM:\n", i);
 
diff --git a/pkcs7/signedData.c b/pkcs7/signedData.c
index 1ef8580e..61b04365 100644
--- a/pkcs7/signedData.c
+++ b/pkcs7/signedData.c
@@ -71,6 +71,7 @@ static int write_file_buffer(const char* fileName, byte* in, word32 inSz)
     ret = (int)fwrite(in, 1, inSz, file);
     if (ret == 0) {
         printf("ERROR: writing buffer to output file\n");
+        fclose(file);
         return -1;
     }
     fclose(file);
@@ -147,6 +148,8 @@ static int signedData_sign_noattrs(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileNoAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
+            wc_FreeRng(&rng);
             return -1;
         }
     }
@@ -227,6 +230,8 @@ static int signedData_sign_attrs(byte* cert, word32 certSz, byte* key,
 
         if (write_file_buffer(encodedFileAttrs, out, ret) != 0) {
             printf("ERROR: error writing encoded to output file\n");
+            wc_PKCS7_Free(pkcs7);
+            wc_FreeRng(&rng);
             return -1;
         }