diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c
index 9d3557e8d7e03682eb9ed3b574f0da284a05149c..992efc0bd48064fa98cda0e79f4eded37225e618 100644
--- a/crypto/pkcs12/p12_decr.c
+++ b/crypto/pkcs12/p12_decr.c
@@ -158,27 +158,31 @@ ASN1_OCTET_STRING *PKCS12_item_i2d_encrypt(X509_ALGOR *algor, const ASN1_ITEM *i
 				       const char *pass, int passlen,
 				       void *obj, int zbuf)
 {
-	ASN1_OCTET_STRING *oct;
+	ASN1_OCTET_STRING *oct = NULL;
 	unsigned char *in = NULL;
 	int inlen;
 	if (!(oct = M_ASN1_OCTET_STRING_new ())) {
 		PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
-		return NULL;
+		goto err;
 	}
 	inlen = ASN1_item_i2d(obj, &in, it);
 	if (!in) {
 		PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR);
-		return NULL;
+		goto err;
 	}
 	if (!PKCS12_pbe_crypt(algor, pass, passlen, in, inlen, &oct->data,
 				 &oct->length, 1)) {
 		PKCS12err(PKCS12_F_PKCS12_ITEM_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR);
 		OPENSSL_free(in);
-		return NULL;
+		goto err;
 	}
 	if (zbuf) OPENSSL_cleanse(in, inlen);
 	OPENSSL_free(in);
 	return oct;
+	err:
+	if (oct)
+		ASN1_OCTET_STRING_free(oct);
+	return NULL;
 }
 
 IMPLEMENT_PKCS12_STACK_OF(PKCS7)