diff --git a/lib/hx509/crypto.c b/lib/hx509/crypto.c
index 4dd3d24d3..d6d2a87c7 100644
--- a/lib/hx509/crypto.c
+++ b/lib/hx509/crypto.c
@@ -1484,6 +1484,8 @@ hx509_crypto_destroy(hx509_crypto crypto)
 	free(crypto->name);
     if (crypto->key.data)
 	free(crypto->key.data);
+    if (crypto->param)
+	free(crypto->param);
     der_free_oid(&crypto->oid);
     memset(crypto, 0, sizeof(*crypto));
     free(crypto);
diff --git a/lib/hx509/hxtool.c b/lib/hx509/hxtool.c
index 2a4e87eb4..1967b116e 100644
--- a/lib/hx509/hxtool.c
+++ b/lib/hx509/hxtool.c
@@ -236,8 +236,8 @@ cms_create_sd(struct cms_create_sd_options *opt, int argc, char **argv)
 
     hx509_certs_free(&anchors);
     hx509_certs_free(&pool);
-    hx509_certs_free(&store);
     hx509_cert_free(cert);
+    hx509_certs_free(&store);
     _hx509_unmap_file(p, sz);
     hx509_lock_free(lock);
 
@@ -313,6 +313,7 @@ cms_unenvelope(struct cms_unenvelope_options *opt, int argc, char **argv)
     _hx509_unmap_file(p, sz);
     hx509_lock_free(lock);
     hx509_certs_free(&certs);
+    der_free_oid(&contentType);
 
     ret = _hx509_write_file(argv[1], o.data, o.length);
     if (ret)