diff --git a/lib/hx509/ks_keychain.c b/lib/hx509/ks_keychain.c
index 59986c690..9b8224f1d 100644
--- a/lib/hx509/ks_keychain.c
+++ b/lib/hx509/ks_keychain.c
@@ -344,11 +344,13 @@ keychain_init(hx509_context context,
 	    if (ret != noErr) {
 		hx509_set_error_string(context, 0, ENOENT,
 				       "Failed to open %s", residue);
+		free(ctx);
 		return ENOENT;
 	    }
 	} else {
 	    hx509_set_error_string(context, 0, ENOENT,
 				   "Unknown subtype %s", residue);
+	    free(ctx);
 	    return ENOENT;
 	}
     }