diff --git a/library/entropy.c b/library/entropy.c
index e41a593..3626d34 100644
--- a/library/entropy.c
+++ b/library/entropy.c
@@ -94,10 +94,10 @@
 #if defined(MBEDTLS_HAVEGE_C)
     mbedtls_havege_free( &ctx->havege_data );
 #endif
-    mbedtls_zeroize( ctx, sizeof( mbedtls_entropy_context ) );
 #if defined(MBEDTLS_THREADING_C)
     mbedtls_mutex_free( &ctx->mutex );
 #endif
+    mbedtls_zeroize( ctx, sizeof( mbedtls_entropy_context ) );
 }
 
 int mbedtls_entropy_add_source( mbedtls_entropy_context *ctx,
diff --git a/library/x509_crt.c b/library/x509_crt.c
index 8967337..3ecda04 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -1770,7 +1770,7 @@
 {
     int ret;
     uint32_t ca_flags = 0;
-    int check_path_cnt = path_cnt + 1;
+    int check_path_cnt;
     unsigned char hash[MBEDTLS_MD_MAX_SIZE];
     const mbedtls_md_info_t *md_info;
 
@@ -1801,8 +1801,10 @@
         if( x509_crt_check_parent( child, trust_ca, 1, path_cnt == 0 ) != 0 )
             continue;
 
+        check_path_cnt = path_cnt + 1;
+
         /*
-         * Reduce path_len to check against if top of the chain is
+         * Reduce check_path_cnt to check against if top of the chain is
          * the same as the trusted CA
          */
         if( child->subject_raw.len == trust_ca->subject_raw.len &&