diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 4450fdb..8667d13 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -3030,6 +3030,8 @@
 
     status = psa_mac_finish_internal( operation,
                                       actual_mac, sizeof( actual_mac ) );
+    if( status != PSA_SUCCESS )
+        goto cleanup;
 
     if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
         status = PSA_ERROR_INVALID_SIGNATURE;