diff --git a/CMakeLists.txt b/CMakeLists.txt
index 6c10580..46ca440 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -315,7 +315,11 @@
 endif()
 
 if (NOT EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/framework/CMakeLists.txt")
-    message(FATAL_ERROR "${CMAKE_CURRENT_SOURCE_DIR}/framework/CMakeLists.txt not found. Run `git submodule update --init` from the source tree to fetch the submodule contents.")
+    if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/.git/")
+        message(FATAL_ERROR "${CMAKE_CURRENT_SOURCE_DIR}CMakeLists.txt not found (and does appear to be a git checkout). Run `git submodule update --init` from the source tree to fetch the submodule contents.")
+    else ()
+        message(FATAL_ERROR "${CMAKE_CURRENT_SOURCE_DIR}/CMakeLists.txt not found (and does not appear to be a git checkout). Please ensure you have downloaded the right archive from the release page on GitHub.")
+    endif()
 endif()
 add_subdirectory(framework)
 
diff --git a/ChangeLog.d/psa_util-bits-0.txt b/ChangeLog.d/psa_util-bits-0.txt
new file mode 100644
index 0000000..9aa70ad
--- /dev/null
+++ b/ChangeLog.d/psa_util-bits-0.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix undefined behavior in some cases when mbedtls_psa_raw_to_der() or
+     mbedtls_psa_der_to_raw() is called with bits=0.
diff --git a/Makefile b/Makefile
index e4d98c9..09c829a 100644
--- a/Makefile
+++ b/Makefile
@@ -6,11 +6,16 @@
     ifeq (,$(wildcard framework/exported.make))
         # Use the define keyword to get a multi-line message.
         # GNU make appends ".  Stop.", so tweak the ending of our message accordingly.
-        define error_message
-$(MBEDTLS_PATH)/framework/exported.make not found.
-Run `git submodule update --init` to fetch the submodule contents.
+        ifeq (,$(wildcard .git))
+            define error_message
+${MBEDTLS_PATH}/framework/exported.make not found (and does appear to be a git checkout). Run `git submodule update --init` from the source tree to fetch the submodule contents.
 This is a fatal error
-        endef
+            endef
+        else
+            define error_message
+${MBEDTLS_PATH}/framework/exported.make not found (and does not appear to be a git checkout). Please ensure you have downloaded the right archive from the release page on GitHub.
+            endef
+        endif
         $(error $(error_message))
     endif
     include framework/exported.make
diff --git a/framework b/framework
index d68446c..5560984 160000
--- a/framework
+++ b/framework
@@ -1 +1 @@
-Subproject commit d68446c9da02e536279a7aaa5a3c9850742ba30c
+Subproject commit 55609845504ce77f3714795785282456444967c8
diff --git a/include/mbedtls/psa_util.h b/include/mbedtls/psa_util.h
index c78cc23..b898f1f 100644
--- a/include/mbedtls/psa_util.h
+++ b/include/mbedtls/psa_util.h
@@ -161,6 +161,16 @@
  * \param[out]  der_len     On success it contains the amount of valid data
  *                          (in bytes) written to \p der. It's undefined
  *                          in case of failure.
+ *
+ * \note                    The behavior is undefined if \p der is null,
+ *                          even if \p der_size is 0.
+ *
+ * \return                  0 if successful.
+ * \return                  #MBEDTLS_ERR_ASN1_BUF_TOO_SMALL if \p der_size
+ *                          is too small or if \p bits is larger than the
+ *                          largest supported curve.
+ * \return                  #MBEDTLS_ERR_ASN1_INVALID_DATA if one of the
+ *                          numbers in the signature is 0.
  */
 int mbedtls_ecdsa_raw_to_der(size_t bits, const unsigned char *raw, size_t raw_len,
                              unsigned char *der, size_t der_size, size_t *der_len);
@@ -177,6 +187,15 @@
  * \param[out]  raw_len     On success it is updated with the amount of valid
  *                          data (in bytes) written to \p raw. It's undefined
  *                          in case of failure.
+ *
+ * \return                  0 if successful.
+ * \return                  #MBEDTLS_ERR_ASN1_BUF_TOO_SMALL if \p raw_size
+ *                          is too small or if \p bits is larger than the
+ *                          largest supported curve.
+ * \return                  #MBEDTLS_ERR_ASN1_INVALID_DATA if the data in
+ *                          \p der is inconsistent with \p bits.
+ * \return                  An \c MBEDTLS_ERR_ASN1_xxx error code if
+ *                          \p der is malformed.
  */
 int mbedtls_ecdsa_der_to_raw(size_t bits, const unsigned char *der, size_t der_len,
                              unsigned char *raw, size_t raw_size, size_t *raw_len);
diff --git a/library/psa_util.c b/library/psa_util.c
index 679d00e..014e648 100644
--- a/library/psa_util.c
+++ b/library/psa_util.c
@@ -440,6 +440,9 @@
     unsigned char *p = der + der_size;
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
 
+    if (bits == 0) {
+        return MBEDTLS_ERR_ASN1_INVALID_DATA;
+    }
     if (raw_len != (2 * coordinate_len)) {
         return MBEDTLS_ERR_ASN1_INVALID_DATA;
     }
@@ -559,6 +562,9 @@
     size_t coordinate_size = PSA_BITS_TO_BYTES(bits);
     int ret;
 
+    if (bits == 0) {
+        return MBEDTLS_ERR_ASN1_INVALID_DATA;
+    }
     /* The output raw buffer should be at least twice the size of a raw
      * coordinate in order to store r and s. */
     if (raw_size < coordinate_size * 2) {
diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c
index 0edadd4..9cee43f 100644
--- a/programs/ssl/ssl_fork_server.c
+++ b/programs/ssl/ssl_fork_server.c
@@ -359,8 +359,6 @@
         goto exit;
     }
 
-    exit_code = MBEDTLS_EXIT_SUCCESS;
-
 exit:
     mbedtls_net_free(&client_fd);
     mbedtls_net_free(&listen_fd);
diff --git a/programs/test/udp_proxy.c b/programs/test/udp_proxy.c
index 7213f8a..43d2e8c 100644
--- a/programs/test/udp_proxy.c
+++ b/programs/test/udp_proxy.c
@@ -938,8 +938,6 @@
 
     }
 
-    exit_code = MBEDTLS_EXIT_SUCCESS;
-
 exit:
 
 #ifdef MBEDTLS_ERROR_C
diff --git a/tests/suites/test_suite_bignum.function b/tests/suites/test_suite_bignum.function
index 3d2b8a1..36f1476 100644
--- a/tests/suites/test_suite_bignum.function
+++ b/tests/suites/test_suite_bignum.function
@@ -212,28 +212,22 @@
                       int output_size, int result)
 {
     mbedtls_mpi X;
-    unsigned char buf[1000];
-    size_t buflen;
-
-    memset(buf, 0x00, 1000);
-
     mbedtls_mpi_init(&X);
+    unsigned char *buf = NULL;
 
-    TEST_ASSERT(mbedtls_test_read_mpi(&X, input_X) == 0);
+    TEST_EQUAL(mbedtls_test_read_mpi(&X, input_X), 0);
 
-    buflen = mbedtls_mpi_size(&X);
-    if (buflen > (size_t) output_size) {
-        buflen = (size_t) output_size;
-    }
+    TEST_CALLOC(buf, output_size);
 
-    TEST_ASSERT(mbedtls_mpi_write_binary(&X, buf, buflen) == result);
+    TEST_EQUAL(mbedtls_mpi_write_binary(&X, buf, output_size), result);
+
     if (result == 0) {
-
-        TEST_ASSERT(mbedtls_test_hexcmp(buf, input_A->x,
-                                        buflen, input_A->len) == 0);
+        TEST_EQUAL(mbedtls_test_hexcmp(buf, input_A->x,
+                                       output_size, input_A->len), 0);
     }
 
 exit:
+    mbedtls_free(buf);
     mbedtls_mpi_free(&X);
 }
 /* END_CASE */
@@ -243,28 +237,22 @@
                          int output_size, int result)
 {
     mbedtls_mpi X;
-    unsigned char buf[1000];
-    size_t buflen;
-
-    memset(buf, 0x00, 1000);
-
     mbedtls_mpi_init(&X);
+    unsigned char *buf = NULL;
 
-    TEST_ASSERT(mbedtls_test_read_mpi(&X, input_X) == 0);
+    TEST_EQUAL(mbedtls_test_read_mpi(&X, input_X), 0);
 
-    buflen = mbedtls_mpi_size(&X);
-    if (buflen > (size_t) output_size) {
-        buflen = (size_t) output_size;
-    }
+    TEST_CALLOC(buf, output_size);
 
-    TEST_ASSERT(mbedtls_mpi_write_binary_le(&X, buf, buflen) == result);
+    TEST_EQUAL(mbedtls_mpi_write_binary_le(&X, buf, output_size), result);
+
     if (result == 0) {
-
-        TEST_ASSERT(mbedtls_test_hexcmp(buf, input_A->x,
-                                        buflen, input_A->len) == 0);
+        TEST_EQUAL(mbedtls_test_hexcmp(buf, input_A->x,
+                                       output_size, input_A->len), 0);
     }
 
 exit:
+    mbedtls_free(buf);
     mbedtls_mpi_free(&X);
 }
 /* END_CASE */
diff --git a/tests/suites/test_suite_bignum.misc.data b/tests/suites/test_suite_bignum.misc.data
index c16c689..2e3ff1e 100644
--- a/tests/suites/test_suite_bignum.misc.data
+++ b/tests/suites/test_suite_bignum.misc.data
@@ -92,7 +92,10 @@
 mpi_read_binary_le:"0941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":"24448B952FBBEF93F89286BA330E62528B151EAC265CC8CE3038519D09E148AF89288E91F48B41ACAD55D9DC5E2B18097C106BE4CE132721BF6359EAF403E7FF90623E8866EE5C192320418DAA682F144ADEDF84F25DE11F49D1FE009D374109"
 
 Base test mbedtls_mpi_write_binary #1
-mpi_write_binary:"941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":"0941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":200:0
+mpi_write_binary:"941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":"000000000941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":100:0
+
+Test mbedtls_mpi_write_binary #1 (Buffer is larger)
+mpi_write_binary:"123123123123123123123123123":"000123123123123123123123123123":15:0
 
 Test mbedtls_mpi_write_binary #1 (Buffer just fits)
 mpi_write_binary:"123123123123123123123123123":"0123123123123123123123123123":14:0
@@ -100,8 +103,17 @@
 Test mbedtls_mpi_write_binary #2 (Buffer too small)
 mpi_write_binary:"123123123123123123123123123":"23123123123123123123123123":13:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
 
+Test mbedtls_mpi_write_binary: nonzero to NULL
+mpi_write_binary:"01":"":0:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
+
+Test mbedtls_mpi_write_binary: 0 to NULL
+mpi_write_binary:"00":"":0:0
+
 Base test mbedtls_mpi_write_binary_le #1
-mpi_write_binary_le:"941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":"24448b952fbbef93f89286ba330e62528b151eac265cc8ce3038519d09e148af89288e91f48b41acad55d9dc5e2b18097c106be4ce132721bf6359eaf403e7ff90623e8866ee5c192320418daa682f144adedf84f25de11f49d1fe009d374109":200:0
+mpi_write_binary_le:"941379d00fed1491fe15df284dfde4a142f68aa8d412023195cee66883e6290ffe703f4ea5963bf212713cee46b107c09182b5edcd955adac418bf4918e2889af48e1099d513830cec85c26ac1e158b52620e33ba8692f893efbb2f958b4424":"24448b952fbbef93f89286ba330e62528b151eac265cc8ce3038519d09e148af89288e91f48b41acad55d9dc5e2b18097c106be4ce132721bf6359eaf403e7ff90623e8866ee5c192320418daa682f144adedf84f25de11f49d1fe009d37410900000000":100:0
+
+Test mbedtls_mpi_write_binary_le #1 (Buffer is larger)
+mpi_write_binary_le:"123123123123123123123123123":"233112233112233112233112230100":15:0
 
 Test mbedtls_mpi_write_binary_le #1 (Buffer just fits)
 mpi_write_binary_le:"123123123123123123123123123":"2331122331122331122331122301":14:0
@@ -109,6 +121,12 @@
 Test mbedtls_mpi_write_binary_le #2 (Buffer too small)
 mpi_write_binary_le:"123123123123123123123123123":"23311223311223311223311223":13:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
 
+Test mbedtls_mpi_write_binary_le: nonzero to NULL
+mpi_write_binary_le:"01":"":0:MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL
+
+Test mbedtls_mpi_write_binary_le: 0 to NULL
+mpi_write_binary_le:"00":"":0:0
+
 Base test mbedtls_mpi_read_file #1
 mpi_read_file:"../framework/data_files/mpi_16":"01f55332c3a48b910f9942f6c914e58bef37a47ee45cb164a5b6b8d1006bf59a059c21449939ebebfdf517d2e1dbac88010d7b1f141e997bd6801ddaec9d05910f4f2de2b2c4d714e2c14a72fc7f17aa428d59c531627f09":0
 
diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function
index dbb313b..798be77 100644
--- a/tests/suites/test_suite_ccm.function
+++ b/tests/suites/test_suite_ccm.function
@@ -79,11 +79,11 @@
 void mbedtls_ccm_setkey(int cipher_id, int key_size, int result)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     unsigned char key[32];
     int ret;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
 
     memset(key, 0x2A, sizeof(key));
     TEST_ASSERT((unsigned) key_size <= 8 * sizeof(key));
@@ -101,6 +101,7 @@
 void ccm_lengths(int msg_len, int iv_len, int add_len, int tag_len, int res)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     unsigned char key[16];
     unsigned char msg[10];
     unsigned char iv[14];
@@ -110,7 +111,6 @@
     int decrypt_ret;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
 
     TEST_CALLOC_OR_SKIP(add, add_len);
     memset(key, 0, sizeof(key));
@@ -146,6 +146,7 @@
                       int res)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     unsigned char key[16];
     unsigned char msg[10];
     unsigned char iv[14];
@@ -155,7 +156,6 @@
     int decrypt_ret;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
 
     memset(key, 0, sizeof(key));
     memset(msg, 0, sizeof(msg));
@@ -191,6 +191,7 @@
                                  data_t *add, data_t *result)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     size_t n1, n1_add;
     uint8_t *io_msg_buf = NULL;
     uint8_t *tag_buf = NULL;
@@ -207,7 +208,6 @@
     TEST_CALLOC(tag_buf, expected_tag_len);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     /* Test with input == output */
     TEST_EQUAL(mbedtls_ccm_encrypt_and_tag(&ctx, msg->len, iv->x, iv->len, add->x, add->len,
@@ -248,11 +248,11 @@
                              data_t *msg, data_t *iv, data_t *result)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, msg->len, 0));
@@ -277,6 +277,7 @@
                               data_t *expected_msg)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     size_t n1, n1_add;
 
     const size_t expected_msg_len = msg->len - expected_tag_len;
@@ -290,7 +291,6 @@
     }
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     /* Test with input == output */
     TEST_EQUAL(mbedtls_ccm_auth_decrypt(&ctx, expected_msg_len, iv->x, iv->len, add->x, add->len,
@@ -343,6 +343,7 @@
 {
     unsigned char iv[13];
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     size_t iv_len, expected_tag_len;
     size_t n1, n1_add;
     uint8_t *io_msg_buf = NULL;
@@ -379,7 +380,6 @@
     iv_len = sizeof(iv);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id,
                                   key->x, key->len * 8), 0);
     /* Test with input == output */
@@ -430,6 +430,7 @@
 {
     unsigned char iv[13];
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     size_t iv_len, expected_tag_len;
     size_t n1, n1_add;
 
@@ -460,7 +461,6 @@
     iv_len = sizeof(iv);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_ASSERT(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8) == 0);
     /* Test with input == output */
     TEST_EQUAL(mbedtls_ccm_star_auth_decrypt(&ctx, expected_msg_len, iv, iv_len,
@@ -507,6 +507,7 @@
                          data_t *result, data_t *tag)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
 
@@ -514,7 +515,6 @@
     TEST_EQUAL(msg->len, result->len);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, msg->len, tag->len));
@@ -547,10 +547,10 @@
                              data_t *tag)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, add->len, 0, tag->len));
@@ -577,9 +577,12 @@
                              data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
+
+    /* This test can't be run with empty additional data */
+    TEST_LE_U(1, add->len);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded values for msg length and tag length. They are not a part of this test
@@ -600,9 +603,9 @@
                                data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded values for msg length and tag length. They are not a part of this test
@@ -622,11 +625,11 @@
                                  data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded value for tag length. It is not a part of this test
@@ -651,10 +654,13 @@
                                data_t *key, data_t *iv, data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
 
+    /* This test can't be run with empty additional data */
+    TEST_LE_U(1, add->len);
+
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded values for msg length and tag length. They are not a part of this test
@@ -680,9 +686,9 @@
                                       data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded values for msg length and tag length. They are not a part of this test
@@ -706,13 +712,16 @@
                                             data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t add_second_buffer[2];
 
+    /* This test can't be run with empty additional data */
+    TEST_LE_U(1, add->len);
+
     add_second_buffer[0] = add->x[add->len - 1];
     add_second_buffer[1] = 0xAB; // some magic value
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded values for msg length and tag length. They are not a part of this test
@@ -735,11 +744,14 @@
                                  data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
 
+    /* This test can't be run with an empty message */
+    TEST_LE_U(1, msg->len);
+
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded value for tag length. It is a not a part of this test
@@ -765,11 +777,14 @@
                                    data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
 
+    /* This test can't be run with an empty message */
+    TEST_LE_U(1, msg->len);
+
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded value for tag length. It is not a part of this test
@@ -801,11 +816,11 @@
                                           data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded value for tag length. It is a not a part of this test
@@ -834,15 +849,18 @@
                                             data_t *add)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
     size_t olen;
     uint8_t msg_second_buffer[2];
 
+    /* This test can't be run with an empty message */
+    TEST_LE_U(1, msg->len);
+
     msg_second_buffer[0] = msg->x[msg->len - 1];
     msg_second_buffer[1] = 0xAB; // some magic value
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded value for tag length. It is a not a part of this test
@@ -869,10 +887,10 @@
                                 data_t *key, data_t *iv)
 {
     mbedtls_ccm_context ctx;
+    mbedtls_ccm_init(&ctx);
     uint8_t *output = NULL;
 
     BLOCK_CIPHER_PSA_INIT();
-    mbedtls_ccm_init(&ctx);
     TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0);
     TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len));
     // use hardcoded values for add length, msg length and tag length.
diff --git a/tests/suites/test_suite_ecdsa.function b/tests/suites/test_suite_ecdsa.function
index f16a6d4..d9ff802 100644
--- a/tests/suites/test_suite_ecdsa.function
+++ b/tests/suites/test_suite_ecdsa.function
@@ -196,13 +196,12 @@
 {
     mbedtls_ecp_group grp;
     mbedtls_mpi d, r, s, r_check, s_check;
-
-    MD_PSA_INIT();
-
     mbedtls_ecp_group_init(&grp);
     mbedtls_mpi_init(&d); mbedtls_mpi_init(&r); mbedtls_mpi_init(&s);
     mbedtls_mpi_init(&r_check); mbedtls_mpi_init(&s_check);
 
+    MD_PSA_INIT();
+
     TEST_ASSERT(mbedtls_ecp_group_load(&grp, id) == 0);
     TEST_ASSERT(mbedtls_test_read_mpi(&d, d_str) == 0);
     TEST_ASSERT(mbedtls_test_read_mpi(&r_check, r_str) == 0);
@@ -235,13 +234,13 @@
     unsigned char sig[200];
     size_t sig_len, i;
 
-    MD_PSA_INIT();
-
     mbedtls_ecdsa_init(&ctx);
     memset(&rnd_info, 0x00, sizeof(mbedtls_test_rnd_pseudo_info));
     memset(hash, 0, sizeof(hash));
     memset(sig, 0x2a, sizeof(sig));
 
+    MD_PSA_INIT();
+
     /* generate signing key */
     TEST_ASSERT(mbedtls_ecdsa_genkey(&ctx, id,
                                      &mbedtls_test_rnd_pseudo_rand,
@@ -300,13 +299,13 @@
     unsigned char sig[200];
     size_t sig_len, i;
 
-    MD_PSA_INIT();
-
     mbedtls_ecdsa_init(&ctx);
     memset(&rnd_info, 0x00, sizeof(mbedtls_test_rnd_pseudo_info));
     memset(hash, 0, sizeof(hash));
     memset(sig, 0x2a, sizeof(sig));
 
+    MD_PSA_INIT();
+
     /* prepare material for signature */
     TEST_ASSERT(mbedtls_test_rnd_pseudo_rand(&rnd_info,
                                              hash, sizeof(hash)) == 0);
@@ -436,12 +435,12 @@
     unsigned char sig[MBEDTLS_ECDSA_MAX_LEN];
     size_t slen;
 
-    MD_PSA_INIT();
-
     mbedtls_ecdsa_restart_init(&rs_ctx);
     mbedtls_ecdsa_init(&ctx);
     memset(sig, 0, sizeof(sig));
 
+    MD_PSA_INIT();
+
     TEST_ASSERT(mbedtls_ecp_group_load(&ctx.grp, id) == 0);
     TEST_ASSERT(mbedtls_test_read_mpi(&ctx.d, d_str) == 0);
 
diff --git a/tests/suites/test_suite_ecjpake.function b/tests/suites/test_suite_ecjpake.function
index 177e09a..7f73195 100644
--- a/tests/suites/test_suite_ecjpake.function
+++ b/tests/suites/test_suite_ecjpake.function
@@ -102,6 +102,7 @@
 void ecjpake_invalid_param()
 {
     mbedtls_ecjpake_context ctx;
+    mbedtls_ecjpake_init(&ctx);
     unsigned char buf[42] = { 0 };
     size_t const len = sizeof(buf);
     mbedtls_ecjpake_role invalid_role = (mbedtls_ecjpake_role) 42;
@@ -110,8 +111,6 @@
 
     MD_PSA_INIT();
 
-    mbedtls_ecjpake_init(&ctx);
-
     TEST_EQUAL(MBEDTLS_ERR_ECP_BAD_INPUT_DATA,
                mbedtls_ecjpake_setup(&ctx,
                                      invalid_role,
@@ -139,13 +138,13 @@
 void read_bad_md(data_t *msg)
 {
     mbedtls_ecjpake_context corrupt_ctx;
+    mbedtls_ecjpake_init(&corrupt_ctx);
     const unsigned char *pw = NULL;
     const size_t pw_len = 0;
     int any_role = MBEDTLS_ECJPAKE_CLIENT;
 
     MD_PSA_INIT();
 
-    mbedtls_ecjpake_init(&corrupt_ctx);
     TEST_ASSERT(mbedtls_ecjpake_setup(&corrupt_ctx, any_role,
                                       MBEDTLS_MD_SHA256, MBEDTLS_ECP_DP_SECP256R1, pw,
                                       pw_len) == 0);
@@ -164,13 +163,12 @@
 void read_round_one(int role, data_t *msg, int ref_ret)
 {
     mbedtls_ecjpake_context ctx;
+    mbedtls_ecjpake_init(&ctx);
     const unsigned char *pw = NULL;
     const size_t pw_len = 0;
 
     MD_PSA_INIT();
 
-    mbedtls_ecjpake_init(&ctx);
-
     TEST_ASSERT(mbedtls_ecjpake_setup(&ctx, role,
                                       MBEDTLS_MD_SHA256, MBEDTLS_ECP_DP_SECP256R1, pw,
                                       pw_len) == 0);
@@ -187,13 +185,12 @@
 void read_round_two_cli(data_t *msg, int ref_ret)
 {
     mbedtls_ecjpake_context ctx;
+    mbedtls_ecjpake_init(&ctx);
     const unsigned char *pw = NULL;
     const size_t pw_len = 0;
 
     MD_PSA_INIT();
 
-    mbedtls_ecjpake_init(&ctx);
-
     TEST_ASSERT(mbedtls_ecjpake_setup(&ctx, MBEDTLS_ECJPAKE_CLIENT,
                                       MBEDTLS_MD_SHA256, MBEDTLS_ECP_DP_SECP256R1, pw,
                                       pw_len) == 0);
@@ -216,13 +213,12 @@
 void read_round_two_srv(data_t *msg, int ref_ret)
 {
     mbedtls_ecjpake_context ctx;
+    mbedtls_ecjpake_init(&ctx);
     const unsigned char *pw = NULL;
     const size_t pw_len = 0;
 
     MD_PSA_INIT();
 
-    mbedtls_ecjpake_init(&ctx);
-
     TEST_ASSERT(mbedtls_ecjpake_setup(&ctx, MBEDTLS_ECJPAKE_SERVER,
                                       MBEDTLS_MD_SHA256, MBEDTLS_ECP_DP_SECP256R1, pw,
                                       pw_len) == 0);
diff --git a/tests/suites/test_suite_hmac_drbg.function b/tests/suites/test_suite_hmac_drbg.function
index 0a50c6c..fbe1b03 100644
--- a/tests/suites/test_suite_hmac_drbg.function
+++ b/tests/suites/test_suite_hmac_drbg.function
@@ -41,8 +41,6 @@
     size_t default_entropy_len;
     size_t expected_consumed_entropy = 0;
 
-    MD_PSA_INIT();
-
     mbedtls_hmac_drbg_init(&ctx);
     memset(buf, 0, sizeof(buf));
     memset(out, 0, sizeof(out));
@@ -50,6 +48,8 @@
     entropy.len = sizeof(buf);
     entropy.p = buf;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_alg);
     TEST_ASSERT(md_info != NULL);
     if (mbedtls_md_get_size(md_info) <= 20) {
@@ -129,11 +129,10 @@
 {
     const mbedtls_md_info_t *md_info;
     mbedtls_hmac_drbg_context ctx;
+    mbedtls_hmac_drbg_init(&ctx);
 
     MD_PSA_INIT();
 
-    mbedtls_hmac_drbg_init(&ctx);
-
     md_info = mbedtls_md_info_from_type(md_alg);
     TEST_ASSERT(md_info != NULL);
 
@@ -159,12 +158,12 @@
     mbedtls_hmac_drbg_context ctx;
     size_t i;
 
-    MD_PSA_INIT();
-
     mbedtls_hmac_drbg_init(&ctx);
     memset(buf, 0, sizeof(buf));
     memset(out, 0, sizeof(out));
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_alg);
     TEST_ASSERT(md_info != NULL);
     TEST_ASSERT(mbedtls_hmac_drbg_seed_buf(&ctx, md_info, buf, sizeof(buf)) == 0);
@@ -194,13 +193,13 @@
     const mbedtls_md_info_t *md_info;
     mbedtls_hmac_drbg_context ctx;
 
-    MD_PSA_INIT();
-
     mbedtls_hmac_drbg_init(&ctx);
 
     p_entropy.p = entropy->x;
     p_entropy.len = entropy->len;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_alg);
     TEST_ASSERT(md_info != NULL);
 
@@ -244,13 +243,13 @@
     const mbedtls_md_info_t *md_info;
     mbedtls_hmac_drbg_context ctx;
 
-    MD_PSA_INIT();
-
     mbedtls_hmac_drbg_init(&ctx);
 
     p_entropy.p = entropy->x;
     p_entropy.len = entropy->len;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_alg);
     TEST_ASSERT(md_info != NULL);
 
@@ -279,13 +278,13 @@
     const mbedtls_md_info_t *md_info;
     mbedtls_hmac_drbg_context ctx;
 
-    MD_PSA_INIT();
-
     mbedtls_hmac_drbg_init(&ctx);
 
     p_entropy.p = entropy->x;
     p_entropy.len = entropy->len;
 
+    MD_PSA_INIT();
+
     md_info = mbedtls_md_info_from_type(md_alg);
     TEST_ASSERT(md_info != NULL);
 
diff --git a/tests/suites/test_suite_md.function b/tests/suites/test_suite_md.function
index 2a885e2..4e62154 100644
--- a/tests/suites/test_suite_md.function
+++ b/tests/suites/test_suite_md.function
@@ -21,10 +21,10 @@
     const int *md_type_ptr;
     const mbedtls_md_info_t *info;
     mbedtls_md_context_t ctx;
+    mbedtls_md_init(&ctx);
     unsigned char out[MBEDTLS_MD_MAX_SIZE] = { 0 };
 
     MD_PSA_INIT();
-    mbedtls_md_init(&ctx);
 
     /*
      * Test that mbedtls_md_list() only returns valid MDs.
@@ -87,13 +87,13 @@
 void md_null_args()
 {
     mbedtls_md_context_t ctx;
+    mbedtls_md_init(&ctx);
 #if defined(MBEDTLS_MD_C)
     const mbedtls_md_info_t *info = mbedtls_md_info_from_type(*(mbedtls_md_list()));
 #endif
     unsigned char buf[1] = { 0 };
 
     MD_PSA_INIT();
-    mbedtls_md_init(&ctx);
 
     TEST_EQUAL(0, mbedtls_md_get_size(NULL));
 #if defined(MBEDTLS_MD_C)
@@ -245,12 +245,11 @@
 
     const mbedtls_md_info_t *md_info = NULL;
     mbedtls_md_context_t ctx, ctx_copy;
-
-    MD_PSA_INIT();
-
     mbedtls_md_init(&ctx);
     mbedtls_md_init(&ctx_copy);
 
+    MD_PSA_INIT();
+
     halfway = src_len / 2;
 
     md_info = mbedtls_md_info_from_type(md_type);
@@ -291,13 +290,12 @@
     unsigned char output[MBEDTLS_MD_MAX_SIZE] = { 0 };
     const mbedtls_md_info_t *md_info = NULL;
     mbedtls_md_context_t ctx, ctx_copy;
+    mbedtls_md_init(&ctx);
+    mbedtls_md_init(&ctx_copy);
     int halfway;
 
     MD_PSA_INIT();
 
-    mbedtls_md_init(&ctx);
-    mbedtls_md_init(&ctx_copy);
-
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
     TEST_EQUAL(0, mbedtls_md_setup(&ctx, md_info, 0));
@@ -363,12 +361,11 @@
     unsigned char output[MBEDTLS_MD_MAX_SIZE] = { 0 };
     const mbedtls_md_info_t *md_info = NULL;
     mbedtls_md_context_t ctx;
+    mbedtls_md_init(&ctx);
     int halfway;
 
     MD_PSA_INIT();
 
-    mbedtls_md_init(&ctx);
-
     md_info = mbedtls_md_info_from_type(md_type);
     TEST_ASSERT(md_info != NULL);
     TEST_EQUAL(0, mbedtls_md_setup(&ctx, md_info, 1));
diff --git a/tests/suites/test_suite_pem.function b/tests/suites/test_suite_pem.function
index 413dc55..091cbd1 100644
--- a/tests/suites/test_suite_pem.function
+++ b/tests/suites/test_suite_pem.function
@@ -66,6 +66,7 @@
                              char *pwd, int res, data_t *out)
 {
     mbedtls_pem_context ctx;
+    mbedtls_pem_init(&ctx);
     int ret;
     size_t use_len = 0;
     size_t pwd_len = strlen(pwd);
@@ -73,8 +74,6 @@
 
     MD_PSA_INIT();
 
-    mbedtls_pem_init(&ctx);
-
     ret = mbedtls_pem_read_buffer(&ctx, header, footer, (unsigned char *) data,
                                   (unsigned char *) pwd, pwd_len, &use_len);
     TEST_ASSERT(ret == res);
diff --git a/tests/suites/test_suite_pkcs1_v21.function b/tests/suites/test_suite_pkcs1_v21.function
index 6261979..a15d5d7 100644
--- a/tests/suites/test_suite_pkcs1_v21.function
+++ b/tests/suites/test_suite_pkcs1_v21.function
@@ -14,18 +14,18 @@
 {
     unsigned char output[256];
     mbedtls_rsa_context ctx;
+    mbedtls_rsa_init(&ctx);
     mbedtls_test_rnd_buf_info info;
     mbedtls_mpi N, E;
-
-    MD_PSA_INIT();
+    mbedtls_mpi_init(&N); mbedtls_mpi_init(&E);
 
     info.fallback_f_rng = mbedtls_test_rnd_std_rand;
     info.fallback_p_rng = NULL;
     info.buf = rnd_buf->x;
     info.length = rnd_buf->len;
 
-    mbedtls_mpi_init(&N); mbedtls_mpi_init(&E);
-    mbedtls_rsa_init(&ctx);
+    MD_PSA_INIT();
+
     TEST_ASSERT(mbedtls_rsa_set_padding(&ctx,
                                         MBEDTLS_RSA_PKCS_V21, hash) == 0);
     memset(output, 0x00, sizeof(output));
@@ -66,17 +66,16 @@
 {
     unsigned char output[64];
     mbedtls_rsa_context ctx;
+    mbedtls_rsa_init(&ctx);
     size_t output_len;
     mbedtls_test_rnd_pseudo_info rnd_info;
     mbedtls_mpi N, P, Q, E;
+    mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
+    mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
     ((void) seed);
 
     MD_PSA_INIT();
 
-    mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
-    mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
-
-    mbedtls_rsa_init(&ctx);
     TEST_ASSERT(mbedtls_rsa_set_padding(&ctx,
                                         MBEDTLS_RSA_PKCS_V21, hash) == 0);
 
@@ -131,19 +130,19 @@
 {
     unsigned char output[512];
     mbedtls_rsa_context ctx;
+    mbedtls_rsa_init(&ctx);
     mbedtls_test_rnd_buf_info info;
     mbedtls_mpi N, P, Q, E;
-
-    MD_PSA_INIT();
+    mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
+    mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
 
     info.fallback_f_rng = mbedtls_test_rnd_std_rand;
     info.fallback_p_rng = NULL;
     info.buf = rnd_buf->x;
     info.length = rnd_buf->len;
 
-    mbedtls_mpi_init(&N); mbedtls_mpi_init(&P);
-    mbedtls_mpi_init(&Q); mbedtls_mpi_init(&E);
-    mbedtls_rsa_init(&ctx);
+    MD_PSA_INIT();
+
     TEST_ASSERT(mbedtls_rsa_set_padding(&ctx,
                                         MBEDTLS_RSA_PKCS_V21, hash) == 0);
 
@@ -196,13 +195,13 @@
                              char *salt, data_t *result_str, int result)
 {
     mbedtls_rsa_context ctx;
+    mbedtls_rsa_init(&ctx);
     mbedtls_mpi N, E;
+    mbedtls_mpi_init(&N); mbedtls_mpi_init(&E);
     ((void) salt);
 
     MD_PSA_INIT();
 
-    mbedtls_mpi_init(&N); mbedtls_mpi_init(&E);
-    mbedtls_rsa_init(&ctx);
     TEST_ASSERT(mbedtls_rsa_set_padding(&ctx,
                                         MBEDTLS_RSA_PKCS_V21, hash) == 0);
 
@@ -236,12 +235,12 @@
                                  int result_full)
 {
     mbedtls_rsa_context ctx;
+    mbedtls_rsa_init(&ctx);
     mbedtls_mpi N, E;
+    mbedtls_mpi_init(&N); mbedtls_mpi_init(&E);
 
     MD_PSA_INIT();
 
-    mbedtls_mpi_init(&N); mbedtls_mpi_init(&E);
-    mbedtls_rsa_init(&ctx);
     TEST_ASSERT(mbedtls_rsa_set_padding(&ctx,
                                         MBEDTLS_RSA_PKCS_V21, ctx_hash) == 0);
 
diff --git a/tests/suites/test_suite_pkparse.function b/tests/suites/test_suite_pkparse.function
index 63ff092..942dae3 100644
--- a/tests/suites/test_suite_pkparse.function
+++ b/tests/suites/test_suite_pkparse.function
@@ -114,10 +114,10 @@
 void pk_parse_keyfile_rsa(char *key_file, char *password, int result)
 {
     mbedtls_pk_context ctx;
+    mbedtls_pk_init(&ctx);
     int res;
     char *pwd = password;
 
-    mbedtls_pk_init(&ctx);
     MD_PSA_INIT();
 
     if (strcmp(pwd, "NULL") == 0) {
@@ -161,9 +161,9 @@
 void pk_parse_public_keyfile_rsa(char *key_file, int result)
 {
     mbedtls_pk_context ctx;
+    mbedtls_pk_init(&ctx);
     int res;
 
-    mbedtls_pk_init(&ctx);
     MD_PSA_INIT();
 
     res = mbedtls_pk_parse_public_keyfile(&ctx, key_file);
diff --git a/tests/suites/test_suite_psa_crypto_util.data b/tests/suites/test_suite_psa_crypto_util.data
index c84a836..a0ec9fd 100644
--- a/tests/suites/test_suite_psa_crypto_util.data
+++ b/tests/suites/test_suite_psa_crypto_util.data
@@ -1,3 +1,12 @@
+# mbedtls_ecdsa_der_to_raw() doesn't accept a null output buffer,
+# even with otherwise invalid paramters,
+# so we pass it a (non-null) buffer of length 1.
+ECDSA Raw -> DER, 0bit
+ecdsa_raw_to_der:0:"":"00":MBEDTLS_ERR_ASN1_INVALID_DATA
+
+ECDSA DER -> Raw, 0bit
+ecdsa_der_to_raw:0:"":"":MBEDTLS_ERR_ASN1_INVALID_DATA
+
 ECDSA Raw -> DER, 256bit, Success
 depends_on:PSA_VENDOR_ECC_MAX_CURVE_BITS >= 256
 ecdsa_raw_to_der:256:"11111111111111111111111111111111111111111111111111111111111111112222222222222222222222222222222222222222222222222222222222222222":"30440220111111111111111111111111111111111111111111111111111111111111111102202222222222222222222222222222222222222222222222222222222222222222":0
diff --git a/tests/suites/test_suite_random.function b/tests/suites/test_suite_random.function
index 155b8e7..b58b22f 100644
--- a/tests/suites/test_suite_random.function
+++ b/tests/suites/test_suite_random.function
@@ -22,7 +22,9 @@
 void random_twice_with_ctr_drbg()
 {
     mbedtls_entropy_context entropy;
+    mbedtls_entropy_init(&entropy);
     mbedtls_ctr_drbg_context drbg;
+    mbedtls_ctr_drbg_init(&drbg);
     unsigned char output1[OUTPUT_SIZE];
     unsigned char output2[OUTPUT_SIZE];
 
@@ -34,8 +36,6 @@
 
 
     /* First round */
-    mbedtls_entropy_init(&entropy);
-    mbedtls_ctr_drbg_init(&drbg);
     TEST_EQUAL(0, mbedtls_ctr_drbg_seed(&drbg,
                                         mbedtls_entropy_func, &entropy,
                                         NULL, 0));
@@ -73,7 +73,9 @@
 void random_twice_with_hmac_drbg(int md_type)
 {
     mbedtls_entropy_context entropy;
+    mbedtls_entropy_init(&entropy);
     mbedtls_hmac_drbg_context drbg;
+    mbedtls_hmac_drbg_init(&drbg);
     unsigned char output1[OUTPUT_SIZE];
     unsigned char output2[OUTPUT_SIZE];
     const mbedtls_md_info_t *md_info = mbedtls_md_info_from_type(md_type);
@@ -81,8 +83,6 @@
     MD_PSA_INIT();
 
     /* First round */
-    mbedtls_entropy_init(&entropy);
-    mbedtls_hmac_drbg_init(&drbg);
     TEST_EQUAL(0, mbedtls_hmac_drbg_seed(&drbg, md_info,
                                          mbedtls_entropy_func, &entropy,
                                          NULL, 0));