diff --git a/ChangeLog b/ChangeLog
index acb26e4..43ad0c3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,9 @@
    * Replace preproccessor condition from #if defined(MBEDTLS_THREADING_PTHREAD)
      to #if defined(MBEDTLS_THREADING_C) as the library cannot assume they will
      always be implemented by pthread support. Fix for #696
+   * Fix resource leak on windows platform, in mbedtls_x509_crt_parse_path.
+     In case of failure, when an error occures, goto cleanup.
+     Found by redplait #590
 
 = mbed TLS 1.3.20 branch released 2017-06-21
 
diff --git a/library/x509_crt.c b/library/x509_crt.c
index b6ca74c..8fa63c5 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -1014,7 +1014,10 @@
                                      p, (int) len - 1,
                                      NULL, NULL );
         if( w_ret == 0 )
-            return( POLARSSL_ERR_X509_FILE_IO_ERROR );
+        {
+            ret = POLARSSL_ERR_X509_FILE_IO_ERROR;
+            goto cleanup;
+        }
 
         w_ret = x509_crt_parse_file( chain, filename );
         if( w_ret < 0 )
@@ -1027,6 +1030,7 @@
     if( GetLastError() != ERROR_NO_MORE_FILES )
         ret = POLARSSL_ERR_X509_FILE_IO_ERROR;
 
+cleanup:
     FindClose( hFind );
 #else /* _WIN32 */
     int t_ret;