diff --git a/library/pem.c b/library/pem.c
index a111970..3f01d3b 100644
--- a/library/pem.c
+++ b/library/pem.c
@@ -463,7 +463,7 @@
          * mismatches. */
         ret = pem_check_pkcs_padding(buf, len, &len);
         if (ret != 0) {
-            mbedtls_free(buf);
+            mbedtls_zeroize_and_free(buf, len);
             return ret;
         }