diff --git a/components/mbedtls/port/sha/esp_sha.c b/components/mbedtls/port/sha/esp_sha.c
index 317292b0f3..0940ed1320 100644
--- a/components/mbedtls/port/sha/esp_sha.c
+++ b/components/mbedtls/port/sha/esp_sha.c
@@ -33,65 +33,69 @@ static const char *TAG = "esp_sha";
 
 void esp_sha(esp_sha_type sha_type, const unsigned char *input, size_t ilen, unsigned char *output)
 {
+    union {
+#if SOC_SHA_SUPPORT_SHA1
+        mbedtls_sha1_context sha1;
+#endif
+#if SOC_SHA_SUPPORT_SHA256
+        mbedtls_sha256_context sha256;
+#endif
+#if SOC_SHA_SUPPORT_SHA384 || SOC_SHA_SUPPORT_SHA512
+        mbedtls_sha512_context sha512;
+#endif
+    } ctx;
+
     int ret;
     assert(input != NULL && output != NULL);
 
 #if SOC_SHA_SUPPORT_SHA1
     if (sha_type == SHA1) {
-        mbedtls_sha1_context *ctx1 = (mbedtls_sha1_context *)malloc(sizeof(mbedtls_sha1_context));
-        assert(ctx1 != NULL);
-        mbedtls_sha1_starts_ret(ctx1);
-        ret = mbedtls_sha1_update_ret(ctx1, input, ilen);
+        mbedtls_sha1_init(&ctx.sha1);
+        mbedtls_sha1_starts_ret(&ctx.sha1);
+        ret = mbedtls_sha1_update_ret(&ctx.sha1, input, ilen);
         assert(ret == 0);
-        ret = mbedtls_sha1_finish_ret(ctx1, output);
+        ret = mbedtls_sha1_finish_ret(&ctx.sha1, output);
         assert(ret == 0);
-        mbedtls_sha1_free(ctx1);
-        free(ctx1);
+        mbedtls_sha1_free(&ctx.sha1);
         return;
     }
 #endif //SOC_SHA_SUPPORT_SHA1
 
 #if SOC_SHA_SUPPORT_SHA256
     if (sha_type == SHA2_256) {
-        mbedtls_sha256_context *ctx256 = (mbedtls_sha256_context *)malloc(sizeof(mbedtls_sha256_context));
-        assert(ctx256 != NULL);
-        mbedtls_sha256_starts_ret(ctx256, 0);
-        ret = mbedtls_sha256_update_ret(ctx256, input, ilen);
+        mbedtls_sha256_init(&ctx.sha256);
+        mbedtls_sha256_starts_ret(&ctx.sha256, 0);
+        ret = mbedtls_sha256_update_ret(&ctx.sha256, input, ilen);
         assert(ret == 0);
-        ret = mbedtls_sha256_finish_ret(ctx256, output);
+        ret = mbedtls_sha256_finish_ret(&ctx.sha256, output);
         assert(ret == 0);
-        mbedtls_sha256_free(ctx256);
-        free(ctx256);
+        mbedtls_sha256_free(&ctx.sha256);
         return;
     }
 #endif //SOC_SHA_SUPPORT_SHA256
 
 #if SOC_SHA_SUPPORT_SHA384
     if (sha_type == SHA2_384) {
-        mbedtls_sha512_context *ctx384 = (mbedtls_sha512_context *)malloc(sizeof(mbedtls_sha512_context));
-        assert(ctx384 != NULL);
-        mbedtls_sha512_starts_ret(ctx384, 1);
-        ret = mbedtls_sha512_update_ret(ctx384, input, ilen);
+        mbedtls_sha512_init(&ctx.sha512);
+        mbedtls_sha512_starts_ret(&ctx.sha512, 1);
+        ret = mbedtls_sha512_update_ret(&ctx.sha512, input, ilen);
         assert(ret == 0);
-        ret = mbedtls_sha512_finish_ret(ctx384, output);
+        ret = mbedtls_sha512_finish_ret(&ctx.sha512, output);
         assert(ret == 0);
-        mbedtls_sha512_free(ctx384);
-        free(ctx384);
+        mbedtls_sha512_free(&ctx.sha512);
         return;
     }
 #endif //SOC_SHA_SUPPORT_SHA384
 
 #if SOC_SHA_SUPPORT_SHA512
     if (sha_type == SHA2_512) {
-        mbedtls_sha512_context *ctx512 = (mbedtls_sha512_context *)malloc(sizeof(mbedtls_sha512_context));
-        assert(ctx512 != NULL);
-        mbedtls_sha512_starts_ret(ctx512, 0);
-        ret = mbedtls_sha512_update_ret(ctx512, input, ilen);
+        mbedtls_sha512_init(&ctx.sha512);
+        mbedtls_sha512_starts_ret(&ctx.sha512, 0);
+        ret = mbedtls_sha512_update_ret(&ctx.sha512, input, ilen);
         assert(ret == 0);
-        ret = mbedtls_sha512_finish_ret(ctx512, output);
+        ret = mbedtls_sha512_finish_ret(&ctx.sha512, output);
         assert(ret == 0);
-        mbedtls_sha512_free(ctx512);
-        free(ctx512);
+        mbedtls_sha512_free(&ctx.sha512);
         return;
     }
 #endif //SOC_SHA_SUPPORT_SHA512