diff --git a/Makefile.am b/Makefile.am
index 00baf7f8e..2c98058e8 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -53,6 +53,10 @@ include tests/include.am
 include sslSniffer/sslSnifferTest/include.am
 include rpm/include.am
 
+if USE_VALGRIND
+TESTS_ENVIRONMENT=./valgrind-error.sh
+endif
+
 TESTS += $(check_PROGRAMS)
 test: check
 
diff --git a/configure.ac b/configure.ac
index ab8cc58b7..1ba6cec60 100644
--- a/configure.ac
+++ b/configure.ac
@@ -649,6 +649,26 @@ then
 fi
 
 
+#valgrind
+AC_ARG_ENABLE(valgrind,
+    [  --enable-valgrind       Enable valgrind for unit tests (default: disabled)],
+    [ ENABLED_VALGRIND=$enableval ],
+    [ ENABLED_VALGRIND=no ]
+    )
+
+if test "$ENABLED_VALGRIND" = "yes"
+then
+    AC_CHECK_PROG(HAVE_VALGRIND,valgrind,yes,no)
+
+    if [["$HAVE_VALGRIND" = "no" ]]; then
+        AC_MSG_ERROR([Valgrind not found.])
+    fi
+    enable_shared=no
+fi
+
+AM_CONDITIONAL([USE_VALGRIND], [test "x$ENABLED_VALGRIND" = "xyes"])
+
+
 # Test certs, use internal cert functions for extra testing 
 AC_ARG_ENABLE(testcert,
     [  --enable-testcert       Enable Test Cert (default: disabled)],
diff --git a/src/ssl.c b/src/ssl.c
index 49c99cbb9..287525b44 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -1481,10 +1481,15 @@ int ProcessFile(CYASSL_CTX* ctx, const char* fname, int format, int type,
     int    dynamic = 0;
     int    ret;
     long   sz = 0;
-    XFILE  file = XFOPEN(fname, "rb"); 
+    XFILE  file; 
+    void*  heapHint = ctx ? ctx->heap : NULL;
 
     (void)crl;
+    (void)heapHint;
 
+    if (fname == NULL) return SSL_BAD_FILE;
+
+    file = XFOPEN(fname, "rb"); 
     if (file == XBADFILE) return SSL_BAD_FILE;
     XFSEEK(file, 0, XSEEK_END);
     sz = XFTELL(file);
@@ -1492,7 +1497,7 @@ int ProcessFile(CYASSL_CTX* ctx, const char* fname, int format, int type,
 
     if (sz > (long)sizeof(staticBuffer)) {
         CYASSL_MSG("Getting dynamic buffer");
-        myBuffer = (byte*) XMALLOC(sz, ctx->heap, DYNAMIC_TYPE_FILE);
+        myBuffer = (byte*)XMALLOC(sz, heapHint, DYNAMIC_TYPE_FILE);
         if (myBuffer == NULL) {
             XFCLOSE(file);
             return SSL_BAD_FILE;
@@ -1515,7 +1520,7 @@ int ProcessFile(CYASSL_CTX* ctx, const char* fname, int format, int type,
     }
 
     XFCLOSE(file);
-    if (dynamic) XFREE(myBuffer, ctx->heap, DYNAMIC_TYPE_FILE);
+    if (dynamic) XFREE(myBuffer, heapHint, DYNAMIC_TYPE_FILE);
 
     return ret;
 }
diff --git a/tests/api.c b/tests/api.c
index b0e822742..a38e11d7f 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -744,6 +744,10 @@ void test_client_nofail(void* args)
         printf("Server response: %s\n", reply);
     }
 
+    CyaSSL_free(ssl);
+    CyaSSL_CTX_free(ctx);
+    
+    CloseSocket(sockfd);
     ((func_args*)args)->return_code = TEST_SUCCESS;
     return;
 }
diff --git a/valgrind-error.sh b/valgrind-error.sh
new file mode 100755
index 000000000..7f7441c3e
--- /dev/null
+++ b/valgrind-error.sh
@@ -0,0 +1,22 @@
+#!/bin/sh
+#
+#
+# Our valgrind "error" wrapper.
+
+valgrind --leak-check=full -q "$@" 2> valgrind.tmp
+
+result="$?"
+
+# verify no errors
+
+output="`cat valgrind.tmp`"
+
+if [ "$output" != "" ]; then
+    cat valgrind.tmp >&2
+    result=1
+fi
+
+rm valgrind.tmp
+
+exit $result
+