diff --git a/configure.ac b/configure.ac
index 976478b4e..b673c346a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2545,6 +2545,44 @@ AC_SUBST([IPPLINK])
 AM_CONDITIONAL([BUILD_FAST_RSA], [test "x$ENABLED_FAST_RSA" = "xyes"])
 
 
+# static memory use
+AC_ARG_ENABLE([staticmemory],
+    [AS_HELP_STRING([--enable-staticmemory],[Enable static memory use (default: disabled)])],
+    [ ENABLED_STATICMEMORY=$enableval ],
+    [ ENABLED_STATICMEMORY=no ]
+    )
+
+if test "x$ENABLED_STATICMEMORY" = "xyes"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY -DWOLFSSL_STATIC_MEMORY_MEDIUM"
+fi
+
+if test "x$ENABLED_STATICMEMORY" = "xnone"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY"
+fi
+
+if test "x$ENABLED_STATICMEMORY" = "xsmall"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY -DWOLFSSL_STATIC_MEMORY_SMALL"
+fi
+
+if test "x$ENABLED_STATICMEMORY" = "xmedium"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY -DWOLFSSL_STATIC_MEMORY_MEDIUM"
+fi
+
+if test "x$ENABLED_STATICMEMORY" = "xlarge"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY -DWOLFSSL_STATIC_MEMORY_LARGE"
+fi
+
+if test "x$ENABLED_STATICMEMORY" = "xhuge"
+then
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_STATIC_MEMORY -DWOLFSSL_STATIC_MEMORY_HUGE"
+fi
+
+
 # microchip api
 AC_ARG_ENABLE([mcapi],
     [  --enable-mcapi          Enable Microchip API (default: disabled)],
diff --git a/examples/client/client.c b/examples/client/client.c
index 1cc937ca7..1f61a26a6 100644
--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -1653,10 +1653,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
         args.argc = argc;
         args.argv = argv;
 
-        wolfSSL_Init();
 #if defined(DEBUG_WOLFSSL) && !defined(WOLFSSL_MDK_SHELL) && !defined(STACK_TRAP)
         wolfSSL_Debugging_ON();
 #endif
+        wolfSSL_Init();
         ChangeToWolfRoot();
 
 #ifdef HAVE_STACK_SIZE
diff --git a/examples/server/server.c b/examples/server/server.c
index f6e1006c7..f435e6857 100644
--- a/examples/server/server.c
+++ b/examples/server/server.c
@@ -1048,10 +1048,10 @@ THREAD_RETURN CYASSL_THREAD server_test(void* args)
         args.signal = &ready;
         InitTcpReady(&ready);
 
-        CyaSSL_Init();
 #if defined(DEBUG_CYASSL) && !defined(WOLFSSL_MDK_SHELL)
         CyaSSL_Debugging_ON();
 #endif
+        CyaSSL_Init();
         ChangeToWolfRoot();
 
 #ifdef HAVE_STACK_SIZE
diff --git a/wolfcrypt/src/memory.c b/wolfcrypt/src/memory.c
index 865022923..3cd9fcb0e 100644
--- a/wolfcrypt/src/memory.c
+++ b/wolfcrypt/src/memory.c
@@ -38,8 +38,9 @@
 
 #include <wolfssl/wolfcrypt/memory.h>
 #include <wolfssl/wolfcrypt/error-crypt.h>
+#include <wolfssl/wolfcrypt/logging.h>
 
-#ifdef WOLFSSL_MALLOC_CHECK
+#if defined(WOLFSSL_MALLOC_CHECK) || defined(WOLFSSL_TRACK_MEMORY_FULL)
     #include <stdio.h>
 #endif
 
@@ -96,7 +97,7 @@ void* wolfSSL_Malloc(size_t size)
         if (res == NULL)
             puts("wolfSSL_malloc failed");
     #endif
-                
+
     return res;
 }
 
@@ -140,6 +141,544 @@ void* wolfSSL_Realloc(void *ptr, size_t size)
     return res;
 }
 
+#ifdef WOLFSSL_STATIC_MEMORY
+
+typedef struct wc_Memory {
+    word32 sz;
+    byte*  buffer;
+    byte   kill;
+    struct wc_Memory* next;
+} wc_Memory;
+#if WC_STATIC_ALIGN < 10
+    #error Alignment is less than wc_Memory struct
+#endif
+
+/* size of chunks of memory to seperate into */
+#define WC_MAX_BUCKETS 9
+static word32 bucket[] = { 64, 128, 256, 512, 1024, 2400, 3408, 4544, 16000 };
+static word32 bucketDist[] = { 8, 4, 4, 12, 4, 5, 2, 1, 1 };
+static wc_Memory* available[WC_MAX_BUCKETS];
+static word32 inUse = 0; /* amount of static memory in use by wolfSSL */
+static byte   useStaticMemory = 1;
+static volatile byte   createMutex = 1;
+static wolfSSL_Mutex memory_mutex;
+
+
+/* returns amount of memory used on success. On error returns negative value
+   wc_Memory** list is the list that new buckets are prepended to
+ */
+static int create_memory_buckets(byte* buffer, word32 bufSz,
+                              word32 buckSz, word32 buckNum, wc_Memory** list) {
+    word32 i;
+    byte*  pt  = buffer;
+    int    ret = 0;
+
+    /* if not enough space available for bucket size then do not try */
+    if (buckSz + WC_STATIC_ALIGN > bufSz) {
+        return ret;
+    }
+
+    if (LockMutex(&memory_mutex) != 0) {
+        return BAD_MUTEX_E;
+    }
+
+    for (i = 0; i < buckNum; i++) {
+        if ((buckSz + WC_STATIC_ALIGN) <= (bufSz - ret)) {
+            /* create a new struct and set its values */
+            wc_Memory* mem = (struct wc_Memory*)pt;
+            mem->sz = buckSz;
+            mem->buffer = (byte*)pt + WC_STATIC_ALIGN;
+            mem->kill = 0;
+            mem->next = NULL;
+
+            /* add the newly created struct to front of list */
+            if (*list == NULL) {
+                *list = mem;
+            } else {
+                mem->next = *list;
+                *list = mem;
+            }
+
+            /* advance pointer and keep track of memory used */
+            ret += buckSz + WC_STATIC_ALIGN;
+            pt  += WC_STATIC_ALIGN + buckSz;
+        }
+        else {
+            break; /* not enough space left for more buckets of this size */
+        }
+    }
+
+    UnLockMutex(&memory_mutex);
+
+    return ret;
+}
+
+
+
+/* Starts at left most address and free until either used memory is encounterd
+   or end of buffer is.
+   Returns amount of buffer freed on success and a negative value on fail.
+ */
+int wolfSSL_unload_static_memory(byte* buffer, word32 sz, word32* amt)
+{
+    wc_Memory* cur = NULL;
+    wc_Memory* fre = NULL;
+    wc_Memory* prv = NULL;
+    int i;
+    word32 idx = 0;
+
+    WOLFSSL_ENTER("wolfSSL_unload_static_memory");
+
+    if (buffer == NULL || sz == 0 || amt == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    if (LockMutex(&memory_mutex) != 0) {
+        return BAD_MUTEX_E;
+    }
+
+    /* too small of memory to be placed as a bucket */
+    if (sz < bucket[0] + WC_STATIC_ALIGN) {
+        *amt = sz;
+        return 1;
+    }
+
+    /* advance past alignment padding */
+    while ((word64)(buffer + idx) % WC_STATIC_ALIGN && idx < sz) { idx++; }
+
+    /* buffer should be already divided up into wc_Memory structs */
+    while (idx < (sz - bucket[0] - WC_STATIC_ALIGN)) {
+        cur = (struct wc_Memory*)(buffer + idx);
+        prv = NULL;
+
+        for (i = 0; i < WC_MAX_BUCKETS; i++) {
+            if (bucket[i] >= cur->sz) break;
+        }
+        fre = available[i];
+
+        /* find the matching address of the memory in available stack */
+        while (fre != NULL && (cur != fre)) {
+            prv = fre;
+            fre = fre->next;
+        }
+
+        if (fre == NULL) {
+            WOLFSSL_MSG("Could not find static memory address to free");
+            break;
+        }
+
+        /* fix linked list to jump over the link to free */
+        if (prv) {
+            prv->next = fre->next;
+        }
+
+        /* case if memory is head of stack */
+        if (available[i] == fre) {
+            available[i] = fre->next;
+        }
+
+        idx += WC_STATIC_ALIGN + fre->sz;
+        fre = NULL;
+    }
+
+    UnLockMutex(&memory_mutex);
+
+    /* account for some left over memory that could not be used for a bucket */
+    if (idx > (sz - (bucket[0] + WC_STATIC_ALIGN))) {
+        *amt = sz; /* all posssible was freed */
+        return 1;
+    }
+    else {
+        *amt = idx;
+        return 0;
+    }
+}
+
+
+int wolfSSL_load_static_memory(byte* buffer, word32 sz)
+{
+    word32 ava = sz;
+    byte*  pt  = buffer;
+    int    ret = 0;
+
+    #ifdef WOLFSSL_TRACK_MEMORY_FULL
+        word32 created_buckets[WC_MAX_BUCKETS];
+        int    j;
+        XMEMSET(created_buckets, 0, sizeof(created_buckets));
+    #endif
+
+    WOLFSSL_ENTER("wolfSSL_load_static_memory");
+
+    if (buffer == NULL) {
+        return BAD_FUNC_ARG;
+    }
+
+    #ifdef WOLFSSL_TRACK_MEMORY_FULL
+        printf("\t%u bytes passed in\n", sz);
+        printf("\tAddress %p - %p\n", buffer, buffer + sz);
+    #endif
+
+    /* align pt */
+    while ((word64)pt % WC_STATIC_ALIGN && pt < (buffer + sz)) {
+        *pt = 0x00;
+        pt++;
+    }
+
+    if (createMutex) {
+        if (InitMutex(&memory_mutex) != 0) {
+            WOLFSSL_MSG("Bad mutex init");
+            return BAD_MUTEX_E;
+        }
+        createMutex = 0;
+    }
+
+    /* devide into chunks of memory and add them to available list */
+    while (ava >= (bucket[0] + WC_STATIC_ALIGN)) {
+        int i;
+        /* start at largest and move to smaller buckets */
+        for (i = (WC_MAX_BUCKETS - 1); i >= 0; i--) {
+            if ((bucket[i] + WC_STATIC_ALIGN) <= ava) {
+                if ((ret = create_memory_buckets(pt, ava,
+                               bucket[i], bucketDist[i], &available[i])) < 0) {
+                    WOLFSSL_LEAVE("wolfSSL_load_static_memory", ret);
+                    return ret;
+                }
+                #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                /* if defined keep track of buckets created for printing stats*/
+                    for (j = 0; (j + bucket[i] + WC_STATIC_ALIGN) <=(word32)ret;
+                                             j += bucket[i] + WC_STATIC_ALIGN) {
+                        created_buckets[i]++;
+                    }
+                #endif
+
+                /* advance pointer in buffer for next buckets and keep track
+                   of how much memory is left available */
+                pt  += ret;
+                ava -= ret;
+            }
+        }
+    }
+
+    #ifdef WOLFSSL_TRACK_MEMORY_FULL
+    /* if defined print out stats of number of buckets created */
+        printf("Created Memory Buckets :\n");
+        for (j = 0; j < WC_MAX_BUCKETS; j++) {
+            printf("Created %d\tof bucket size %d\n", created_buckets[j],
+                                                                    bucket[j]);
+        }
+    #endif
+
+    return 1;
+}
+
+
+int wolfSSL_use_static_memory(byte flag)
+{
+
+    WOLFSSL_ENTER("wolfSSL_use_static_memory");
+
+    useStaticMemory = flag;
+
+    return 0;
+}
+
+
+word32 wolfSSL_static_memory_inUse()
+{
+
+    WOLFSSL_ENTER("wolfSSL_static_memory_inUse");
+
+    return inUse;
+}
+
+
+void* wolfSSL_Malloc_Static(size_t size)
+{
+    void* res = 0;
+    wc_Memory* pt = NULL;
+    int   i;
+
+    if (useStaticMemory == 0) {
+        pt = malloc(size + WC_STATIC_ALIGN);
+        pt->buffer = (byte*)pt + WC_STATIC_ALIGN;
+        pt->sz     = (word32)size;
+        pt->kill   = 1;
+        pt->next   = NULL;
+        res = pt->buffer;
+    }
+    else {
+
+        if (LockMutex(&memory_mutex) != 0) {
+            WOLFSSL_MSG("Bad memory_mutex lock");
+            return NULL;
+        }
+
+        for (i = 0; i < WC_MAX_BUCKETS; i++) {
+            if ((word32)size < bucket[i]) {
+                if (available[i] != NULL) {
+                    pt = available[i];
+                    available[i] = pt->next;
+                    res = pt->buffer;
+                    inUse += pt->sz + WC_STATIC_ALIGN;
+                #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                    printf("used bucket at address %p size of %d for size"
+                           " req %d\n", res, bucket[i], (word32)size);
+                #endif
+                    break;
+                }
+            }
+        }
+
+        UnLockMutex(&memory_mutex);
+
+        /* case when no memory size is available */
+        if (pt == NULL) {
+
+            #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                {
+                    int k, j;
+                    printf("\tRequested size %lu\n\tAvailable memory "
+                            "buckets\n", size);
+                    for (k = 0; k < WC_MAX_BUCKETS; k++) {
+                        pt = available[k];
+                        j = 0;
+                        while (pt) {
+                            j++;
+                            pt = pt->next;
+                        }
+                        printf("\t%d of bucket %d\n", j, bucket[k]);
+                    }
+                }
+            #endif
+
+            /* check if too large and never going to get memory needed */
+            if ((word32)size > bucket[WC_MAX_BUCKETS-1]) {
+                WOLFSSL_MSG("Size of malloc is too large");
+                return NULL;
+            }
+
+            /* wait then try again if set to */
+            if (WOLFSSL_STATIC_TIMEOUT > 0) {
+                WOLFSSL_MSG("Waiting for available memory bucket");
+                XSLEEP(WOLFSSL_STATIC_TIMEOUT);
+
+
+                if (LockMutex(&memory_mutex) != 0) {
+                    WOLFSSL_MSG("Bad memory_mutex lock");
+                    return NULL;
+                }
+
+                for (i = 0; i < WC_MAX_BUCKETS; i++) {
+                    if ((word32)size < bucket[i]) {
+                        if (available[i] != NULL) {
+                            pt = available[i];
+                            available[i] = pt->next;
+                            res = pt->buffer;
+                            inUse += pt->sz + WC_STATIC_ALIGN;
+                        #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                            printf("used bucket at address %p size of %d"
+                                   " for size req %d\n", res, bucket[i],
+                                   (word32)size);
+                        #endif
+                            break;
+                        }
+                    }
+                }
+
+                UnLockMutex(&memory_mutex);
+            }
+
+            if (pt == NULL) {
+                WOLFSSL_MSG("No available memory bucket");
+            }
+        }
+    }
+
+    #ifdef WOLFSSL_MALLOC_CHECK
+        if (res == NULL)
+            puts("wolfSSL_malloc failed");
+    #endif
+
+    (void)i;
+    (void)pt;
+
+    return res;
+}
+
+void wolfSSL_Free_Static(void *ptr)
+{
+    int i;
+    wc_Memory* pt;
+
+    if (ptr) {
+        /* get memory struct and add it to available list */
+        pt = (wc_Memory*)((byte*)ptr - WC_STATIC_ALIGN);
+
+        if (pt->kill) {
+            free(pt);
+        }
+        else {
+            LockMutex(&memory_mutex);
+
+            for (i = 0; i < WC_MAX_BUCKETS; i++) {
+                if (pt->sz == bucket[i]) {
+                    inUse -= WC_STATIC_ALIGN + pt->sz;
+                    pt->next = available[i];
+                    available[i] = pt;
+                    #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                        printf("\tfreed %p bucket size of %d\n"
+                                                            ,pt, bucket[i]);
+                    #endif
+                    break;
+                }
+            }
+            UnLockMutex(&memory_mutex);
+        }
+    }
+
+    (void)i;
+    (void)pt;
+}
+
+
+void* wolfSSL_Realloc_Static(void *ptr, size_t size)
+{
+    void* res = 0;
+    wc_Memory* pt = NULL;
+    int   i;
+
+    if (useStaticMemory == 0) {
+        pt = realloc(ptr, size + WC_STATIC_ALIGN);
+        pt->buffer = (byte*)pt + WC_STATIC_ALIGN;
+        pt->sz     = (word32)size;
+        pt->kill   = 1;
+        pt->next   = NULL;
+        res = pt->buffer;
+    }
+    else {
+
+        if (LockMutex(&memory_mutex) != 0) {
+            WOLFSSL_MSG("Bad memory_mutex lock");
+            return NULL;
+        }
+
+        for (i = 0; i < WC_MAX_BUCKETS; i++) {
+            if ((word32)size < bucket[i]) {
+                if (available[i] != NULL) {
+                    word32 prvSz;
+
+                    pt = available[i];
+                    available[i] = pt->next;
+                    res = pt->buffer;
+
+                    /* copy over original information and free ptr */
+                    prvSz = ((wc_Memory*)((byte*)ptr -WC_STATIC_ALIGN))->sz;
+                    prvSz = (prvSz > bucket[i])? bucket[i]: prvSz;
+                    XMEMCPY(pt->buffer, ptr, prvSz);
+
+                    /* free memory that was previously being used */
+                    UnLockMutex(&memory_mutex);
+                    wolfSSL_Free_Static(ptr);
+                    if (LockMutex(&memory_mutex) != 0) {
+                        WOLFSSL_MSG("Bad memory_mutex lock");
+                        return NULL;
+                    }
+
+                    inUse += pt->sz + WC_STATIC_ALIGN;
+                #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                    printf("realloc used a bucket of %d for size req %d\n",
+                                                   bucket[i], (word32)size);
+                #endif
+                    break;
+                }
+            }
+        }
+
+        UnLockMutex(&memory_mutex);
+
+        /* case when no memory size is available */
+        if (pt == NULL) {
+
+            #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                {
+                    int k, j;
+                    printf("\tRequested size %lu\n\tAvailable memory "
+                            "buckets\n", size);
+                    for (k = 0; k < WC_MAX_BUCKETS; k++) {
+                        pt = available[k];
+                        j = 0;
+                        while (pt) {
+                            j++;
+                            pt = pt->next;
+                        }
+                        printf("\t%d of bucket %d\n", j, bucket[k]);
+                    }
+                }
+            #endif
+
+            /* check if too large and never going to get memory needed */
+            if ((word32)size > bucket[WC_MAX_BUCKETS-1]) {
+                WOLFSSL_MSG("Size of malloc is too large");
+                return NULL;
+            }
+
+            if (WOLFSSL_STATIC_TIMEOUT > 0) {
+                WOLFSSL_MSG("Waiting for available memory bucket");
+                XSLEEP(WOLFSSL_STATIC_TIMEOUT);
+
+                if (LockMutex(&memory_mutex) != 0) {
+                    WOLFSSL_MSG("Bad memory_mutex lock");
+                    return NULL;
+                }
+
+                for (i = 0; i < WC_MAX_BUCKETS; i++) {
+                    if ((word32)size < bucket[i]) {
+                        if (available[i] != NULL) {
+                            word32 prvSz;
+
+                            pt = available[i];
+                            available[i] = pt->next;
+                            res = pt->buffer;
+
+                            /* copy over original information and free ptr*/
+                            prvSz = ((wc_Memory*)((byte*)ptr -
+                                                      WC_STATIC_ALIGN))->sz;
+                            prvSz = (prvSz > bucket[i])? bucket[i]: prvSz;
+                            XMEMCPY(pt->buffer, ptr, prvSz);
+
+                            /* free memory that was previously being used */
+                            UnLockMutex(&memory_mutex);
+                            wolfSSL_Free_Static(ptr);
+                            if (LockMutex(&memory_mutex) != 0) {
+                                WOLFSSL_MSG("Bad memory_mutex lock");
+                                return NULL;
+                            }
+
+                            inUse += pt->sz + WC_STATIC_ALIGN;
+                        #ifdef WOLFSSL_TRACK_MEMORY_FULL
+                            printf("realloc used a bucket of %d for size"
+                                   " req %d\n", bucket[i], (word32)size);
+                        #endif
+                            break;
+                        }
+                    }
+                }
+                UnLockMutex(&memory_mutex);
+            }
+
+            if (pt == NULL) {
+                WOLFSSL_MSG("No available memory bucket");
+            }
+        }
+    }
+
+    (void)i;
+    (void)pt;
+
+    return res;
+}
+#endif /* WOLFSSL_STATIC_MEMORY */
+
 #endif /* USE_WOLFSSL_MEMORY */
 
 
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 9f8e2f7b9..ec5ec4149 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -40,6 +40,30 @@
     #pragma warning(disable: 4996)
 #endif
 
+#ifdef WOLFSSL_STATIC_MEMORY
+#if defined(WOLFSSL_STATIC_MEMORY_SMALL)
+static byte wc_staticMemory[54833];
+/* peak of one connection (10 concurent connections) plus 41 chunks of 64 byte
+   for structs */
+#elif defined(WOLFSSL_STATIC_MEMORY_MEDIUM)
+static byte wc_staticMemory[941888];
+/* peak of one connection (520 concurent connections) plus 41 chunks of 64 byte
+   for structs */
+#elif defined(WOLFSSL_STATIC_MEMORY_LARGE)
+static byte wc_staticMemory[1860992];
+/* peak of one connection (1040 concurent connections) plus 41 chunks of 64 byte
+   for structs */
+#elif defined(WOLFSSL_STATIC_MEMORY_HUGE)
+static byte wc_staticMemory[3699200];
+/* peak of one connection (1040 concurent connections) plus 41 chunks of 64 byte
+   for structs */
+#else
+static byte wc_staticMemory[0];
+#endif
+#endif /* WOLFSSL_STATIC_MEMORY */
+
+/* prevent multiple mutex initializations */
+static volatile int initRefCount = 0;
 
 /* Used to initialize state for wolfcrypt
    return 0 on success
@@ -47,6 +71,8 @@
 int wolfCrypt_Init()
 {
     int ret = 0;
+
+    if (initRefCount == 0) {
     #if WOLFSSL_CRYPT_HW_MUTEX
         /* If crypto hardware mutex protection is enabled, then initialize it */
         wolfSSL_CryptHwMutexInit();
@@ -65,6 +91,19 @@ int wolfCrypt_Init()
         }
     #endif
 
+    #ifdef WOLFSSL_STATIC_MEMORY
+        /* set static memory functions and load initial memory */
+        wolfSSL_SetAllocators(wolfSSL_Malloc_Static, wolfSSL_Free_Static,
+                                                        wolfSSL_Realloc_Static);
+        if (wolfSSL_load_static_memory(wc_staticMemory,
+                                                sizeof(wc_staticMemory)) != 1) {
+            WOLFSSL_MSG("Error setting up static memory");
+            ret = WC_INIT_E;
+        }
+    #endif
+        initRefCount = 1;
+    }
+
     return ret;
 }
 
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index 559b34eec..3f13d7be4 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -84,6 +84,10 @@
 #ifdef HAVE_FIPS
     #include <wolfssl/wolfcrypt/fips_test.h>
 #endif
+#if defined(WOLFSSL_STATIC_MEMORY)
+    #define USE_CERT_BUFFERS_1024 /* avoid dynamic memory from fopen */
+    #include <wolfssl/wolfcrypt/memory.h>
+#endif
 
 #ifdef _MSC_VER
     /* 4996 warning to use MS extensions e.g., strcpy_s instead of strncpy */
@@ -224,6 +228,9 @@ int  certext_test(void);
 #ifdef HAVE_IDEA
 int idea_test(void);
 #endif
+#ifdef WOLFSSL_STATIC_MEMORY
+    int memory_test(void);
+#endif
 
 /* General big buffer size for many tests. */
 #define FOURK_BUF 4096
@@ -260,11 +267,12 @@ static void myFipsCb(int ok, int err, const char* hash)
 
 #endif /* HAVE_FIPS */
 
-
 int wolfcrypt_test(void* args)
 {
     int ret = 0;
 
+    wolfCrypt_Init();
+
     ((func_args*)args)->return_code = -1; /* error state */
 
 #if defined(USE_WOLFSSL_MEMORY) && defined(WOLFSSL_TRACK_MEMORY)
@@ -288,6 +296,13 @@ int wolfcrypt_test(void* args)
 #endif /* USE_FAST_MATH */
 #endif /* !NO_BIG_INT */
 
+#ifdef WOLFSSL_STATIC_MEMORY
+    if ( (ret = memory_test()) != 0)
+        return err_sys("MEMORY   test failed!\n", ret);
+    else
+        printf( "MEMORY   test passed!\n");
+#endif
+
 #ifndef NO_MD5
     if ( (ret = md5_test()) != 0)
         return err_sys("MD5      test failed!\n", ret);
@@ -679,6 +694,55 @@ static int OpenNitroxDevice(int dma_mode,int dev_id)
 #endif /* NO_MAIN_DRIVER */
 
 
+#ifdef WOLFSSL_STATIC_MEMORY
+int memory_test()
+{
+    byte buf[320];
+    byte *pt;
+    const char msg[] = "Hello wolfSSL";
+    const char msg2[] = "Hello wolfSSL in Bozeman, Montana";
+    int ret;
+    word32 amt;
+
+    XMEMSET(buf, 0, sizeof(buf));
+
+    ret = wolfSSL_load_static_memory(buf, sizeof(buf));
+    if (ret != 1) {
+        return -511;
+    }
+
+    pt = (byte*)XMALLOC(sizeof(msg), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (pt == NULL) {
+        return -512;
+    }
+
+    if (wolfSSL_static_memory_inUse() <= sizeof(msg)) {
+        return -513;
+    }
+
+    XMEMCPY(pt, msg, sizeof(msg));
+
+	pt = (byte*)XREALLOC(pt, sizeof(msg2), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (pt == NULL) {
+        return -514;
+    }
+
+    if (XMEMCMP(pt, msg, sizeof(msg))) {
+        return -515;
+    }
+
+    XMEMCPY(pt, msg2, sizeof(msg2));
+    XFREE(pt, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    ret = wolfSSL_unload_static_memory(buf, sizeof(buf), &amt);
+    if (ret != 1 || amt < sizeof(buf)) {
+        return -516;
+    }
+
+    return 0;
+}
+#endif /* WOLFSSL_STATIC_MEMORY */
+
+
 #ifdef WOLFSSL_MD2
 int md2_test()
 {
@@ -3945,7 +4009,7 @@ int certext_test(void)
     byte kid_ca[] = "\x33\xD8\x45\x66\xD7\x68\x87\x18\x7E\x54"
                     "\x0D\x70\x27\x91\xC7\x26\xD7\x85\x65\xC0";
 
-    tmp = (byte*)malloc(FOURK_BUF);
+    tmp = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (tmp == NULL)
         return -200;
 
@@ -3956,7 +4020,7 @@ int certext_test(void)
     file = fopen("./othercert.der", "rb");
 #endif
     if (!file) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -200;
     }
 
@@ -4007,7 +4071,7 @@ int certext_test(void)
     file = fopen("./certecc.der", "rb");
 #endif
     if (!file) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -210;
     }
 
@@ -4061,7 +4125,7 @@ int certext_test(void)
     file = fopen("./cert.der", "rb");
 #endif
     if (!file) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -220;
     }
 
@@ -4106,7 +4170,7 @@ int certext_test(void)
 #endif
 
     FreeDecodedCert(&cert);
-    free(tmp);
+    XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
 
     return 0;
 }
@@ -4134,7 +4198,7 @@ int rsa_test(void)
     DecodedCert cert;
 #endif
 
-    tmp = (byte*)malloc(FOURK_BUF);
+    tmp = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (tmp == NULL)
         return -40;
 
@@ -4150,7 +4214,7 @@ int rsa_test(void)
     if (!file) {
         err_sys("can't open ./certs/client-key.der, "
                 "Please run from wolfSSL home dir", -40);
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -40;
     }
 
@@ -4164,46 +4228,46 @@ int rsa_test(void)
 
     ret = wc_InitRsaKey(&key, 0);
     if (ret != 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -39;
     }
     ret = wc_RsaPrivateKeyDecode(tmp, &idx, &key, (word32)bytes);
     if (ret != 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -41;
     }
     ret = wc_InitRng(&rng);
     if (ret != 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -42;
     }
     ret = wc_RsaPublicEncrypt(in, inLen, out, sizeof(out), &key, &rng);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -43;
     }
     ret = wc_RsaPrivateDecrypt(out, ret, plain, sizeof(plain), &key);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -44;
     }
     if (memcmp(plain, in, inLen)) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -45;
     }
     ret = wc_RsaSSL_Sign(in, inLen, out, sizeof(out), &key, &rng);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -46;
     }
     memset(plain, 0, sizeof(plain));
     ret = wc_RsaSSL_Verify(out, ret, plain, sizeof(plain), &key);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL ,DYNAMIC_TYPE_TMP_BUFFER);
         return -47;
     }
     if (memcmp(plain, in, ret)) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -48;
     }
 
@@ -4216,17 +4280,17 @@ int rsa_test(void)
     ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
                        WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA, WC_MGF1SHA1, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -143;
     }
     ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
                        WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA, WC_MGF1SHA1, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -144;
     }
     if (XMEMCMP(plain, in, inLen)) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -145;
     }
     #endif /* NO_SHA */
@@ -4236,17 +4300,17 @@ int rsa_test(void)
     ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
                   WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -243;
     }
     ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
                   WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -244;
     }
     if (XMEMCMP(plain, in, inLen)) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -245;
     }
 
@@ -4255,13 +4319,13 @@ int rsa_test(void)
     ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
                   WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -246;
     }
     ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
            WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, in, sizeof(in));
     if (ret > 0) { /* in this case decrypt should fail */
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -247;
     }
 
@@ -4270,17 +4334,17 @@ int rsa_test(void)
     ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
            WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, in, sizeof(in));
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -248;
     }
     ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
            WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, in, sizeof(in));
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -249;
     }
     if (XMEMCMP(plain, in, inLen)) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -250;
     }
 
@@ -4290,13 +4354,13 @@ int rsa_test(void)
         ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
                 WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA, WC_MGF1SHA1, in, sizeof(in));
         if (ret < 0) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -251;
         }
         ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
            WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA256, WC_MGF1SHA256, in, sizeof(in));
         if (ret > 0) { /* should fail */
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -252;
         }
         #endif /* NO_SHA*/
@@ -4312,17 +4376,17 @@ int rsa_test(void)
         ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
                   WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA512, WC_MGF1SHA512, NULL, 0);
         if (ret < 0) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -343;
         }
         ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
                   WC_RSA_OAEP_PAD, WC_HASH_TYPE_SHA512, WC_MGF1SHA512, NULL, 0);
         if (ret < 0) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -344;
         }
         if (XMEMCMP(plain, in, inLen)) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -345;
         }
     }
@@ -4333,17 +4397,17 @@ int rsa_test(void)
     ret = wc_RsaPublicEncrypt_ex(in, inLen, out, sizeof(out), &key, &rng,
                   WC_RSA_PKCSV15_PAD, WC_HASH_TYPE_NONE, 0, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -443;
     }
     ret = wc_RsaPrivateDecrypt_ex(out, ret, plain, sizeof(plain), &key,
                   WC_RSA_PKCSV15_PAD, WC_HASH_TYPE_NONE, 0, NULL, 0);
     if (ret < 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -444;
     }
     if (XMEMCMP(plain, in, inLen)) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -445;
     }
     #endif /* !HAVE_FAST_RSA && !HAVE_FIPS */
@@ -4362,7 +4426,7 @@ int rsa_test(void)
 #else
     file2 = fopen(clientCert, "rb");
     if (!file2) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -49;
     }
 
@@ -4398,7 +4462,7 @@ int rsa_test(void)
     if (!file) {
         err_sys("can't open ./certs/client-keyPub.der, "
                 "Please run from wolfSSL home dir", -40);
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -50;
     }
 
@@ -4408,14 +4472,14 @@ int rsa_test(void)
 
     ret = wc_InitRsaKey(&keypub, 0);
     if (ret != 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -51;
     }
     idx = 0;
 
     ret = wc_RsaPublicKeyDecode(tmp, &idx, &keypub, (word32)bytes);
     if (ret != 0) {
-        free(tmp);
+        XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeRsaKey(&keypub);
         return -52;
     }
@@ -4434,34 +4498,34 @@ int rsa_test(void)
 
         ret = wc_InitRsaKey(&genKey, 0);
         if (ret != 0) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -300;
         }
         ret = wc_MakeRsaKey(&genKey, 1024, 65537, &rng);
         if (ret != 0) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -301;
         }
 
-        der = (byte*)malloc(FOURK_BUF);
+        der = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (der == NULL) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -307;
         }
-        pem = (byte*)malloc(FOURK_BUF);
+        pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
-            free(tmp);
-            free(der);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -308;
         }
 
         derSz = wc_RsaKeyToDer(&genKey, der, FOURK_BUF);
         if (derSz < 0) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -302;
         }
 
@@ -4471,27 +4535,27 @@ int rsa_test(void)
         keyFile = fopen("./key.der", "wb");
 #endif
         if (!keyFile) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -303;
         }
         ret = (int)fwrite(der, 1, derSz, keyFile);
         fclose(keyFile);
         if (ret != derSz) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -313;
         }
 
         pemSz = wc_DerToPem(der, derSz, pem, FOURK_BUF, PRIVATEKEY_TYPE);
         if (pemSz < 0) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -304;
         }
@@ -4502,36 +4566,36 @@ int rsa_test(void)
         pemFile = fopen("./key.pem", "wb");
 #endif
         if (!pemFile) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -305;
         }
         ret = (int)fwrite(pem, 1, pemSz, pemFile);
         fclose(pemFile);
         if (ret != pemSz) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -314;
         }
 
         ret = wc_InitRsaKey(&derIn, 0);
         if (ret != 0) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&genKey);
             return -3060;
         }
         idx = 0;
         ret = wc_RsaPrivateKeyDecode(der, &idx, &derIn, derSz);
         if (ret != 0) {
-            free(der);
-            free(pem);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&derIn);
             wc_FreeRsaKey(&genKey);
             return -306;
@@ -4539,8 +4603,8 @@ int rsa_test(void)
 
         wc_FreeRsaKey(&derIn);
         wc_FreeRsaKey(&genKey);
-        free(pem);
-        free(der);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif /* WOLFSSL_KEY_GEN */
 
@@ -4558,15 +4622,15 @@ int rsa_test(void)
         DecodedCert decode;
 #endif
 
-        derCert = (byte*)malloc(FOURK_BUF);
+        derCert = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (derCert == NULL) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -309;
         }
-        pem = (byte*)malloc(FOURK_BUF);
+        pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
-            free(tmp);
-            free(derCert);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -310;
         }
 
@@ -4592,34 +4656,34 @@ int rsa_test(void)
 
         /* add SKID from the Public Key */
         if (wc_SetSubjectKeyIdFromPublicKey(&myCert, &keypub, NULL) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -398;
         }
 
          /* add AKID from the Public Key */
          if (wc_SetAuthKeyIdFromPublicKey(&myCert, &keypub, NULL) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
              return -399;
         }
 
         /* add Key Usage */
         if (wc_SetKeyUsage(&myCert,"cRLSign,keyCertSign") != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -400;
         }
 #endif /* WOLFSSL_CERT_EXT */
 
         certSz = wc_MakeSelfCert(&myCert, derCert, FOURK_BUF, &key, &rng);
         if (certSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -401;
         }
 
@@ -4627,9 +4691,9 @@ int rsa_test(void)
         InitDecodedCert(&decode, derCert, certSz, 0);
         ret = ParseCert(&decode, CERT_TYPE, NO_VERIFY, 0);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -402;
         }
         FreeDecodedCert(&decode);
@@ -4641,25 +4705,25 @@ int rsa_test(void)
         derFile = fopen("./cert.der", "wb");
 #endif
         if (!derFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -403;
         }
         ret = (int)fwrite(derCert, 1, certSz, derFile);
         fclose(derFile);
         if (ret != certSz) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -414;
         }
 
         pemSz = wc_DerToPem(derCert, certSz, pem, FOURK_BUF, CERT_TYPE);
         if (pemSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -404;
         }
 
@@ -4669,21 +4733,21 @@ int rsa_test(void)
         pemFile = fopen("./cert.pem", "wb");
 #endif
         if (!pemFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -405;
         }
         ret = (int)fwrite(pem, 1, pemSz, pemFile);
         fclose(pemFile);
         if (ret != pemSz) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -406;
         }
-        free(pem);
-        free(derCert);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
     /* CA style */
     {
@@ -4702,24 +4766,24 @@ int rsa_test(void)
         DecodedCert decode;
 #endif
 
-        derCert = (byte*)malloc(FOURK_BUF);
+        derCert = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (derCert == NULL) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -311;
         }
-        pem = (byte*)malloc(FOURK_BUF);
+        pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
-            free(derCert);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -312;
         }
 
         file3 = fopen(caKeyFile, "rb");
 
         if (!file3) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -412;
         }
 
@@ -4728,16 +4792,16 @@ int rsa_test(void)
 
         ret = wc_InitRsaKey(&caKey, 0);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -411;
         }
         ret = wc_RsaPrivateKeyDecode(tmp, &idx3, &caKey, (word32)bytes3);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -413;
         }
@@ -4764,43 +4828,43 @@ int rsa_test(void)
 
         /* add SKID from the Public Key */
         if (wc_SetSubjectKeyIdFromPublicKey(&myCert, &key, NULL) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -398;
         }
 
         /* add AKID from the CA certificate */
         if (wc_SetAuthKeyId(&myCert, caCertFile) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -399;
         }
 
         /* add Key Usage */
         if (wc_SetKeyUsage(&myCert,"keyEncipherment,keyAgreement") != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -400;
         }
 #endif /* WOLFSSL_CERT_EXT */
 
         ret = wc_SetIssuer(&myCert, caCertFile);
         if (ret < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -405;
         }
 
         certSz = wc_MakeCert(&myCert, derCert, FOURK_BUF, &key, NULL, &rng);
         if (certSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -407;
         }
@@ -4808,9 +4872,9 @@ int rsa_test(void)
         certSz = wc_SignCert(myCert.bodySz, myCert.sigType, derCert, FOURK_BUF,
                           &caKey, NULL, &rng);
         if (certSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -408;
         }
@@ -4819,9 +4883,9 @@ int rsa_test(void)
         InitDecodedCert(&decode, derCert, certSz, 0);
         ret = ParseCert(&decode, CERT_TYPE, NO_VERIFY, 0);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -409;
         }
@@ -4834,27 +4898,27 @@ int rsa_test(void)
         derFile = fopen("./othercert.der", "wb");
 #endif
         if (!derFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -410;
         }
         ret = (int)fwrite(derCert, 1, certSz, derFile);
         fclose(derFile);
         if (ret != certSz) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -416;
         }
 
         pemSz = wc_DerToPem(derCert, certSz, pem, FOURK_BUF, CERT_TYPE);
         if (pemSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -411;
         }
@@ -4865,24 +4929,24 @@ int rsa_test(void)
         pemFile = fopen("./othercert.pem", "wb");
 #endif
         if (!pemFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
             return -412;
         }
         ret = (int)fwrite(pem, 1, pemSz, pemFile);
         if (ret != pemSz) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             fclose(pemFile);
             wc_FreeRsaKey(&caKey);
             return -415;
         }
         fclose(pemFile);
-        free(pem);
-        free(derCert);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeRsaKey(&caKey);
     }
 #ifdef HAVE_ECC
@@ -4906,24 +4970,24 @@ int rsa_test(void)
         DecodedCert decode;
 #endif
 
-        derCert = (byte*)malloc(FOURK_BUF);
+        derCert = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (derCert == NULL) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5311;
         }
-        pem = (byte*)malloc(FOURK_BUF);
+        pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
-            free(derCert);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5312;
         }
 
         file3 = fopen(eccCaKeyFile, "rb");
 
         if (!file3) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5412;
         }
 
@@ -4933,9 +4997,9 @@ int rsa_test(void)
         wc_ecc_init(&caKey);
         ret = wc_EccPrivateKeyDecode(tmp, &idx3, &caKey, (word32)bytes3);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5413;
         }
 
@@ -4961,9 +5025,9 @@ int rsa_test(void)
 
         file3 = fopen(eccCaKeyPubFile, "rb");
         if (!file3) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5500;
         }
 
@@ -4972,36 +5036,36 @@ int rsa_test(void)
 
         wc_ecc_init(&caKeyPub);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5501;
         }
 
         idx3 = 0;
         ret = wc_EccPublicKeyDecode(tmp, &idx3, &caKeyPub, (word32)bytes3);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKeyPub);
             return -5502;
         }
 
         /* add SKID from the Public Key */
         if (wc_SetSubjectKeyIdFromPublicKey(&myCert, &key, NULL) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKeyPub);
             return -5503;
         }
 
         /* add AKID from the Public Key */
         if (wc_SetAuthKeyIdFromPublicKey(&myCert, NULL, &caKeyPub) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKeyPub);
             return -5504;
         }
@@ -5009,38 +5073,38 @@ int rsa_test(void)
 
         /* add Key Usage */
         if (wc_SetKeyUsage(&myCert,"digitalSignature,nonRepudiation") != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5505;
         }
 #endif /* WOLFSSL_CERT_EXT */
 
         ret = wc_SetIssuer(&myCert, eccCaCertFile);
         if (ret < 0) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5405;
         }
 
         certSz = wc_MakeCert(&myCert, derCert, FOURK_BUF, &key, NULL, &rng);
         if (certSz < 0) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5407;
         }
 
         certSz = wc_SignCert(myCert.bodySz, myCert.sigType, derCert, FOURK_BUF,
                           NULL, &caKey, &rng);
         if (certSz < 0) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5408;
         }
 
@@ -5048,9 +5112,9 @@ int rsa_test(void)
         InitDecodedCert(&decode, derCert, certSz, 0);
         ret = ParseCert(&decode, CERT_TYPE, NO_VERIFY, 0);
         if (ret != 0) {
-            free(tmp);
-            free(pem);
-            free(derCert);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
             return -5409;
         }
@@ -5063,28 +5127,28 @@ int rsa_test(void)
         derFile = fopen("./certecc.der", "wb");
 #endif
         if (!derFile) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5410;
         }
         ret = (int)fwrite(derCert, 1, certSz, derFile);
         fclose(derFile);
         if (ret != certSz) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5414;
         }
 
         pemSz = wc_DerToPem(derCert, certSz, pem, FOURK_BUF, CERT_TYPE);
         if (pemSz < 0) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5411;
         }
 
@@ -5094,24 +5158,24 @@ int rsa_test(void)
         pemFile = fopen("./certecc.pem", "wb");
 #endif
         if (!pemFile) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5412;
         }
         ret = (int)fwrite(pem, 1, pemSz, pemFile);
         if (ret != pemSz) {
-            free(pem);
-            free(derCert);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_ecc_free(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -5415;
         }
 
         fclose(pemFile);
-        free(pem);
-        free(derCert);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_ecc_free(&caKey);
     }
 #endif /* HAVE_ECC */
@@ -5131,15 +5195,15 @@ int rsa_test(void)
 #ifdef WOLFSSL_TEST_CERT
         DecodedCert decode;
 #endif
-        derCert = (byte*)malloc(FOURK_BUF);
+        derCert = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (derCert == NULL) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -311;
         }
-        pem = (byte*)malloc(FOURK_BUF);
+        pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
-            free(derCert);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -312;
         }
 
@@ -5154,9 +5218,9 @@ int rsa_test(void)
         word32 rc = ntru_crypto_drbg_instantiate(112, pers_str,
                           sizeof(pers_str), GetEntropy, &drbg);
         if (rc != DRBG_OK) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -448;
         }
 
@@ -5164,9 +5228,9 @@ int rsa_test(void)
                                              &public_key_len, NULL,
                                              &private_key_len, NULL);
         if (rc != NTRU_OK) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -449;
         }
 
@@ -5174,27 +5238,27 @@ int rsa_test(void)
                                              &public_key_len, public_key,
                                              &private_key_len, private_key);
         if (rc != NTRU_OK) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -450;
         }
 
         rc = ntru_crypto_drbg_uninstantiate(drbg);
 
         if (rc != NTRU_OK) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -451;
         }
 
         caFile = fopen(caKeyFile, "rb");
 
         if (!caFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -452;
         }
 
@@ -5203,16 +5267,16 @@ int rsa_test(void)
 
         ret = wc_InitRsaKey(&caKey, 0);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -453;
         }
         ret = wc_RsaPrivateKeyDecode(tmp, &idx3, &caKey, (word32)bytes);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -454;
         }
 
@@ -5231,46 +5295,46 @@ int rsa_test(void)
         /* add SKID from the Public Key */
         if (wc_SetSubjectKeyIdFromNtruPublicKey(&myCert, public_key,
                                                 public_key_len) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -496;
         }
 
         /* add AKID from the CA certificate */
         if (wc_SetAuthKeyId(&myCert, caCertFile) != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -495;
         }
 
         /* add Key Usage */
         if (wc_SetKeyUsage(&myCert,"digitalSignature,nonRepudiation,"
                                    "keyEncipherment,keyAgreement") != 0) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -494;
         }
 #endif /* WOLFSSL_CERT_EXT */
 
         ret = wc_SetIssuer(&myCert, caCertFile);
         if (ret < 0) {
-            free(derCert);
-            free(pem);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -455;
         }
 
         certSz = wc_MakeNtruCert(&myCert, derCert, FOURK_BUF, public_key,
                               public_key_len, &rng);
         if (certSz < 0) {
-            free(derCert);
-            free(pem);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             wc_FreeRsaKey(&caKey);
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -456;
         }
 
@@ -5278,9 +5342,9 @@ int rsa_test(void)
                           &caKey, NULL, &rng);
         wc_FreeRsaKey(&caKey);
         if (certSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -457;
         }
 
@@ -5289,70 +5353,70 @@ int rsa_test(void)
         InitDecodedCert(&decode, derCert, certSz, 0);
         ret = ParseCert(&decode, CERT_TYPE, NO_VERIFY, 0);
         if (ret != 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -458;
         }
         FreeDecodedCert(&decode);
 #endif
         derFile = fopen("./ntru-cert.der", "wb");
         if (!derFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -459;
         }
         ret = (int)fwrite(derCert, 1, certSz, derFile);
         fclose(derFile);
         if (ret != certSz) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -473;
         }
 
         pemSz = wc_DerToPem(derCert, certSz, pem, FOURK_BUF, CERT_TYPE);
         if (pemSz < 0) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -460;
         }
 
         pemFile = fopen("./ntru-cert.pem", "wb");
         if (!pemFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -461;
         }
         ret = (int)fwrite(pem, 1, pemSz, pemFile);
         fclose(pemFile);
         if (ret != pemSz) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -474;
         }
 
         ntruPrivFile = fopen("./ntru-key.raw", "wb");
         if (!ntruPrivFile) {
-            free(derCert);
-            free(pem);
-            free(tmp);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -462;
         }
         ret = (int)fwrite(private_key, 1, private_key_len, ntruPrivFile);
         fclose(ntruPrivFile);
         if (ret != private_key_len) {
-            free(pem);
-            free(derCert);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -475;
         }
-        free(pem);
-        free(derCert);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(derCert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif /* HAVE_NTRU */
 #ifdef WOLFSSL_CERT_REQ
@@ -5364,15 +5428,15 @@ int rsa_test(void)
         int         pemSz;
         FILE*       reqFile;
 
-        der = (byte*)malloc(FOURK_BUF);
+        der = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (der == NULL) {
-            free(tmp);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -463;
         }
-        pem = (byte*)malloc(FOURK_BUF);
+        pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         if (pem == NULL) {
-            free(der);
-            free(tmp);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -464;
         }
 
@@ -5393,44 +5457,44 @@ int rsa_test(void)
 #ifdef WOLFSSL_CERT_EXT
         /* add SKID from the Public Key */
         if (wc_SetSubjectKeyIdFromPublicKey(&req, &keypub, NULL) != 0) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -496;
         }
 
         /* add Key Usage */
         if (wc_SetKeyUsage(&req,"digitalSignature,nonRepudiation,"
                                 "keyEncipherment,keyAgreement") != 0) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -494;
         }
 #endif /* WOLFSSL_CERT_EXT */
 
         derSz = wc_MakeCertReq(&req, der, FOURK_BUF, &key, NULL);
         if (derSz < 0) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -465;
         }
 
         derSz = wc_SignCert(req.bodySz, req.sigType, der, FOURK_BUF,
                           &key, NULL, &rng);
         if (derSz < 0) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -466;
         }
 
         pemSz = wc_DerToPem(der, derSz, pem, FOURK_BUF, CERTREQ_TYPE);
         if (pemSz < 0) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -467;
         }
 
@@ -5440,18 +5504,18 @@ int rsa_test(void)
         reqFile = fopen("./certreq.der", "wb");
 #endif
         if (!reqFile) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -468;
         }
 
         ret = (int)fwrite(der, 1, derSz, reqFile);
         fclose(reqFile);
         if (ret != derSz) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -471;
         }
 
@@ -5461,22 +5525,22 @@ int rsa_test(void)
         reqFile = fopen("./certreq.pem", "wb");
 #endif
         if (!reqFile) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -469;
         }
         ret = (int)fwrite(pem, 1, pemSz, reqFile);
         fclose(reqFile);
         if (ret != pemSz) {
-            free(pem);
-            free(der);
-            free(tmp);
+            XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -470;
         }
 
-        free(pem);
-        free(der);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif /* WOLFSSL_CERT_REQ */
 #endif /* WOLFSSL_CERT_GEN */
@@ -5488,7 +5552,7 @@ int rsa_test(void)
 #ifdef HAVE_CAVIUM
     wc_RsaFreeCavium(&key);
 #endif
-    free(tmp);
+    XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     wc_FreeRng(&rng);
 
     return 0;
@@ -5674,22 +5738,22 @@ int dsa_test(void)
     ret = wc_MakeDsaKey(&rng, &genKey);
     if (ret != 0) return -363;
 
-    der = (byte*)malloc(FOURK_BUF);
+    der = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (der == NULL) {
         wc_FreeDsaKey(&genKey);
         return -364;
     }
-    pem = (byte*)malloc(FOURK_BUF);
+    pem = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (pem == NULL) {
-        free(der);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&genKey);
         return -365;
     }
 
     derSz = wc_DsaKeyToDer(&genKey, der, FOURK_BUF);
     if (derSz < 0) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -366;
     }
 
@@ -5699,24 +5763,24 @@ int dsa_test(void)
     keyFile = fopen("./key.der", "wb");
 #endif
     if (!keyFile) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&genKey);
         return -367;
     }
     ret = (int)fwrite(der, 1, derSz, keyFile);
     fclose(keyFile);
     if (ret != derSz) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&genKey);
         return -368;
     }
 
     pemSz = wc_DerToPem(der, derSz, pem, FOURK_BUF, DSA_PRIVATEKEY_TYPE);
     if (pemSz < 0) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&genKey);
         return -369;
     }
@@ -5727,16 +5791,16 @@ int dsa_test(void)
     pemFile = fopen("./key.pem", "wb");
 #endif
     if (!pemFile) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&genKey);
         return -370;
     }
     ret = (int)fwrite(pem, 1, pemSz, pemFile);
     fclose(pemFile);
     if (ret != pemSz) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&genKey);
         return -371;
     }
@@ -5745,8 +5809,8 @@ int dsa_test(void)
     idx = 0;
     ret = wc_DsaPrivateKeyDecode(der, &idx, &derIn, derSz);
     if (ret != 0) {
-        free(der);
-        free(pem);
+        XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_FreeDsaKey(&derIn);
         wc_FreeDsaKey(&genKey);
         return -373;
@@ -5754,8 +5818,8 @@ int dsa_test(void)
 
     wc_FreeDsaKey(&derIn);
     wc_FreeDsaKey(&genKey);
-    free(pem);
-    free(der);
+    XFREE(pem, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(der, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     }
 #endif /* WOLFSSL_KEY_GEN */
 
@@ -7702,8 +7766,12 @@ int compress_test(void)
     byte *c = NULL;
     byte *d = NULL;
 
-    c = calloc(cSz, sizeof(byte));
-    d = calloc(dSz, sizeof(byte));
+    c = XMALLOC(cSz * sizeof(byte), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    d = XMALLOC(dSz * sizeof(byte), NULL, DYNAMIC_TYPE_TMP_BUFFER);
+
+    /* follow calloc and initialize to 0 */
+    XMEMSET(c, 0, cSz);
+    XMEMSET(d, 0, dSz);
 
     if (c == NULL || d == NULL)
         ret = -300;
@@ -7722,8 +7790,8 @@ int compress_test(void)
     if (ret == 0 && memcmp(d, sample_text, dSz))
         ret = -303;
 
-    if (c) free(c);
-    if (d) free(d);
+    if (c) XFREE(c, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    if (d) XFREE(d, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 
     return ret;
 }
@@ -7757,20 +7825,20 @@ int pkcs7enveloped_test(void)
     };
 
     /* read client cert and key in DER format */
-    cert = (byte*)malloc(FOURK_BUF);
+    cert = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (cert == NULL)
         return -201;
 
-    privKey = (byte*)malloc(FOURK_BUF);
+    privKey = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (privKey == NULL) {
-        free(cert);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -202;
     }
 
     certFile = fopen(clientCert, "rb");
     if (!certFile) {
-        free(cert);
-        free(privKey);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         err_sys("can't open ./certs/client-cert.der, "
                 "Please run from wolfSSL home dir", -42);
         return -42;
@@ -7781,8 +7849,8 @@ int pkcs7enveloped_test(void)
 
     keyFile = fopen(clientKey, "rb");
     if (!keyFile) {
-        free(cert);
-        free(privKey);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         err_sys("can't open ./certs/client-key.der, "
                 "Please run from wolfSSL home dir", -43);
         return -43;
@@ -7803,8 +7871,8 @@ int pkcs7enveloped_test(void)
     envelopedSz = wc_PKCS7_EncodeEnvelopedData(&pkcs7, enveloped,
                                             sizeof(enveloped));
     if (envelopedSz <= 0) {
-        free(cert);
-        free(privKey);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -203;
     }
 
@@ -7812,31 +7880,31 @@ int pkcs7enveloped_test(void)
     decodedSz = wc_PKCS7_DecodeEnvelopedData(&pkcs7, enveloped, envelopedSz,
                                           decoded, sizeof(decoded));
     if (decodedSz <= 0) {
-        free(cert);
-        free(privKey);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -204;
     }
 
     /* test decode result */
     if (memcmp(decoded, data, sizeof(data)) != 0) {
-        free(cert);
-        free(privKey);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -205;
     }
 
     /* output pkcs7 envelopedData for external testing */
     pkcs7File = fopen(pkcs7OutFile, "wb");
     if (!pkcs7File) {
-        free(cert);
-        free(privKey);
+        XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -206;
     }
 
     ret = (int)fwrite(enveloped, envelopedSz, 1, pkcs7File);
     fclose(pkcs7File);
 
-    free(cert);
-    free(privKey);
+    XFREE(cert, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(privKey, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     wc_PKCS7_Free(&pkcs7);
 
     if (ret > 0)
@@ -7884,27 +7952,27 @@ int pkcs7signed_test(void)
     dataSz = (word32) strlen(data);
     outSz = FOURK_BUF;
 
-    certDer = (byte*)malloc(FOURK_BUF);
+    certDer = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (certDer == NULL)
         return -207;
-    keyDer = (byte*)malloc(FOURK_BUF);
+    keyDer = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (keyDer == NULL) {
-        free(certDer);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -208;
     }
-    out = (byte*)malloc(FOURK_BUF);
+    out = (byte*)XMALLOC(FOURK_BUF, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     if (out == NULL) {
-        free(certDer);
-        free(keyDer);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -209;
     }
 
     /* read in DER cert of recipient, into cert of size certSz */
     file = fopen(clientCert, "rb");
     if (!file) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         err_sys("can't open ./certs/client-cert.der, "
                 "Please run from wolfSSL home dir", -44);
         return -44;
@@ -7914,9 +7982,9 @@ int pkcs7signed_test(void)
 
     file = fopen(clientKey, "rb");
     if (!file) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         err_sys("can't open ./certs/client-key.der, "
                 "Please run from wolfSSL home dir", -45);
         return -45;
@@ -7926,9 +7994,9 @@ int pkcs7signed_test(void)
 
     ret = wc_InitRng(&rng);
     if (ret != 0) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -210;
     }
 
@@ -7937,9 +8005,9 @@ int pkcs7signed_test(void)
 
     ret = wc_RNG_GenerateBlock(&rng, &senderNonce[2], PKCS7_NONCE_SZ);
     if (ret != 0) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return -211;
     }
 
@@ -7963,9 +8031,9 @@ int pkcs7signed_test(void)
 
         ret = wc_InitSha(&sha);
         if (ret != 0) {
-            free(certDer);
-            free(keyDer);
-            free(out);
+            XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+            XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
             return -4003;
         }
         wc_ShaUpdate(&sha, msg.publicKey, msg.publicKeySz);
@@ -7977,9 +8045,9 @@ int pkcs7signed_test(void)
     }
     ret = wc_PKCS7_EncodeSignedData(&msg, out, outSz);
     if (ret < 0) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_PKCS7_Free(&msg);
         return -212;
     }
@@ -7989,18 +8057,18 @@ int pkcs7signed_test(void)
     /* write PKCS#7 to output file for more testing */
     file = fopen("./pkcs7signedData.der", "wb");
     if (!file) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_PKCS7_Free(&msg);
         return -213;
     }
     ret = (int)fwrite(out, 1, outSz, file);
     fclose(file);
     if (ret != (int)outSz) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_PKCS7_Free(&msg);
         return -218;
     }
@@ -8010,35 +8078,35 @@ int pkcs7signed_test(void)
 
     ret = wc_PKCS7_VerifySignedData(&msg, out, outSz);
     if (ret < 0) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_PKCS7_Free(&msg);
         return -214;
     }
 
     if (msg.singleCert == NULL || msg.singleCertSz == 0) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_PKCS7_Free(&msg);
         return -215;
     }
 
     file = fopen("./pkcs7cert.der", "wb");
     if (!file) {
-        free(certDer);
-        free(keyDer);
-        free(out);
+        XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+        XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         wc_PKCS7_Free(&msg);
         return -216;
     }
     ret = (int)fwrite(msg.singleCert, 1, msg.singleCertSz, file);
     fclose(file);
 
-    free(certDer);
-    free(keyDer);
-    free(out);
+    XFREE(certDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(keyDer, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+    XFREE(out, NULL, DYNAMIC_TYPE_TMP_BUFFER);
     wc_PKCS7_Free(&msg);
 
     wc_FreeRng(&rng);
diff --git a/wolfssl/wolfcrypt/memory.h b/wolfssl/wolfcrypt/memory.h
index 5bf8c26f6..6553449ea 100644
--- a/wolfssl/wolfcrypt/memory.h
+++ b/wolfssl/wolfcrypt/memory.h
@@ -58,6 +58,20 @@ WOLFSSL_API int wolfSSL_SetAllocators(wolfSSL_Malloc_cb  malloc_function,
                                     wolfSSL_Free_cb    free_function,
                                     wolfSSL_Realloc_cb realloc_function);
 
+#ifdef WOLFSSL_STATIC_MEMORY
+    #define WOLFSSL_STATIC_TIMEOUT 1
+    #define WC_STATIC_ALIGN 64
+
+    WOLFSSL_API int wolfSSL_load_static_memory(byte* buffer, word32 sz);
+    WOLFSSL_API int wolfSSL_unload_static_memory(byte* buffer, word32 sz,
+                                                                   word32* amt);
+    WOLFSSL_API int wolfSSL_use_static_memory(byte flag);
+    WOLFSSL_API word32 wolfSSL_static_memory_inUse(void);
+    WOLFSSL_LOCAL void* wolfSSL_Malloc_Static(size_t size);
+    WOLFSSL_LOCAL void  wolfSSL_Free_Static(void *ptr);
+    WOLFSSL_LOCAL void* wolfSSL_Realloc_Static(void *ptr, size_t size);
+#endif /* WOLFSSL_STATIC_MEMORY */
+
 #ifdef __cplusplus
     }  /* extern "C" */
 #endif
diff --git a/wolfssl/wolfcrypt/types.h b/wolfssl/wolfcrypt/types.h
index 9a76e0b6e..8825ddb53 100644
--- a/wolfssl/wolfcrypt/types.h
+++ b/wolfssl/wolfcrypt/types.h
@@ -176,12 +176,18 @@
 	    extern void *XMALLOC(size_t n, void* heap, int type);
 	    extern void *XREALLOC(void *p, size_t n, void* heap, int type);
 	    extern void XFREE(void *p, void* heap, int type);
+        #ifdef WOLFSSL_STATIC_MEMORY /* don't use wolfSSL static memory either*/
+            #undef WOLFSSL_STATIC_MEMORY
+        #endif
 	#elif defined(NO_WOLFSSL_MEMORY)
 	    /* just use plain C stdlib stuff if desired */
 	    #include <stdlib.h>
 	    #define XMALLOC(s, h, t)     ((void)h, (void)t, malloc((s)))
 	    #define XFREE(p, h, t)       {void* xp = (p); if((xp)) free((xp));}
 	    #define XREALLOC(p, n, h, t) realloc((p), (n))
+        #ifdef WOLFSSL_STATIC_MEMORY /* don't use wolfSSL static memory either*/
+            #undef WOLFSSL_STATIC_MEMORY
+        #endif
 	#elif !defined(MICRIUM_MALLOC) && !defined(EBSNET) \
 	        && !defined(WOLFSSL_SAFERTOS) && !defined(FREESCALE_MQX) \
 	        && !defined(FREESCALE_KSDK_MQX) && !defined(FREESCALE_FREE_RTOS) \
@@ -200,6 +206,13 @@
        #endif
 	#endif
 
+
+    /* sleep function for static memory */
+    #ifdef WOLFSSL_STATIC_MEMORY
+        #include <unistd.h>
+        #define XSLEEP(t) sleep((t))
+    #endif /* WOLFSSL_STATIC_MEMORY */
+
 	#ifndef STRING_USER
 	    #include <string.h>
 	    char* mystrnstr(const char* s1, const char* s2, unsigned int n);