diff --git a/src/tls.c b/src/tls.c
index 0297af48a..2c94127b2 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -940,59 +940,67 @@ static int Hmac_OuterHash(Hmac* hmac, unsigned char* mac)
     #ifndef NO_SHA
         case WC_SHA:
             ret = wc_InitSha(&hmac->hash.sha);
-            if (ret == 0)
+            if (ret == 0) {
                 ret = wc_ShaUpdate(&hmac->hash.sha, (byte*)hmac->opad,
                                                              WC_SHA_BLOCK_SIZE);
-            if (ret == 0)
-                ret = wc_ShaUpdate(&hmac->hash.sha, (byte*)hmac->innerHash,
-                                                            WC_SHA_DIGEST_SIZE);
-            if (ret == 0)
-                ret = wc_ShaFinal(&hmac->hash.sha, mac);
+                if (ret == 0)
+                    ret = wc_ShaUpdate(&hmac->hash.sha, (byte*)hmac->innerHash,
+                                                                WC_SHA_DIGEST_SIZE);
+                if (ret == 0)
+                    ret = wc_ShaFinal(&hmac->hash.sha, mac);
+                wc_ShaFree(&hmac->hash.sha);
+            }
             break;
     #endif /* !NO_SHA */
 
     #ifndef NO_SHA256
         case WC_SHA256:
             ret = wc_InitSha256(&hmac->hash.sha256);
-            if (ret == 0)
+            if (ret == 0) {
                 ret = wc_Sha256Update(&hmac->hash.sha256, (byte*)hmac->opad,
                                                           WC_SHA256_BLOCK_SIZE);
-            if (ret == 0)
-                ret = wc_Sha256Update(&hmac->hash.sha256,
-                                                         (byte*)hmac->innerHash,
-                                                         WC_SHA256_DIGEST_SIZE);
-            if (ret == 0)
-                ret = wc_Sha256Final(&hmac->hash.sha256, mac);
+                if (ret == 0)
+                    ret = wc_Sha256Update(&hmac->hash.sha256,
+                                                             (byte*)hmac->innerHash,
+                                                             WC_SHA256_DIGEST_SIZE);
+                if (ret == 0)
+                    ret = wc_Sha256Final(&hmac->hash.sha256, mac);
+                wc_Sha256Free(&hmac->hash.sha256);
+            }
             break;
     #endif /* !NO_SHA256 */
 
     #ifdef WOLFSSL_SHA384
         case WC_SHA384:
             ret = wc_InitSha384(&hmac->hash.sha384);
-            if (ret == 0)
+            if (ret == 0) {
                 ret = wc_Sha384Update(&hmac->hash.sha384, (byte*)hmac->opad,
                                                           WC_SHA384_BLOCK_SIZE);
-            if (ret == 0)
-                ret = wc_Sha384Update(&hmac->hash.sha384,
-                                                         (byte*)hmac->innerHash,
-                                                         WC_SHA384_DIGEST_SIZE);
-            if (ret == 0)
-                ret = wc_Sha384Final(&hmac->hash.sha384, mac);
+                if (ret == 0)
+                    ret = wc_Sha384Update(&hmac->hash.sha384,
+                                                             (byte*)hmac->innerHash,
+                                                             WC_SHA384_DIGEST_SIZE);
+                if (ret == 0)
+                    ret = wc_Sha384Final(&hmac->hash.sha384, mac);
+                wc_Sha384Free(&hmac->hash.sha384);
+            }
             break;
     #endif /* WOLFSSL_SHA384 */
 
     #ifdef WOLFSSL_SHA512
         case WC_SHA512:
             ret = wc_InitSha512(&hmac->hash.sha512);
-            if (ret == 0)
+            if (ret == 0) {
                 ret = wc_Sha512Update(&hmac->hash.sha512,(byte*)hmac->opad,
                                                           WC_SHA512_BLOCK_SIZE);
-            if (ret == 0)
-                ret = wc_Sha512Update(&hmac->hash.sha512,
-                                                         (byte*)hmac->innerHash,
-                                                         WC_SHA512_DIGEST_SIZE);
-            if (ret == 0)
-                ret = wc_Sha512Final(&hmac->hash.sha512, mac);
+                if (ret == 0)
+                    ret = wc_Sha512Update(&hmac->hash.sha512,
+                                                             (byte*)hmac->innerHash,
+                                                             WC_SHA512_DIGEST_SIZE);
+                if (ret == 0)
+                    ret = wc_Sha512Final(&hmac->hash.sha512, mac);
+                wc_Sha512Free(&hmac->hash.sha512);
+            }
             break;
     #endif /* WOLFSSL_SHA512 */
     }
diff --git a/tests/api.c b/tests/api.c
index 31982853e..84e0b6795 100644
--- a/tests/api.c
+++ b/tests/api.c
@@ -20148,6 +20148,9 @@ static int test_ForceZero(void)
     unsigned char data[32];
     unsigned int i, j, len;
 
+    /* Test case with 0 length */
+    ForceZero(data, 0);
+
     /* Test ForceZero */
     for (i = 0; i < sizeof(data); i++) {
         for (len = 1; len < sizeof(data) - i; len++) {
diff --git a/wolfcrypt/src/hash.c b/wolfcrypt/src/hash.c
index ec6c09cf2..60ae8aa48 100644
--- a/wolfcrypt/src/hash.c
+++ b/wolfcrypt/src/hash.c
@@ -658,12 +658,17 @@ int wc_HashFinal(wc_HashAlg* hash, enum wc_HashType type, byte* out)
             return MEMORY_E;
     #endif
 
-        ret = wc_InitMd5(md5);
-        if (ret == 0) {
-            ret = wc_Md5Update(md5, data, len);
-            if (ret == 0) {
-                ret = wc_Md5Final(md5, hash);
+        if ((ret = wc_InitMd5(md5)) != 0) {
+            WOLFSSL_MSG("InitMd5 failed");
+        }
+        else {
+            if ((ret = wc_Md5Update(md5, data, len)) != 0) {
+                WOLFSSL_MSG("Md5Update failed");
             }
+            else if ((ret = wc_Md5Final(md5, hash)) != 0) {
+                WOLFSSL_MSG("Md5Final failed");
+            }
+            wc_Md5Free(md5);
         }
 
     #ifdef WOLFSSL_SMALL_STACK
@@ -691,11 +696,16 @@ int wc_HashFinal(wc_HashAlg* hash, enum wc_HashType type, byte* out)
     #endif
 
         if ((ret = wc_InitSha(sha)) != 0) {
-            WOLFSSL_MSG("wc_InitSha failed");
+            WOLFSSL_MSG("InitSha failed");
         }
         else {
-            wc_ShaUpdate(sha, data, len);
-            wc_ShaFinal(sha, hash);
+            if ((ret = wc_ShaUpdate(sha, data, len)) != 0) {
+                WOLFSSL_MSG("ShaUpdate failed");
+            }
+            else if ((ret = wc_ShaFinal(sha, hash)) != 0) {
+                WOLFSSL_MSG("ShaFinal failed");
+            }
+            wc_ShaFree(sha);
         }
 
     #ifdef WOLFSSL_SMALL_STACK
diff --git a/wolfssl/wolfcrypt/mem_track.h b/wolfssl/wolfcrypt/mem_track.h
index 4689eb51f..d964aadae 100644
--- a/wolfssl/wolfcrypt/mem_track.h
+++ b/wolfssl/wolfcrypt/mem_track.h
@@ -123,7 +123,7 @@
         mt->u.hint.thisSize   = sz;
         mt->u.hint.thisMemory = (byte*)mt + sizeof(memoryTrack);
 
-#ifdef WOLFSSL_DEBUG_MEMORY
+#ifdef WOLFSSL_DEBUG_MEMORY_PRINT
         printf("Alloc: %p -> %u at %s:%d\n", mt->u.hint.thisMemory, (word32)sz, func, line);
 #endif
 
@@ -159,7 +159,7 @@
         ourMemStats.totalDeallocs++;
 #endif
 
-#ifdef WOLFSSL_DEBUG_MEMORY
+#ifdef WOLFSSL_DEBUG_MEMORY_PRINT
         printf("Free: %p -> %u at %s:%d\n", ptr, (word32)mt->u.hint.thisSize, func, line);
 #endif