diff --git a/library/cmac.c b/library/cmac.c
index 62f2a6abb..ee2fe056c 100644
--- a/library/cmac.c
+++ b/library/cmac.c
@@ -737,19 +737,19 @@ static int cmac_test_subkeys( int verbose,
         return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
     }
 
-    mbedtls_cipher_init( &ctx );
-
     for( i = 0; i < num_tests; i++ )
     {
         if( verbose != 0 )
             mbedtls_printf( "  %s CMAC subkey #%u: ", testname, i + 1 );
 
+        mbedtls_cipher_init( &ctx );
+
         if( ( ret = mbedtls_cipher_setup( &ctx, cipher_info ) ) != 0 )
         {
             if( verbose != 0 )
                 mbedtls_printf( "test execution failed\n" );
 
-            goto exit;
+            goto cleanup;
         }
 
         if( ( ret = mbedtls_cipher_setkey( &ctx, key, keybits,
@@ -758,7 +758,7 @@ static int cmac_test_subkeys( int verbose,
             if( verbose != 0 )
                 mbedtls_printf( "test execution failed\n" );
 
-            goto exit;
+            goto cleanup;
         }
 
         ret = cmac_generate_subkeys( &ctx, K1, K2 );
@@ -766,7 +766,8 @@ static int cmac_test_subkeys( int verbose,
         {
            if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
-            goto exit;
+
+            goto cleanup;
         }
 
         if( ( ret = memcmp( K1, subkeys, block_size ) ) != 0  ||
@@ -774,16 +775,22 @@ static int cmac_test_subkeys( int verbose,
         {
             if( verbose != 0 )
                 mbedtls_printf( "failed\n" );
-            goto exit;
+
+            goto cleanup;
         }
 
         if( verbose != 0 )
             mbedtls_printf( "passed\n" );
+
+        mbedtls_cipher_free( &ctx );
     }
 
-exit:
+    goto exit;
+
+cleanup:
     mbedtls_cipher_free( &ctx );
 
+exit:
     return( ret );
 }
 
diff --git a/tests/suites/test_suite_cmac.function b/tests/suites/test_suite_cmac.function
index 0cb437b67..4b31ab2ff 100644
--- a/tests/suites/test_suite_cmac.function
+++ b/tests/suites/test_suite_cmac.function
@@ -93,7 +93,6 @@ void mbedtls_cmac_null_args( )
                                            NULL ) ==
                                               MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
 
-
 exit:
     mbedtls_cipher_free( &ctx );
 }
@@ -114,6 +113,7 @@ void mbedtls_cmac_setkey( int cipher_type, int key_size,
     TEST_ASSERT( ( cipher_info = mbedtls_cipher_info_from_type( cipher_type ) )
                     != NULL );
 
+    memset( buf, 0x2A, sizeof( buf ) );
     TEST_ASSERT( ( result == mbedtls_cipher_cmac( cipher_info, key, key_size,
                                                 buf, 16, tmp ) ) != 0 );
 }