diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index 086a6fc..03180c6 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -1503,6 +1503,7 @@
 generate_key_expansion_openvpn_prf(const struct tls_session *session, struct key2 *key2)
 {
     uint8_t master[48] = { 0 };
+    bool ret = false;
 
     const struct key_state *ks = &session->key[KS_PRIMARY];
     const struct key_source2 *key_src = ks->key_src;
@@ -1521,7 +1522,7 @@
                      sizeof(key_src->client.random1), key_src->server.random1,
                      sizeof(key_src->server.random1), NULL, NULL, master, sizeof(master)))
     {
-        return false;
+        goto exit;
     }
 
     /* compute key expansion */
@@ -1530,13 +1531,15 @@
                      key_src->server.random2, sizeof(key_src->server.random2), client_sid,
                      server_sid, (uint8_t *)key2->keys, sizeof(key2->keys)))
     {
-        return false;
+        goto exit;
     }
-    secure_memzero(&master, sizeof(master));
 
     key2->n = 2;
+    ret = true;
 
-    return true;
+exit:
+    secure_memzero(&master, sizeof(master));
+    return ret;
 }
 
 /*