diff --git a/src/libtls/tls_peer.c b/src/libtls/tls_peer.c
index bfdba3eab..ed2031128 100644
--- a/src/libtls/tls_peer.c
+++ b/src/libtls/tls_peer.c
@@ -1013,7 +1013,7 @@ static status_t process_hello_done(private_tls_peer_t *this,
  */
 static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 {
-	chunk_t received, verify_data;
+	chunk_t received, verify_data = chunk_empty;
 	u_char buf[12];
 
 	if (this->tls->get_version_max(this->tls) < TLS_1_3)
@@ -1040,7 +1040,7 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 		{
 			DBG1(DBG_TLS, "calculating server finished failed");
 			this->alert->add(this->alert, TLS_FATAL, TLS_INTERNAL_ERROR);
-			return NEED_MORE;
+			goto out;
 		}
 	}
 
@@ -1048,16 +1048,17 @@ static status_t process_finished(private_tls_peer_t *this, bio_reader_t *reader)
 	{
 		DBG1(DBG_TLS, "received server finished invalid");
 		this->alert->add(this->alert, TLS_FATAL, TLS_DECRYPT_ERROR);
-		return NEED_MORE;
-	}
-
-	if (verify_data.ptr != buf)
-	{
-		chunk_free(&verify_data);
+		goto out;
 	}
 
 	this->crypto->append_handshake(this->crypto, TLS_FINISHED, received);
 	this->state = STATE_FINISHED_RECEIVED;
+
+out:
+	if (verify_data.ptr && verify_data.ptr != buf)
+	{
+		chunk_free(&verify_data);
+	}
 	return NEED_MORE;
 }