diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 6f9203d..cc70510 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -9959,11 +9959,14 @@
 }
 
 /*
- * Unserialise session, see ssl_save_session()
+ * Unserialise session, see mbedtls_ssl_session_save().
+ *
+ * This internal version is wrapped by a public function that cleans up in
+ * case of error.
  */
-int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
-                              const unsigned char *buf,
-                              size_t len )
+static int ssl_session_load( mbedtls_ssl_session *session,
+                             const unsigned char *buf,
+                             size_t len )
 {
     const unsigned char *p = buf;
     const unsigned char * const end = buf + len;
@@ -10092,6 +10095,21 @@
 }
 
 /*
+ * Unserialise session: public wrapper for error cleaning
+ */
+int mbedtls_ssl_session_load( mbedtls_ssl_session *session,
+                              const unsigned char *buf,
+                              size_t len )
+{
+    int ret = ssl_session_load( session, buf, len );
+
+    if( ret != 0 )
+        mbedtls_ssl_session_free( session );
+
+    return( ret );
+}
+
+/*
  * Perform a single step of the SSL handshake
  */
 int mbedtls_ssl_handshake_step( mbedtls_ssl_context *ssl )