diff --git a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c
index e79a442dd76..380fba7d2c7 100644
--- a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c
+++ b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c
@@ -74,7 +74,13 @@ static int crypto_ec_point_mul_ecc_hw(const mbedtls_ecp_group *grp,
     ecc_point_t p_hw = { 0 };
     ecc_point_t r_hw = { 0 };
     unsigned char scalar_le[MAX_SIZE] = { 0 };
-    size_t curve_len = grp->pbits / 8;
+    size_t curve_len;
+
+    if (!grp || !p || !k || !res) {
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+    }
+
+    curve_len = grp->pbits / 8;
 
     if (!crypto_ec_point_mul_curve_supported(grp)) {
         return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
@@ -814,7 +820,11 @@ static int crypto_ec_point_mul_p256_window4_core(const mbedtls_ecp_group *grp,
     int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
     bool started = false;
 
-    if (!grp || grp->id != MBEDTLS_ECP_DP_SECP256R1 ||
+    if (!grp || !p || !k || !r) {
+        return MBEDTLS_ERR_ECP_BAD_INPUT_DATA;
+    }
+
+    if (grp->id != MBEDTLS_ECP_DP_SECP256R1 ||
             mbedtls_mpi_cmp_int(&p->MBEDTLS_PRIVATE(Z), 1) != 0) {
         return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
     }
@@ -1043,6 +1053,10 @@ int crypto_ec_point_mul(struct crypto_ec *e, const struct crypto_ec_point *p,
 {
     int ret;
 
+    if (!e || !p || !b || !res) {
+        return -1;
+    }
+
     ret = crypto_ec_point_mul_fast((mbedtls_ecp_group *) e,
                                    (const mbedtls_ecp_point *) p,
                                    (const mbedtls_mpi *) b,
diff --git a/components/wpa_supplicant/src/common/sae.c b/components/wpa_supplicant/src/common/sae.c
index f02095f9af9..18fba4c3f9a 100644
--- a/components/wpa_supplicant/src/common/sae.c
+++ b/components/wpa_supplicant/src/common/sae.c
@@ -406,6 +406,7 @@ static int sae_derive_pwe_ecc(struct sae_data *sae, const u8 *addr1,
 	    crypto_bignum_to_bin(y, x_y + SAE_MAX_ECC_PRIME_LEN,
 				 SAE_MAX_ECC_PRIME_LEN, prime_len) < 0) {
 		wpa_printf(MSG_DEBUG, "SAE: Could not solve y");
+		res = -1;
 		goto fail;
 	}