diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c
index 599879d35..b1d9b674a 100644
--- a/wpa_supplicant/bss.c
+++ b/wpa_supplicant/bss.c
@@ -570,22 +570,25 @@ int wpa_bss_get_max_rate(const struct wpa_bss *bss)
 int wpa_bss_get_bit_rates(const struct wpa_bss *bss, u8 **rates)
 {
 	const u8 *ie, *ie2;
-	int i, j, len;
+	int i, j;
+	unsigned int len;
+	u8 *r;
 
 	ie = wpa_bss_get_ie(bss, WLAN_EID_SUPP_RATES);
 	ie2 = wpa_bss_get_ie(bss, WLAN_EID_EXT_SUPP_RATES);
 
 	len = (ie ? ie[1] : 0) + (ie2 ? ie2[1] : 0);
 
-	*rates = os_malloc(len);
-	if (!*rates)
+	r = os_malloc(len);
+	if (!r)
 		return -1;
 
 	for (i = 0; ie && i < ie[1]; i++)
-		(*rates)[i] = ie[i + 2] & 0x7f;
+		r[i] = ie[i + 2] & 0x7f;
 
 	for (j = 0; ie2 && j < ie2[1]; j++)
-		(*rates)[i + j] = ie2[j + 2] & 0x7f;
+		r[i + j] = ie2[j + 2] & 0x7f;
 
+	*rates = r;
 	return len;
 }