1 files changed, 3 insertions, 2 deletions

diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
index c1dd39eaaeeb..6116cd05e228 100644
--- a/drivers/char/tpm/tpm_i2c_infineon.c
+++ b/drivers/char/tpm/tpm_i2c_infineon.c
@@ -473,7 +473,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
 static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 {
         int size = 0;
-        int expected, status;
+        int status;
+        u32 expected;
 
         if (count < TPM_HEADER_SIZE) {
                 size = -EIO;
@@ -488,7 +489,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
         }
 
         expected = be32_to_cpu(*(__be32 *)(buf + 2));
-        if ((size_t) expected > count) {
+        if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) {
                 size = -EIO;
                 goto out;
         }