From a4e6fa2f42b5371783646c1507ea30ff26416ad3 Mon Sep 17 00:00:00 2001
From: Jin Cheng <jinCheng@espressif.com>
Date: Fri, 29 May 2026 14:25:09 +0800
Subject: [PATCH] fix(bt/bluedroid): added buffer length check for HID host
 data indication

---
 components/bt/host/bluedroid/stack/hid/hidh_conn.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/components/bt/host/bluedroid/stack/hid/hidh_conn.c b/components/bt/host/bluedroid/stack/hid/hidh_conn.c
index da880a1ebc3..170bfce7e92 100644
--- a/components/bt/host/bluedroid/stack/hid/hidh_conn.c
+++ b/components/bt/host/bluedroid/stack/hid/hidh_conn.c
@@ -766,6 +766,11 @@ static void hidh_l2cif_data_ind (UINT16 l2cap_cid, BT_HDR *p_msg)
         return;
     }
 
+    if (p_msg->len < 1) {
+        HIDH_TRACE_WARNING ("HID-Host Rcvd Empty L2CAP data");
+        osi_free (p_msg);
+        return;
+    }
 
     ttype    = HID_GET_TRANS_FROM_HDR(*p_data);
     param    = HID_GET_PARAM_FROM_HDR(*p_data);