diff --git a/components/bt/host/bluedroid/stack/avrc/avrc_api.c b/components/bt/host/bluedroid/stack/avrc/avrc_api.c
index a1099364ea0..d44579088a5 100644
--- a/components/bt/host/bluedroid/stack/avrc/avrc_api.c
+++ b/components/bt/host/bluedroid/stack/avrc/avrc_api.c
@@ -910,11 +910,19 @@ static BT_HDR   *avrc_pass_msg(tAVRC_MSG_PASS *p_msg)
 {
     BT_HDR  *p_cmd = NULL;
     UINT8   *p_data;
+    UINT32  buf_size;
+    UINT16  pass_len;
 
     assert(p_msg != NULL);
-    assert(AVRC_CMD_BUF_SIZE > (AVRC_MIN_CMD_LEN+p_msg->pass_len));
 
-    if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) {
+    /* ctype(1) + subunit(1) + opcode(1) + op_id(1) + data_len(1) + optional pass data */
+    pass_len = (p_msg->op_id == AVRC_ID_VENDOR) ? p_msg->pass_len : 0;
+    buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 5 + pass_len;
+    if (buf_size > AVRC_CMD_BUF_SIZE) {
+        return NULL;
+    }
+
+    if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
         p_cmd->offset   = AVCT_MSG_OFFSET;
         p_cmd->layer_specific   = AVCT_DATA_CTRL;
         p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
diff --git a/components/bt/host/bluedroid/stack/avrc/avrc_opt.c b/components/bt/host/bluedroid/stack/avrc/avrc_opt.c
index ff3a26870f3..d92634a3dc1 100644
--- a/components/bt/host/bluedroid/stack/avrc/avrc_opt.c
+++ b/components/bt/host/bluedroid/stack/avrc/avrc_opt.c
@@ -60,18 +60,20 @@ static BT_HDR   *avrc_vendor_msg(tAVRC_MSG_VENDOR *p_msg)
 */
 #define AVRC_MIN_VENDOR_CMD_LEN (BT_HDR_SIZE + AVCT_MSG_OFFSET + AVRC_VENDOR_HDR_SIZE)
 
+    UINT32 buf_size;
+#if AVRC_METADATA_INCLUDED == TRUE
+    const UINT16 max_cmd_buf = AVRC_META_CMD_BUF_SIZE;
+#else
+    const UINT16 max_cmd_buf = AVRC_CMD_BUF_SIZE;
+#endif
+
     if (!p_msg) {
         return NULL;
     }
 
-#if AVRC_METADATA_INCLUDED == TRUE
-    if ((AVRC_META_CMD_BUF_SIZE >= AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len) &&
-        ((p_cmd = (BT_HDR *) osi_malloc(AVRC_META_CMD_BUF_SIZE)) != NULL))
-#else
-    if ((AVRC_CMD_BUF_SIZE >= (AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len)) &&
-        ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL))
-#endif
-    {
+    buf_size = (UINT32)AVRC_MIN_VENDOR_CMD_LEN + p_msg->vendor_len;
+    if (buf_size <= max_cmd_buf &&
+            ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL)) {
         p_cmd->offset   = AVCT_MSG_OFFSET;
         p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
         *p_data++       = (p_msg->hdr.ctype & AVRC_CTYPE_MASK);
@@ -115,8 +117,10 @@ UINT16 AVRC_UnitCmd(UINT8 handle, UINT8 label)
 {
     BT_HDR  *p_cmd;
     UINT8   *p_data;
+    /* ctype + subunit + opcode + AVRC_UNIT_OPRND_BYTES */
+    UINT32  buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 3 + AVRC_UNIT_OPRND_BYTES;
 
-    if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) {
+    if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
         p_cmd->offset   = AVCT_MSG_OFFSET;
         p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
         *p_data++       = AVRC_CMD_STATUS;
@@ -159,8 +163,10 @@ UINT16 AVRC_SubCmd(UINT8 handle, UINT8 label, UINT8 page)
 {
     BT_HDR  *p_cmd;
     UINT8   *p_data;
+    /* ctype + subunit + opcode + page + AVRC_SUB_OPRND_BYTES */
+    UINT32  buf_size = (UINT32)sizeof(BT_HDR) + AVCT_MSG_OFFSET + 4 + AVRC_SUB_OPRND_BYTES;
 
-    if ((p_cmd = (BT_HDR *) osi_malloc(AVRC_CMD_BUF_SIZE)) != NULL) {
+    if ((p_cmd = (BT_HDR *) osi_malloc(buf_size)) != NULL) {
         p_cmd->offset   = AVCT_MSG_OFFSET;
         p_data          = (UINT8 *)(p_cmd + 1) + p_cmd->offset;
         *p_data++       = AVRC_CMD_STATUS;