From de369a5cfc35da40fc71e4f8a9d346db536f62ec Mon Sep 17 00:00:00 2001
From: Jin Cheng <jinCheng@espressif.com>
Date: Fri, 29 May 2026 15:47:40 +0800
Subject: [PATCH] fix(bt/bluedroid): added buffer length check for HID Device
 data indication

---
 components/bt/host/bluedroid/stack/hid/hidd_conn.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/components/bt/host/bluedroid/stack/hid/hidd_conn.c b/components/bt/host/bluedroid/stack/hid/hidd_conn.c
index 6984bc9a1c0..576d82bdbfb 100644
--- a/components/bt/host/bluedroid/stack/hid/hidd_conn.c
+++ b/components/bt/host/bluedroid/stack/hid/hidd_conn.c
@@ -507,6 +507,11 @@ static void hidd_l2cif_data_ind(uint16_t cid, BT_HDR *p_msg)
         osi_free(p_msg);
         return;
     }
+    if (p_msg->len < 1) {
+        HIDD_TRACE_WARNING ("HID-Device Rcvd Empty L2CAP data");
+        osi_free(p_msg);
+        return;
+    }
     msg_type = HID_GET_TRANS_FROM_HDR(*p_data);
     param = HID_GET_PARAM_FROM_HDR(*p_data);
     if (msg_type == HID_TRANS_DATA && cid == p_hcon->intr_cid) {