1 files changed, 9 insertions, 0 deletions
diff --git a/stack/hid/hidh_conn.cc b/stack/hid/hidh_conn.cc
index 1ab03b75f..a41aa909d 100644
--- a/stack/hid/hidh_conn.cc
+++ b/stack/hid/hidh_conn.cc
@@ -42,6 +42,7 @@
 #include "hidh_api.h"
 #include "hidh_int.h"
 
+#include "log/log.h"
 #include "osi/include/osi.h"
 
 static uint8_t find_conn_by_cid(uint16_t cid);
@@ -799,6 +800,14 @@ static void hidh_l2cif_data_ind(uint16_t l2cap_cid, BT_HDR* p_msg) {
     return;
   }
 
+  if (p_msg->len < 1) {
+    HIDH_TRACE_WARNING("Rcvd L2CAP data, invalid length %d, should be >= 1",
+                       p_msg->len);
+    osi_free(p_msg);
+    android_errorWriteLog(0x534e4554, "80493272");
+    return;
+  }
+
   ttype = HID_GET_TRANS_FROM_HDR(*p_data);
   param = HID_GET_PARAM_FROM_HDR(*p_data);
   rep_type = param & HID_PAR_REP_TYPE_MASK;