diff --git a/components/bt/bluedroid/stack/hcic/hciblecmds.c b/components/bt/bluedroid/stack/hcic/hciblecmds.c
index a34806fdb..87785749b 100644
--- a/components/bt/bluedroid/stack/hcic/hciblecmds.c
+++ b/components/bt/bluedroid/stack/hcic/hciblecmds.c
@@ -33,7 +33,7 @@
 #include <stddef.h>
 #include <string.h>
 
-#define HCI_GET_CMD_BUF(paramlen)       ((BT_HDR *)osi_malloc(HCI_CMD_BUF_SIZE))
+#define HCI_GET_CMD_BUF(paramlen)       ((BT_HDR *)osi_malloc(HCIC_PREAMBLE_SIZE + sizeof(BT_HDR) + paramlen))
 
 #if (defined BLE_INCLUDED) && (BLE_INCLUDED == TRUE)
 
@@ -524,7 +524,7 @@ BOOLEAN btsnd_hcic_ble_encrypt (UINT8 *key, UINT8 key_len,
     BT_HDR *p;
     UINT8 *pp;
 
-    if ((p = HCI_GET_CMD_BUF(sizeof(BT_HDR) + sizeof (void *) +
+    if ((p = HCI_GET_CMD_BUF(sizeof (void *) +
                              HCIC_PARAM_SIZE_BLE_ENCRYPT)) == NULL) {
         return (FALSE);
     }
@@ -563,7 +563,7 @@ BOOLEAN btsnd_hcic_ble_rand (void *p_cmd_cplt_cback)
     BT_HDR *p;
     UINT8 *pp;
 
-    if ((p = HCI_GET_CMD_BUF(sizeof(BT_HDR) + sizeof (void *) +
+    if ((p = HCI_GET_CMD_BUF(sizeof (void *) +
                              HCIC_PARAM_SIZE_BLE_RAND)) == NULL) {
         return (FALSE);
     }
@@ -1004,17 +1004,17 @@ BOOLEAN btsnd_hcic_ble_update_adv_report_flow_control (UINT16 num)
     BT_HDR *p;
     UINT8 *pp;
 
-    if ((p = HCI_GET_CMD_BUF (1)) == NULL) {
+    if ((p = HCI_GET_CMD_BUF (HCIC_PARAM_SIZE_BLE_UPDATE_ADV_FLOW_CONTROL)) == NULL) {
         return (FALSE);
     }
 
     pp = (UINT8 *)(p + 1);
 
-    p->len = HCIC_PREAMBLE_SIZE + 2;
+    p->len = HCIC_PREAMBLE_SIZE + HCIC_PARAM_SIZE_BLE_UPDATE_ADV_FLOW_CONTROL;
     p->offset = 0;
 
     UINT16_TO_STREAM (pp, HCI_VENDOR_BLE_ADV_REPORT_FLOW_CONTROL);
-    UINT8_TO_STREAM (pp, 2);
+    UINT8_TO_STREAM (pp, HCIC_PARAM_SIZE_BLE_UPDATE_ADV_FLOW_CONTROL);
     UINT16_TO_STREAM (pp, num);
 
     btu_hcif_send_cmd (LOCAL_BR_EDR_CONTROLLER_ID, p);
diff --git a/components/bt/bluedroid/stack/hcic/hcicmds.c b/components/bt/bluedroid/stack/hcic/hcicmds.c
index 5c5f1f4a1..69944315e 100644
--- a/components/bt/bluedroid/stack/hcic/hcicmds.c
+++ b/components/bt/bluedroid/stack/hcic/hcicmds.c
@@ -35,7 +35,7 @@
 
 #include "btm_int.h"    /* Included for UIPC_* macro definitions */
 
-#define HCI_GET_CMD_BUF(paramlen)       ((BT_HDR *)osi_malloc(HCI_CMD_BUF_SIZE))
+#define HCI_GET_CMD_BUF(paramlen)       ((BT_HDR *)osi_malloc(HCIC_PREAMBLE_SIZE + sizeof(BT_HDR) + paramlen))
 
 BOOLEAN btsnd_hcic_inquiry(const LAP inq_lap, UINT8 duration, UINT8 response_cnt)
 {
diff --git a/components/bt/bluedroid/stack/include/stack/hcimsgs.h b/components/bt/bluedroid/stack/include/stack/hcimsgs.h
index 04a7ba438..8da0cbaa2 100644
--- a/components/bt/bluedroid/stack/include/stack/hcimsgs.h
+++ b/components/bt/bluedroid/stack/include/stack/hcimsgs.h
@@ -688,6 +688,7 @@ void btsnd_hcic_vendor_spec_cmd (void *buffer, UINT16 opcode,
 #define HCIC_PARAM_SIZE_BLE_SET_RAND_PRIV_ADDR_TIMOUT   2
 #define HCIC_PARAM_SIZE_BLE_SET_DATA_LENGTH             6
 #define HCIC_PARAM_SIZE_BLE_WRITE_EXTENDED_SCAN_PARAM  11
+#define HCIC_PARAM_SIZE_BLE_UPDATE_ADV_FLOW_CONTROL    2
 
 /* ULP HCI command */
 BOOLEAN btsnd_hcic_ble_set_evt_mask (BT_EVENT_MASK event_mask);