For HIDs that use only the default report ID of zero, the host knows the report length, and thus the transfer length, from the report descriptor.
When a HID uses multiple report IDs, the transfer begins with the report ID so the host will know the expected report length from that as well.
A short packet (which may be a zero-length data packet) indicates end of transfer when needed. From the HID spec, 8.4:
All reports except the longest which exceed wMaxPacketSize for the endpoint
must terminate with a short packet. The longest report does not require a short
packet terminator.
If there are multiple reports in a top level collection then all reports, except the
longest, must terminate with a short packet.