--- old/src/java.base/share/classes/sun/security/provider/ByteArrayAccess.java	2016-04-05 10:16:50.000000000 +0800
+++ new/src/java.base/share/classes/sun/security/provider/ByteArrayAccess.java	2016-04-05 10:16:50.000000000 +0800
@@ -448,10 +448,12 @@
             out[outOfs++] = (byte)(i >> 48);
             out[outOfs++] = (byte)(i >> 40);
             out[outOfs++] = (byte)(i >> 32);
-            out[outOfs++] = (byte)(i >> 24);
-            out[outOfs++] = (byte)(i >> 16);
-            out[outOfs++] = (byte)(i >>  8);
-            out[outOfs++] = (byte)(i      );
+            if (outOfs < len) {     // SHA-512/224 is 28 bytes
+                out[outOfs++] = (byte) (i >> 24);
+                out[outOfs++] = (byte) (i >> 16);
+                out[outOfs++] = (byte) (i >> 8);
+                out[outOfs++] = (byte) (i);
+            }
         }
     }
 }