src/java.base/share/classes/sun/security/provider/ByteArrayAccess.java

rev 13987 : 8051408: NIST SP 800-90A SecureRandom implementations

@@ -446,12 +446,14 @@
             long i = in[inOfs++];
             out[outOfs++] = (byte)(i >> 56);
             out[outOfs++] = (byte)(i >> 48);
             out[outOfs++] = (byte)(i >> 40);
             out[outOfs++] = (byte)(i >> 32);
-            out[outOfs++] = (byte)(i >> 24);
-            out[outOfs++] = (byte)(i >> 16);
-            out[outOfs++] = (byte)(i >>  8);
-            out[outOfs++] = (byte)(i      );
+            if (outOfs < len) {     // SHA-512/224 is 28 bytes
+                out[outOfs++] = (byte) (i >> 24);
+                out[outOfs++] = (byte) (i >> 16);
+                out[outOfs++] = (byte) (i >> 8);
+                out[outOfs++] = (byte) (i);
+            }
         }
     }
 }