Convert.FromHexString exception with too large buffer

src/libraries/System.Private.CoreLib/src/System/Convert.cs

@@ -3007,11 +3007,15 @@ public static OperationStatus FromHexString(ReadOnlySpan<char> source, Span<byte
                 quotient = destination.Length;
                 result = OperationStatus.DestinationTooSmall;
             }
-            else if (remainder == 1)
+            else if (destination.Length > quotient)
             {
-                source = source.Slice(0, source.Length - 1);
-                destination = destination.Slice(0, destination.Length - 1);
+                if (remainder == 1)
+                {
+                    source = source.Slice(0, source.Length - 1);
+                }
+
                 result = OperationStatus.NeedMoreData;
+                destination = destination.Slice(0, quotient);
             }
 
             if (!HexConverter.TryDecodeFromUtf16(source, destination, out charsConsumed))

src/libraries/System.Runtime/tests/System.Runtime.Extensions.Tests/System/Convert.FromHexString.cs

@@ -136,6 +136,18 @@ public static void TooShortDestination()
             Assert.Equal(destinationSize, bytesWritten);
         }
 
+        [Fact]
+        public static void TooLongDestination()
+        {
+            string hex = Convert.ToHexString([255, 255, 255]);
+            byte[] buffer = new byte[100];
+            var status = Convert.FromHexString(hex, buffer, out int charsConsumed, out int bytesWritten);
+
+            Assert.Equal(OperationStatus.NeedMoreData, status);
+            Assert.Equal(hex.Length, charsConsumed);
+            Assert.Equal(hex.Length / 2, bytesWritten);
+        }
+
         [Fact]
         public static void NeedMoreData_OrFormatException()
         {
@@ -152,6 +164,7 @@ public static void NeedMoreData_OrFormatException()
             Assert.Equal(0, consumed);
             Assert.Equal(0, written);
 
+            // Odd length
             spanHex = hex.AsSpan(0, hex.Length - 1);
 
             var oneOffResult = Convert.FromHexString(spanHex, destination, out consumed, out written);
@@ -160,6 +173,15 @@ public static void NeedMoreData_OrFormatException()
             Assert.Equal(OperationStatus.NeedMoreData, oneOffResult);
             Assert.Equal(spanHex.Length - 1, consumed);
             Assert.Equal((spanHex.Length - 1) / 2, written);
+
+            // Even length
+            spanHex = hex.AsSpan(0, hex.Length - 2);
+
+            var twoOffResult = Convert.FromHexString(spanHex, destination, out consumed, out written);
+
+            Assert.Equal(OperationStatus.NeedMoreData, twoOffResult);
+            Assert.Equal(spanHex.Length, consumed);
+            Assert.Equal(spanHex.Length / 2, written);
         }
     }
 }