diff --git a/wolfcrypt/src/blake2b.c b/wolfcrypt/src/blake2b.c
index c1f3e7a80..311d19148 100644
--- a/wolfcrypt/src/blake2b.c
+++ b/wolfcrypt/src/blake2b.c
@@ -356,6 +356,8 @@ int blake2b_final( blake2b_state *S, byte *out, byte outlen )
     }
 
     S->buflen -= BLAKE2B_BLOCKBYTES;
+    if ( S->buflen >= (BLAKE2B_BLOCKBYTES * 2) )
+      return BAD_LENGTH_E;
     XMEMCPY( S->buf, S->buf + BLAKE2B_BLOCKBYTES, (wolfssl_word)S->buflen );
   }