diff --git a/src/corelib/tools/qcryptographichash.cpp b/src/corelib/tools/qcryptographichash.cpp
index a38e9c2d3b1..af299c91bb0 100644
--- a/src/corelib/tools/qcryptographichash.cpp
+++ b/src/corelib/tools/qcryptographichash.cpp
@@ -1132,13 +1132,15 @@ QByteArrayView QCryptographicHash::hashInto(QSpan<std::byte> buffer,
                                             QSpan<const QByteArrayView> data,
                                             Algorithm method) noexcept
 {
+    if (buffer.size() < hashLengthInternal(method))
+        return {}; // buffer too small
+
     QCryptographicHashPrivate hash(method);
     for (QByteArrayView part : data)
         hash.addData(part);
     hash.finalizeUnchecked(); // no mutex needed: no-one but us has access to 'hash'
     auto result = hash.resultView();
-    if (buffer.size() < result.size())
-        return {}; // buffer too small
+    Q_ASSERT(buffer.size() >= result.size());
     // ### optimize: have the method directly write into `buffer`
     memcpy(buffer.data(), result.data(), result.size());
     return buffer.first(result.size());
diff --git a/tests/auto/corelib/tools/qcryptographichash/tst_qcryptographichash.cpp b/tests/auto/corelib/tools/qcryptographichash/tst_qcryptographichash.cpp
index 47e0ead2708..54298bc92f9 100644
--- a/tests/auto/corelib/tools/qcryptographichash/tst_qcryptographichash.cpp
+++ b/tests/auto/corelib/tools/qcryptographichash/tst_qcryptographichash.cpp
@@ -212,6 +212,9 @@ void tst_QCryptographicHash::static_hash()
 
     std::byte buffer[1024];
     QCOMPARE(QCryptographicHash::hashInto(buffer, first, _algo), hash_first);
+
+    // Too small buffer
+    QVERIFY(QCryptographicHash::hashInto(QSpan{buffer}.first(5), first, _algo).isNull());
 }