Potential bug in TryWriteBytes (#2049)

InnerText has odd length (3 chars). Integer division means
InnerText.Length / 2 == 1, so a 1-byte buffer "matches" the truncated
size. The guard on line 142 uses && instead of ||, so it falls through
and the loop throws on the last Slice.

Author: SimonCropp

src/DocumentFormat.OpenXml.Framework/SimpleTypes/HexBinaryValue.cs

@@ -139,7 +139,7 @@ bool TryWriteBytes(Span<byte> bytes)
                 return false;
             }
 
-            if (InnerText.Length % 2 != 0 && bytes.Length != InnerText.Length / 2)
+            if (InnerText.Length % 2 != 0 || bytes.Length != InnerText.Length / 2)
             {
                 return false;
             }

test/DocumentFormat.OpenXml.Tests/SimpleTypes/HexBinaryValueTests.cs

@@ -74,6 +74,19 @@ public void GetBytes()
                 b => Assert.Equal(0x01, b));
         }
 
+        [Fact]
+        public void TryWriteBytesWithOddLengthReturnsFalse()
+        {
+            // InnerText has odd length (3 chars). Integer division means
+            // InnerText.Length / 2 == 1, so a 1-byte buffer "matches" the
+            // truncated size. The guard on line 142 uses && instead of ||,
+            // so it falls through and the loop throws on the last Slice.
+            HexBinaryValue type = new("FFF");
+            var buffer = new byte[1]; // InnerText.Length / 2 with integer division
+
+            Assert.False(type.TryWriteBytes(buffer));
+        }
+
         [Fact]
         public void CreateFromBytes()
         {