check value to quiet coverity

the dbuff code ensures that we don't loop over too much data, but
Coverity doesn't know that.

diff --git a/src/lib/util/cbor.c b/src/lib/util/cbor.c
index 8337915d0463781403d680cf6dd2fc97f0e0ca56..8eba200ab77f853e58caf07d5d3e8ded8d478f0a 100644 (file)
--- a/src/lib/util/cbor.c
+++ b/src/lib/util/cbor.c
@@ -1152,6 +1152,10 @@ ssize_t fr_cbor_decode_value_box(TALLOC_CTX *ctx, fr_value_box_t *vb, fr_dbuff_t
                        indefinite = false;
                }
 
+#ifdef STATIC_ANALYZER
+               if (value > fr_dbuff_remaining(&work_dbuff)) return -1;
+#endif
+
                /*
                 *      Loop until we decode everything.  For simplicity, we handle indefinite and definite
                 *      length arrays in the same loop.
@@ -1514,6 +1518,10 @@ ssize_t fr_cbor_decode_pair(TALLOC_CTX *ctx, fr_pair_list_t *out, fr_dbuff_t *db
                indefinite = false;
        }
 
+#ifdef STATIC_ANALYZER
+       if (value > fr_dbuff_remaining(&work_dbuff)) return -1;
+#endif
+
        /*
         *      Loop until we decode everything.  For simplicity, we handle indefinite and definite
         *      length arrays in the same loop.