Annotate false positive tainted_data (CID #1243443) (#4717)

Coverity doesn't realize that eap_validation(), which is called
before eap_identity(), range checks the length.

diff --git a/src/lib/eap/session.c b/src/lib/eap/session.c
index 68751f88276a1ed966740340a83d1db33cd22cb3..9aeba055f9f818cde75a9d6f10170b5e820dc14f 100644 (file)
--- a/src/lib/eap/session.c
+++ b/src/lib/eap/session.c
@@ -273,6 +273,7 @@ static char *eap_identity(request_t *request, eap_session_t *eap_session, eap_pa
         *      If the length is 5, then a buffer with a length of 1 is
         *      created with a \0 byte.
         */
+       /* coverity[tainted_data] */
        return talloc_bstrndup(eap_session, (char *)&eap_packet->data[1], len - 5);
 }