add INSISTs to silence tainted data false positive in Coverity

(cherry picked from commit 83a5c670b82ac019385c787839af4bc20ea06aef)

diff --git a/lib/dns/rdata/generic/hip_55.c b/lib/dns/rdata/generic/hip_55.c
index 5198497dcb07824fab5629b554942c2af4675090..e69c2685a01e976d6fb59f9d5c34e82322188486 100644 (file)
--- a/lib/dns/rdata/generic/hip_55.c
+++ b/lib/dns/rdata/generic/hip_55.c
@@ -318,6 +318,8 @@ tostruct_hip(ARGS_TOSTRUCT) {
                goto cleanup;
        isc_region_consume(&region, hip->hit_len);
 
+       INSIST(hip->key_len <= region.length);
+
        hip->key = mem_maybedup(mctx, region.base, hip->key_len);
        if (hip->key == NULL)
                goto cleanup;