Add an assert for a correct buffer size.

It is not immediately clear that the memcpy below the added assert is
valid and does not access out of bounds. The added assert would hit if
the memcpy ever were out of bounds.

The access is actually safe and the assert will never hit because
of the "if (frag_off > msg_len || frag_len > msg_len - frag_off) {"
check and the fact that dtls1_parse_fragment ensures body's length
is exactly frag_len; however this seems rather fragile so I'd still
like to have this assert just in case this breaks. Also, this depends
on dtls1_get_incoming_message and dtls_new_incoming_message as well...
just the fact that a later code change could break this invariant
seems reason enough to add this assert, and be it just to document the
invariant.

Found while auditing use of subspan.

Tested: IDA/Diaphora and ghidriff find no differences in generated code
other than type identifiers with the extra template argument.

Change-Id: I33ceeb559ade726ac9d62495bfe1748c298f5ac1
Bug: 390229582
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/82927
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: David Benjamin <davidben@google.com>
Auto-Submit: Rudolf Polzer <rpolzer@google.com>

ssl/d1_both.cc

diff --git a/ssl/d1_both.cc b/ssl/d1_both.cc
index c81e6f5..ef0a95c 100644
--- a/ssl/d1_both.cc
+++ b/ssl/d1_both.cc
@@ -337,6 +337,7 @@
 
     // Copy the body into the fragment.
     Span<uint8_t> dest = frag->msg().subspan(frag_off, CBS_len(&body));
+    assert(dest.size() == CBS_len(&body));
     OPENSSL_memcpy(dest.data(), CBS_data(&body), CBS_len(&body));
     frag->reassembly.MarkRange(frag_off, frag_off + frag_len);
   }