diff --git a/lib/dns/rdata/generic/hip_55.c b/lib/dns/rdata/generic/hip_55.c
index 5198497dcb..e69c2685a0 100644
--- a/lib/dns/rdata/generic/hip_55.c
+++ b/lib/dns/rdata/generic/hip_55.c
@@ -318,6 +318,8 @@ tostruct_hip(ARGS_TOSTRUCT) {
 		goto cleanup;
 	isc_region_consume(&region, hip->hit_len);
 
+	INSIST(hip->key_len <= region.length);
+
 	hip->key = mem_maybedup(mctx, region.base, hip->key_len);
 	if (hip->key == NULL)
 		goto cleanup;