MT#55283 check skb->len against UDP header

Change-Id: Idda845297199fcd70f06bc375eeb30a362ee2a68
(cherry picked from commit ca0b2f76e6)
(cherry picked from commit 35c971a20e)

kernel-module/nft_rtpengine.c

@@ -7154,7 +7154,7 @@ static int rtpengine46(struct sk_buff *oskb,
 			g->decrypt_rtp.cipher->name);
 
 	datalen = ntohs(uh->len);
-	if (datalen < sizeof(*uh))
+	if (datalen < sizeof(*uh) || datalen > oskb->len - (oskb->transport_header - oskb->network_header))
 		goto out_target;
 	datalen -= sizeof(*uh);
 	DBG("udp payload = %u\n", datalen);