libsimaka: Prevent out-of-bounds read when parsing attributes with actual length field

These attributes contain a 16-bit length field for the actual length of
the data in bits or bytes, as compared to the length in 4-byte blocks in
the attribute header.  The previous code didn't correctly account for the
length of the fixed header (4 bytes) when it compared the parsed length
to the length in the header.  This could cause an out-of-bounds read of
up to four bytes beyond the end of the attribute/message.

Fixes: f8330d0395 ("Added a libsimaka library with shared message handling code for EAP-SIM/AKA")

src/libsimaka/simaka_message.c

@@ -374,7 +374,7 @@ static bool parse_attributes(private_simaka_message_t *this, chunk_t in)
 			{
 				uint16_t len;
 
-				if (hdr->length < 1 || in.len < 4)
+				if (hdr->length < 1 || in.len < hdr->length * 4)
 				{
 					return invalid_length(hdr->type);
 				}
@@ -384,7 +384,7 @@ static bool parse_attributes(private_simaka_message_t *this, chunk_t in)
 				{	/* AT_RES uses length encoding in bits */
 					len /= 8;
 				}
-				if (len > hdr->length * 4 || len > in.len)
+				if (len > hdr->length * 4 - 4)
 				{
 					return invalid_length(hdr->type);
 				}