Fix unsigned underflow in inject_cached_message

I have reviewed the patch(011-inject-cached-message-underflow) from Emond.
It has also passed all regression tests.

This patch modifies the packet length validation in inject_cached_message to prevent
a session crash caused by an unsigned integer underflow.

Previously, the logic determined whether to process a query cache message by checking
if the packet length minus its header size was greater than zero(if ((ntohl(len) - sizeof(len)) > 0)).

However, this evaluation method introduced a critical vulnerability under unsigned arithmetic rules.

When a corrupt packet with a payload length shorter than the header size is processed,
the subtraction underflows into a massive positive integer,
bypassing the guard and forcing a fatal memory allocation failure that terminates the session.
In our local test environment, injecting a short packet successfully reproduced this exact behavior,
causing a memory context allocation crash.

The updated logic changes the condition to a direct comparison
before subtraction(if (ntohl(len) > (uint32) sizeof(len))),
ensuring that invalid short packets are securely blocked and the session remains stable,
which proves the fix is highly valid.

Thank you Emond.

Taiki Koshino<koshino(at)sraoss(dot)co(dot)jp>
SRA OSS K.K.
TEL: 03-5979-2701 FAX: 03-5979-2702
URL: https://www.sraoss.co.jp/