netfilter: nf_ct_sip: don't drop packets with offsets pointing outside the packet