## Describe the bug
The AMF crashed when receiving a short plaintext initial NAS message with a security header type greater than 0 from UE. This bug is caused by a missing length check of the payload. 

## To Reproduce
Steps to reproduce the behavior:
1. Run free5gc with default config.
2. Connect UERANSIM gNB (or any other compatible gNB implementations) with free5GC
3. Use UERANSIM UE (or any other compatible UE implementations) to send an initial NAS message with a payload length less than 6 (without header), and a security header type greater than 0. (e.g., 0x7E025F74)

The malformed packet can be sent by modifying sendNasMessage() function in src/ue/nas/mm/messaging.cpp of UERANSIM. 

## Expected behavior
The program should discard the malformed packet instead of a crash. 

## Environment (please complete the following information):
 - free5GC Version: v3.3.0
 - OS: Ubuntu 22.04 LTS
 - Kernel version: 6.2.0-39-generic
 - go version: 1.21.5 linux/amd64

## Trace File
### Configuration File

Use the default configuration file

### PCAP File

[free5gc_crash_ngap.zip](https://github.com/free5gc/free5gc/files/13814407/free5gc_crash_ngap.zip)

### Log File

[FATA][AMF][Ngap] panic: runtime error: slice bounds out of range [7:4]
goroutine 44 [running]:
runtime/debug.Stack()
/snap/go/10426/src/runtime/debug/stack.go:24 +0x5e
[github.com/free5gc/amf/internal/ngap/service.handleConnection.func1()](http://github.com/free5gc/amf/internal/ngap/service.handleConnection.func1())
/free5gc/NFs/amf/internal/ngap/service/service.go:184 +0x45
panic({0xc64940?, 0xc0005281b0?})
/snap/go/10426/src/runtime/panic.go:914 +0x21f
[github.com/free5gc/amf/internal/nas/nas_security.DecodePlainNasNoIntegrityCheck](http://github.com/free5gc/amf/internal/nas/nas_security.DecodePlainNasNoIntegrityCheck)({0xc000433760, 0x6, 0x8})
/free5gc/NFs/amf/internal/nas/nas_security/security.go:362 +0x11d
[github.com/free5gc/amf/internal/ngap.handleInitialUEMessageMain](http://github.com/free5gc/amf/internal/ngap.handleInitialUEMessageMain)(0xc0004da000, 0xc0002f2040, 0xc0004333e8, 0xc000246030, 0xc00078c600, 0xc00047a1e8, 0x0, 0xc00047a4e8, 0xc000128c68?)
/free5gc/NFs/amf/internal/ngap/handler.go:451 +0x2e5
[github.com/free5gc/amf/internal/ngap.handlerInitialUEMessage](http://github.com/free5gc/amf/internal/ngap.handlerInitialUEMessage)(0xc0004da000, 0xc53da0?, 0xc0007b41c0)
/free5gc/NFs/amf/internal/ngap/handler_generated.go:3503 +0x14cf
[github.com/free5gc/amf/internal/ngap.dispatchMain](http://github.com/free5gc/amf/internal/ngap.dispatchMain)(0xc0004da000, 0x3a?)
/free5gc/NFs/amf/internal/ngap/dispatcher_generated.go:49 +0x12f
[github.com/free5gc/amf/internal/ngap.Dispatch](http://github.com/free5gc/amf/internal/ngap.Dispatch)({0xe1a3f8?, 0xc0003fa070}, {0xc00058c000, 0x3a, 0x40000})
/free5gc/NFs/amf/internal/ngap/dispatcher.go:45 +0x1f5
[github.com/free5gc/amf/internal/ngap/service.handleConnection](http://github.com/free5gc/amf/internal/ngap/service.handleConnection)(0xc0003fa070, 0x40000, {0xd339f0?, 0xd33a00?, 0xd339f8?})
/free5gc/NFs/amf/internal/ngap/service/service.go:237 +0x3e4
created by [github.com/free5gc/amf/internal/ngap/service.listenAndServe](http://github.com/free5gc/amf/internal/ngap/service.listenAndServe) in goroutine 22
/free5gc/NFs/amf/internal/ngap/service/service.go:158 +0x9a5

## Additional context
This security issue could allow a denial of service attack launched from a malicious UE to crash the AMF and affect other users. I'll create a pull request regarding this issue shortly. 


[Bugs] AMF crashed with malformed NAS packets from UE
This is a GitHub Issue
repo:free5gc
owner:free5gc
Title : [Bugs] AMF crashed with malformed NAS packets from UE
Issue date:

--- start body ---
## Describe the bug
The AMF crashed when receiving a short plaintext initial NAS message with a security header type greater than 0 from UE. This bug is caused by a missing length check of the payload. 

## To Reproduce
Steps to reproduce the behavior:
1. Run free5gc with default config.
2. Connect UERANSIM gNB (or any other compatible gNB implementations) with free5GC
3. Use UERANSIM UE (or any other compatible UE implementations) to send an initial NAS message with a payload length less than 6 (without header), and a security header type greater than 0. (e.g., 0x7E025F74)

The malformed packet can be sent by modifying sendNasMessage() function in src/ue/nas/mm/messaging.cpp of UERANSIM. 

## Expected behavior
The program should discard the malformed packet instead of a crash. 

## Environment (please complete the following information):
 - free5GC Version: v3.3.0
 - OS: Ubuntu 22.04 LTS
 - Kernel version: 6.2.0-39-generic
 - go version: 1.21.5 linux/amd64

## Trace File
### Configuration File

Use the default configuration file

### PCAP File

[free5gc_crash_ngap.zip](https://github.com/free5gc/free5gc/files/13814407/free5gc_crash_ngap.zip)

### Log File

[FATA][AMF][Ngap] panic: runtime error: slice bounds out of range [7:4]
goroutine 44 [running]:
runtime/debug.Stack()
/snap/go/10426/src/runtime/debug/stack.go:24 +0x5e
[github.com/free5gc/amf/internal/ngap/service.handleConnection.func1()](http://github.com/free5gc/amf/internal/ngap/service.handleConnection.func1())
/free5gc/NFs/amf/internal/ngap/service/service.go:184 +0x45
panic({0xc64940?, 0xc0005281b0?})
/snap/go/10426/src/runtime/panic.go:914 +0x21f
[github.com/free5gc/amf/internal/nas/nas_security.DecodePlainNasNoIntegrityCheck](http://github.com/free5gc/amf/internal/nas/nas_security.DecodePlainNasNoIntegrityCheck)({0xc000433760, 0x6, 0x8})
/free5gc/NFs/amf/internal/nas/nas_security/security.go:362 +0x11d
[github.com/free5gc/amf/internal/ngap.handleInitialUEMessageMain](http://github.com/free5gc/amf/internal/ngap.handleInitialUEMessageMain)(0xc0004da000, 0xc0002f2040, 0xc0004333e8, 0xc000246030, 0xc00078c600, 0xc00047a1e8, 0x0, 0xc00047a4e8, 0xc000128c68?)
/free5gc/NFs/amf/internal/ngap/handler.go:451 +0x2e5
[github.com/free5gc/amf/internal/ngap.handlerInitialUEMessage](http://github.com/free5gc/amf/internal/ngap.handlerInitialUEMessage)(0xc0004da000, 0xc53da0?, 0xc0007b41c0)
/free5gc/NFs/amf/internal/ngap/handler_generated.go:3503 +0x14cf
[github.com/free5gc/amf/internal/ngap.dispatchMain](http://github.com/free5gc/amf/internal/ngap.dispatchMain)(0xc0004da000, 0x3a?)
/free5gc/NFs/amf/internal/ngap/dispatcher_generated.go:49 +0x12f
[github.com/free5gc/amf/internal/ngap.Dispatch](http://github.com/free5gc/amf/internal/ngap.Dispatch)({0xe1a3f8?, 0xc0003fa070}, {0xc00058c000, 0x3a, 0x40000})
/free5gc/NFs/amf/internal/ngap/dispatcher.go:45 +0x1f5
[github.com/free5gc/amf/internal/ngap/service.handleConnection](http://github.com/free5gc/amf/internal/ngap/service.handleConnection)(0xc0003fa070, 0x40000, {0xd339f0?, 0xd33a00?, 0xd339f8?})
/free5gc/NFs/amf/internal/ngap/service/service.go:237 +0x3e4
created by [github.com/free5gc/amf/internal/ngap/service.listenAndServe](http://github.com/free5gc/amf/internal/ngap/service.listenAndServe) in goroutine 22
/free5gc/NFs/amf/internal/ngap/service/service.go:158 +0x9a5

## Additional context
This security issue could allow a denial of service attack launched from a malicious UE to crash the AMF and affect other users. I'll create a pull request regarding this issue shortly. 


--- end body ---
