Fix possible integer overflow in Opus with ~16MB fed to the decoder.

src/opus_decoder.c

 /* Copyright (c) 2010 Xiph.Org Foundation, Skype Limited
    Written by Jean-Marc Valin and Koen Vos */
 /*
    Redistribution and use in source and binary forms, with or without
    modification, are permitted provided that the following conditions
    are met:
 
    - Redistributions of source code must retain the above copyright
    notice, this list of conditions and the following disclaimer.
 
@@ skipping 594 matching lines @@
          return OPUS_INVALID_PACKET;
       /* Number of frames encoded in bits 0 to 5 */
       ch = *data++;
       count = ch&0x3F;
       if (count <= 0 || framesize*count > 5760)
          return OPUS_INVALID_PACKET;
       len--;
       /* Padding flag is bit 6 */
       if (ch&0x40)
       {
-         int padding=0;
          int p;
          do {
             if (len<=0)
                return OPUS_INVALID_PACKET;
             p = *data++;
             len--;
-            padding += p==255 ? 254: p;
+            len -= p==255 ? 254: p;
          } while (p==255);
-         len -= padding;
       }
       if (len<0)
          return OPUS_INVALID_PACKET;
       /* VBR flag is bit 7 */
       cbr = !(ch&0x80);
       if (!cbr)
       {
          /* VBR case */
          last_size = len;
          for (i=0;i<count-1;i++)
@@ skipping 355 matching lines @@
    if (count<0)
       return count;
 
    samples = count*opus_packet_get_samples_per_frame(packet, dec->Fs);
    /* Can't have more than 120 ms */
    if (samples*25 > dec->Fs*3)
       return OPUS_INVALID_PACKET;
    else
       return samples;
 }