Fix possible integer overflow in Opus with ~16MB fed to the decoder.

src/opus_decoder.c

Index: src/opus_decoder.c
===================================================================
--- src/opus_decoder.c	(revision 173381)
+++ src/opus_decoder.c	(working copy)
@@ -612,16 +612,14 @@
       /* Padding flag is bit 6 */
       if (ch&0x40)
       {
-         int padding=0;
          int p;
          do {
             if (len<=0)
                return OPUS_INVALID_PACKET;
             p = *data++;
             len--;
-            padding += p==255 ? 254: p;
+            len -= p==255 ? 254: p;
          } while (p==255);
-         len -= padding;
       }
       if (len<0)
          return OPUS_INVALID_PACKET;