Clean up code a bit.

Clean up code a bit.

"ivoff" is a pointer to the IV, not the offset of the IV; call it ivptr.

Have a variable that points to the beginning of the ciphertext, and use
that.

Fix the check that makes sure the authentication data/integrity check
value length isn't too big - it needs to make sure that it doesn't go
before the beginning of the ciphertext, i.e. doesn't overlap with the
IV.

Don't bother with a variable pointing to the secret, just pass
sa->secret.

Fix the check that makes sure the padding length isn't too big - make
sure it, plus 2 for the padding length and next header bytes, isn't
bigger than the ciphertext length.

Update a test to reflect the stricter length checks.