Fix breakage of SSH-2 packet decompression by r10070.

The line that resets st->pktin->length to cover only the semantic
payload of the SSH message was overwriting the modification to
st->pktin->length performed by the optional decompression step. I
didn't notice because I don't habitually enable compression.

[originally from svn r10103]
[r10070 == 9f5d51a4ac]

ssh.c

@@ -1711,6 +1711,9 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
 
     st->pktin->sequence = st->incoming_sequence++;
 
+    st->pktin->length = st->packetlen - st->pad;
+    assert(st->pktin->length >= 0);
+
     /*
      * Decompress packet payload.
      */
@@ -1739,7 +1742,7 @@ static struct Packet *ssh2_rdpkt(Ssh ssh, unsigned char **data, int *datalen)
      */
     st->pktin->type = st->pktin->data[5];
     st->pktin->body = st->pktin->data + 6;
-    st->pktin->length = st->packetlen - 6 - st->pad;
+    st->pktin->length -= 6;
     assert(st->pktin->length >= 0);    /* one last double-check */
 
     if (ssh->logctx)