safety check to ensure we dont send out beyond the users buffer

Fix the issue noted at http://anoncvs.estpak.ee/cgi-bin/cgit/openbsd-src/commit/lib/libssl?id=cb8b51bf2f6517fe96ab0d20c4d9bba2eef1b67c and http://marc.info/?l=openssl-dev&m=139809485525663&w=2 and noted by Kurt and in RT at http://rt.openssl.org/Ticket/Display.html?id=3320