Fix CVE-2014-0791

This patch fixes CVE-2014-0791, the remaining length in the stream is checked before doing some malloc().

This one does the length check correctly.