Fix CVE-2014-0791

This patch fixes CVE-2014-0791, the remaining length in the stream is checked
before doing some malloc().
Merge pull request #1656 from hardening/CVE-2014-0791-v2

Fix CVE-2014-0791