belongs in a demuxer, furthermore the code might be exploitable.
Fixes issue530

Originally committed as revision 14209 to svn://svn.ffmpeg.org/ffmpeg/trunk