Don't allocate from a declared length before checking the source can supply it

[ahkarl13]

Four places take a length straight out of a file header and allocate it before dcm_require() checks the bytes are actually there. Small crafted files then produce very large allocations:

Where | Input | Requested -- | -- | -- parse_element_body() — reached from dcm_filehandle_get_file_meta(), the first parse step | 177 B | 4 GiB dcm_parse_encapsulated_frame() — from dcm_filehandle_read_frame() | 395 B | 4.27 GiB parse_pixeldata_item() — from parse_pixeldata() | small | 822 MB dcm_parse_frame() — frame size arithmetic (below) | small | 2.2 GB

ERROR: libFuzzer: out-of-memory (malloc(4294967296))
    #8  dcm_calloc                     src/dicom.c:45
    #9  parse_element_body             src/dicom-parse.c:606
    #10 dcm_parse_group                src/dicom-parse.c:851
    #11 dcm_filehandle_read_file_meta  src/dicom-file.c:575
    #12 dcm_filehandle_get_file_meta   src/dicom-file.c:639

The last one is a bit different and worth reading on its own. dcm_parse_frame() computed

c

*length = rows * columns * samples_per_pixel * (bits_allocated / 8);

with four uint16_t operands. They promote to int, so the product overflows signed arithmetic — undefined behaviour — before it ever reaches the uint32_t it lands in:

dicom-parse.c:1078:41: runtime error: signed integer overflow:
                       1098696192 * 2 cannot be represented in type 'int'

Widening isn't sufficient either — 65535 × 65535 × 4 × 8 doesn't fit in 32 bits — so it computes in uint64_t and range-checks. Worth flagging for consumers: anything that recomputes the frame size from the rows/columns/samples/bits on DcmFrame would read past the buffer when that product wrapped small.

The guard itself is a small helper, dcm_remaining(), built on the seek method DcmIO already has. A custom DcmIO whose seek fails returns -1 and keeps today's behaviour, so streaming clients are unaffected.

Three of these are the same shape in three places, which probably means the check wants to live somewhere shared rather than at each call site — happy to restructure it however you'd prefer.

check_dicom passes and dcm-dump output is byte-identical on all seven files in data/test_files after each patch. Reproducers attached.