XFA: bound memcpy length in _png_load_bmp_attribute()