revealed since

commit 81e3ca4f
Author: Tor Lillqvist <tml@collabora.com>
Date:   Tue Jun 21 10:34:21 2016 +0300

    Use real assert() instead of DBG_ASSERT()

sanitize invalid palette entry indexes at the outer perimeter on initial load
to try and avoid having to do it in all sort of places in the interior.

png spec says that the palette has to appear before the first IDAT so we
should always know the palette size here

Change-Id: I6e04223adce1c88d037f9cf34862e6f54e381bb0