Fix handling incorrect hIST chunks of uneven size

The hIST chunks, used for storing image histograms, contain arrays of
16-bit unsigned integers, and the chunk size is expected to be an even
number. Raise a png_chunk_benign_error() if a hIST chunk fails to meet
this expectation.

Reported-by: Eugene Kliuchnikov <eustas@google.com>
diff --git a/pngrutil.c b/pngrutil.c
index c4de582..3c7e0e6 100644
--- a/pngrutil.c
+++ b/pngrutil.c
@@ -2123,8 +2123,9 @@
 
    num = length / 2 ;
 
-   if (num != (unsigned int) png_ptr->num_palette ||
-       num > (unsigned int) PNG_MAX_PALETTE_LENGTH)
+   if (length != num * 2 ||
+       num != (unsigned int)png_ptr->num_palette ||
+       num > (unsigned int)PNG_MAX_PALETTE_LENGTH)
    {
       png_crc_finish(png_ptr, length);
       png_chunk_benign_error(png_ptr, "invalid");