[libpng14] Fixed off-by-one bug in png_handle_sCAL() when using fixed point arithmetic, causing out-of-bounds read in png_set_sCAL() because of failure to copy the string terminators (Franke Busse).