heap-buffer-overflow in bmp read palette

heap-buffer-overflow in bmp read palette: a task in MiMo-V2.6-RL-oss: Agentic RL Environments (MiMo RL release). AddressSanitizer: heap-buffer-overflow in function bmp read palette in file mupdf/source/fitz/load-bmp.c