SECURITY UPDATE: heap out-of-bounds read in the PCD decoder
debian/patches/CVE-2026-56378.patch: bound q against the end of the luma,
chroma1 or chroma2 plane it currently points into before the delta is
read in DecodeImage() in coders/pcd.c, and raise CorruptImage when that
bound was reached