ilLoadGifL / iReadLump out-of-bounds writing

[Photosounder]

I've isolated a bug that occurs when loading certain GIFs, demonstrated with this minimalistic code:

#include <stdlib.h>
#include <stdio.h>

#ifdef _MSC_VER
#pragma comment (lib, "DevIL.lib")
#pragma comment (lib, "ILU.lib")
#pragma comment (lib, "ILUT.lib")
#endif

#include <IL/il.h>
#include <IL/ilu.h>

char *load_raw_file(const char *path, size_t *size)
{
    FILE *in_file;
    char *data;
    size_t fsize;

    in_file = fopen(path, "rb");

    if (in_file==NULL)
    {
        fprintf(stderr, "File '%s' not found.\n", path);
        return NULL;
    }

    fseek(in_file, 0, SEEK_END);
    fsize = ftell(in_file);
    rewind (in_file);

    data = calloc (fsize+1, sizeof(char));
    fread(data, 1, fsize, in_file);

    fclose(in_file);

    if (size)
        *size = fsize;

    return data;    
}

void load_image_libdevil(const char *in_path)
{
    ILubyte *raw_data;
    size_t size;
    ILboolean err;
    ILuint ImgId;

    raw_data = load_raw_file(in_path, &size);
    if (raw_data==NULL || size==0)
        return ;

    // Initialize DevIL.
    ilInit();
    ilOriginFunc(IL_ORIGIN_UPPER_LEFT);
    ilEnable(IL_ORIGIN_SET);
    ilGenImages(1, &ImgId);     // Generate the main image name to use.
    ilBindImage(ImgId);     // Bind this image name.

    if (!ilLoadL(IL_TYPE_UNKNOWN, raw_data, size))
    {
        fprintf(stderr, "Could not open image from the %d byte buffer in memory\n", size);
        return ;
    }
}

int main()
{
    load_image_libdevil("1477604070775.gif");

    printf("Done.\n");

    return 0;
}

This code loads the GIF's data into memory then lets ilLoadL do its work. Typically it works fine except with some GIFs like this one, the call stack is ilLoadL→ilLoadGifL→iLoadGifInternal→GetImages→iGetPalette→iReadLump, and in iReadLump() the problem occurs at the line *((ILubyte*)Buffer + i) = *((ILubyte*)ReadLump + ReadLumpPos + i);, the problem being that *((ILubyte*)Buffer + i) is out of bounds for some reason.

I'm using DevIL 1.8.0, and appverif.exe to catch the problem. Here's a ZIP containing the source, the problem causing GIF, the VS2017 project and the DevIL.dll (and its .pdb file).

DevIL_bug.zip