Fix hang in the case of a corrupted PNG chunk length

If a PNG chunk has an invalid length, this can get into an endless loop and cause the tab to hang.

Verify that:
 * The length is not negative ( Shouldn't be possible per PNG spec, but happens due to treating the length as signed )
 * The offset never goes backwards. 

Test case PNG: http://s.andreanall.com/tmp/ball-bad.png
( That file is http://en.wikipedia.org/wiki/File:Animated_PNG_example_bouncing_beach_ball.png, with the 33rd byte changed to 0xFF )