fix #929 by validating image magic number