Fixed buffer overflow in bmp_load()