Integer division (w*h)/8 truncates when w*h is not a multiple of 8,
allocating one byte too few. spr2color then writes past the end of
the buffer, corrupting the heap. Use (w*h+7)/8 to round up correctly.
Triggered by any tag whose width*height is not divisible by 8.