PCX and XCF: Fixes backport

Backport quality and security bug fixes from master:

• MR !220 (merged)
• MR !226 (merged)
• MR !231 (merged) (XCF part only)
• MR !241 (merged)
• MR !242 (merged)
• MR !244 (merged)