Line 945, I'd check the values in l_limit, dicPos, and cnt_R are all <= dictionary size. Line 948, check sym_R is a valid length. Also on lines 952 & 953 check l_dic_Spec has not been corrupted, and 1 <= l_rep0 <= dict size.
Actually I'm referring to this line: data[1] = be_int2(d16[0]); d16 points to the...
First value in ZTR chebyshev is little-endian