static unsigned short get_ushort(const unsigned char *data)
/* Returns a ushort from a little-endian serialized value */
static unsigned short get_tga_ushort(const unsigned char *data)
 {
    return data[0] | (data[1] << 8);
 }

The product writes data past the end, or before the beginning, of the intended buffer.