Help with SZDD decompression

I've coded an SZDD decompression routine based on this pseudo-code. Testing it on one of Sonic CD's files gets me a segmentation fault. Next, I've tried to look up more information and compared it to other implementations. I've found one omission in the pseudo-code I took as a base. However, even after fixing that, I still get a segmentation fault.

At this point, I'm out of ideas. What the heck is wrong with this code?

Code (C):

1. unsigned char* szdd_decompress(char* p_filename) {
2.   unsigned char* p_bytes = 0;
3.   unsigned int bytecnt = 0;
4.   unsigned char cntbytes[4];
5.   unsigned int bytepos = 0;
6.   unsigned char dictionary[4096];
7.   unsigned int pos = 4096 - 16;
8.   FILE* fp = 0;
9.  
10.   fp = fopen(p_filename, "rb");
11.   if (fp == 0) return 0;
12.  
13.   if (fgetc(fp) != 'S') return 0; // magic
14.   if (fgetc(fp) != 'Z') return 0;
15.   if (fgetc(fp) != 'D') return 0;
16.   if (fgetc(fp) != 'D') return 0;
17.   if (fgetc(fp) != 0x88) return 0;
18.   if (fgetc(fp) != 0xF0) return 0;
19.   if (fgetc(fp) != 0x27) return 0;
20.   if (fgetc(fp) != 0x33) return 0;
21.   if (fgetc(fp) != 'A') return 0; // mode
22.   fgetc(fp); // last character of filename
23.  
24.   fread(cntbytes, 1, 4, fp);
25.   bytecnt = read_uint_littleendian(cntbytes);
26.   p_bytes = (unsigned char*)malloc(bytecnt);
27.   memset(dictionary, ' ', sizeof(dictionary));
28.  
29.   do {
30.     unsigned int control = fgetc(fp);
31.     if (feof(fp)) break;
32.  
33.     for (unsigned int bit = 1; bit & 0xFF; bit <<= 1) {
34.       if (control & bit) {
35.         p_bytes[bytepos] = dictionary[pos] = fgetc(fp);
36.         ++pos;
37.         pos %= 4096;
38.         ++bytepos;
39.       }
40.       else {
41.         unsigned int matchpos = fgetc(fp);
42.         unsigned int matchlen = fgetc(fp);
43.         matchpos |= (matchlen & 0xF0) << 4;
44.         matchlen = (matchlen & 0x0F) + 3;
45.  
46.         while (matchlen-- != 0) {
47.           p_bytes[bytepos] = dictionary[pos] = dictionary[matchpos];
48.           ++pos;
49.           pos %= 4096;
50.           ++matchpos;
51.           matchpos %= 4096;
52.           ++bytepos;
53.         }
54.       }
55.     }
56.   }
57.   while (1);
58.  
59.   fclose(fp);
60.  
61.   return p_bytes;
62. }