diff --git a/lib/Bzip2.js b/lib/Bzip2.js
index <HASH>..<HASH> 100644
--- a/lib/Bzip2.js
+++ b/lib/Bzip2.js
@@ -193,7 +193,7 @@ Bunzip.prototype._get_next_block = function() {
   var symCount = symTotal + 2;
   var groups = [], hufGroup;
   for (j = 0; j < groupCount; j++) {
-    var length = Util.makeU8Buffer(symCount), temp = Util.makeU8Buffer(MAX_HUFCODE_BITS + 1);
+    var length = Util.makeU8Buffer(symCount), temp = Util.makeU16Buffer(MAX_HUFCODE_BITS + 1);
     /* Read Huffman code lengths for each symbol.  They're stored in
        a way similar to MTF; record a starting value for the first symbol,
        and an offset from the previous value for every symbol after that. */
Apply fix for "pathological case of huffman coding" from toybox's bunzip.c.

Quoting the original commit message:

> A pathological case of huffman coding that uses 8 bits to code each
> of <I> symbols could cause an unsigned char limit[8] to wrap back to
> 0, setting limit to -1 and making the decompressor exit with a data
> error.

See: <URL>