pull16
return pull16(cpp) & 0xffff; /* pull16 returns -1 on error */
static unsigned short pull16(unsigned char **cpp);