I tried just as you said. But the returning address is 0xffffffff99700910. still out of bounds. And I get segmentation fault furtherly. I want also to send you bitio_o_append function, maybe there, there can be a leak, corruption or something.

Code:
typedef struct bitio_stream {          /* structure that defines a bitstrem */
int used;                            /* identifier if the bitstream is used */
  char *buf;                           /* buffer holding the bitstream */
  long nbits;                          /* currend size of bitstream (counted
                                          in bits !) */
  size_t size;                         /* current size of allocated memory for
                                          holding the bitstream. */
} bitio_stream;

/*===========================================================================*/
long bitio_o_append (handle, val, nbits)

int handle;
unsigned long val;
int nbits;

/* This function appends a value to a bitstream.

   parameters:

   HANDLE:  Indicates the bitstream for appending.
   VAL:     Value to be output.
   NBITS:   Number of bits of VAL to be output to the stream. Note that NBITS
            muste be less that sizeof (LONG)

   The return-value is the bit-position of the value in the bit-stream, or -1
   on a fault.
*/

{
/******* Check if bitstream is allready initialized and number of bits does not
         exceed sizeof (unsigned long). */

  assert (bios[handle].used);
  assert (sizeof (unsigned long) * 8 >= nbits);

/******* check if there is enough memory to store the new value. Reallocate
         the memory-block if not */

  if ((bios[handle].nbits + nbits) / 8 + 1 > (long) bios[handle].size) {
    bios[handle].buf = realloc (bios[handle].buf, bios[handle].size + INCSIZE);
    if (bios[handle].buf == NULL) return 0;
        memset (bios[handle].buf + bios[handle].size, 0, INCSIZE);
    bios[handle].size += INCSIZE;
  }

/******* output data to bitstream */
bitio_o_outp (handle, val, nbits, bios[handle].nbits);
  bios[handle].nbits += nbits;

  return bios[handle].nbits;
}
and the function which is used by bitio_o_append:

Code:
/*===========================================================================*/
void bitio_o_outp (handle, val, nbits, bitpos)

int handle;
unsigned long val;
int nbits;
long bitpos;

/* This function outputs a value to a specified position of a bitstream

   parameters:

   HANDLE:  Indicates the bitstream for output.
   VAL:     Value to be output.
   NBITS:   Number of bits of VAL to be output to the stream. Note that NBITS
            must be less then sizeof (LONG)
   BITPOS:  bitposition of the value in the bitstream.
*/

{
  int i, bit, bitval;
  size_t byte;
  char *pc, c;

/******* Check if bitstream is allready initialized and number of bits does not
         exceed sizeof (unsigned long). */

  assert (bios[handle].used);
  assert (sizeof (unsigned long) * 8 >= nbits);

  for (i = nbits - 1; i >= 0; i --) {

/******* Get bit-value */

    bitval = (int) (val >> i) & 1;

/******* calculate bit- and byte-number for output */

    /*byte = (int) (bitpos / 8);
bit  = (int) (bitpos % 8);*/
    byte = (int) (bitpos / 8);
    bit  = (int) (bitpos % 8);
    bit  = 7 - bit;

/******* set bit-value to output stream */

    pc = bios[handle].buf + byte;
    if (bitval) {
      c = (char) (1 << bit);
      *pc |= c;
    }
    else {
      c = (char) (1 << bit);
      c ^= 0xff;
      *pc &= c;
    }
    bitpos ++;
  }
}