What happens if *(_it + 1) is the end of the data buffer?

Passing the length of data to this function and doing length checks would fix this.

This also applies to the rest of this function.

You also seem to forget checking if the data is terminated correctly before calling this function.