You can calloc the array instead of have a fixed size. You can validate the packet for <16. The person who wrote this consciously thought to themselves "here's

You can calloc the array instead of have a fixed size. You can validate the packet for <16. The person who wrote this consciously thought to themselves "here's 16 slots I can fill, here is an external source that comes in with how many slots it wants to fill." at which point the server-authoritative-model senses should have started tinkling, as well as the experienced-c-programmer-who-has-been-bitten-by-out-of-bounds-memory-accesses-before senses.