From 29dcf02977d2c3dc71b13440428fe7eb2c71d1b6 Mon Sep 17 00:00:00 2001
From: Spagles <106791090+Spagles@users.noreply.github.com>
Date: Sat, 1 Aug 2026 19:52:50 +1000
Subject: [PATCH 1/3] fix: prevent ArrayIndexOutOfBoundsException in dedicated
 server packet deserialization

---
 .../vmstudio/visor/core/server/network/ServerNetworking.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/visor-core/src/main/java/org/vmstudio/visor/core/server/network/ServerNetworking.java b/visor-core/src/main/java/org/vmstudio/visor/core/server/network/ServerNetworking.java
index 958f6577..ac935c5e 100644
--- a/visor-core/src/main/java/org/vmstudio/visor/core/server/network/ServerNetworking.java
+++ b/visor-core/src/main/java/org/vmstudio/visor/core/server/network/ServerNetworking.java
@@ -44,7 +44,7 @@ public static void createDedicatedChannel(@NotNull CoreAddonServer coreAddon){
                 VisorNetwork.CORE_NETWORK_VERSION
         ).toServer(
                 (id, buffer)->{
-                    VisorCorePayloadID payloadId = VisorCorePayloadID.values()[id];
+                    VisorCorePayloadID payloadId = VisorCorePayloadID.fromOrdinal(id);
                     return VisorCorePayloadID.readToServer(payloadId, buffer);
                 },
                 ServerPacketHandler::handlePacket

From 3f9fec920128a12b872eabf66b9dd84374e42470 Mon Sep 17 00:00:00 2001
From: Spagles <106791090+Spagles@users.noreply.github.com>
Date: Sat, 1 Aug 2026 19:53:22 +1000
Subject: [PATCH 2/3] fix: add bounds checking to payload ID deserialization in
 VisorCorePayloadID

---
 .../visor/api/common/network/VisorCorePayloadID.java     | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java b/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java
index 980d2aac..2a1b4ac3 100644
--- a/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java
+++ b/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java
@@ -56,12 +56,21 @@ public byte byteOrdinal() {
     public static VisorCorePayloadID fromOrdinal(byte ordinalByte){
         // -127...127 to 0..255
         int unsignedByte = ordinalByte & 0xFF;
+        if (unsignedByte >= values().length) {
+            return null;
+        }
         return values()[unsignedByte];
     }
 
     @Environment(EnvType.CLIENT)
     public static VisorPayloadToClient readToClient(VisorCorePayloadID payloadID,
                                              FriendlyByteBuf buffer) {
+        if (payloadID == null) {
+            VisorAPI.client().getLogger().error(
+                    "Visor: Got unexpected payload identifier on client: null"
+            );
+            return UnknownPayloadToClient.read(buffer);
+        }
         return switch (payloadID) {
             case HANDSHAKE -> HandshakePayloadToClient.read(buffer);
             case SERVER_SETTINGS -> SettingsPayloadToClient.read(buffer);

From dd1e7138098624a9edee8500a4e20118c817e802 Mon Sep 17 00:00:00 2001
From: Spagles <106791090+Spagles@users.noreply.github.com>
Date: Sat, 1 Aug 2026 19:53:58 +1000
Subject: [PATCH 3/3] fix: handle null payload ID in server packet reader

---
 .../visor/api/common/network/VisorCorePayloadID.java        | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java b/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java
index 2a1b4ac3..7b30a040 100644
--- a/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java
+++ b/visor-api/src/main/java/org/vmstudio/visor/api/common/network/VisorCorePayloadID.java
@@ -97,6 +97,12 @@ public static VisorPayloadToClient readToClient(VisorCorePayloadID payloadID,
 
     public static VisorPayloadToServer readToServer(VisorCorePayloadID payloadID,
                                              FriendlyByteBuf buffer) {
+        if (payloadID == null) {
+            VisorAPI.server().getLogger().error(
+                    "Visor: Got unexpected payload identifier on server: null"
+            );
+            return UnknownPayloadToServer.read(buffer);
+        }
         return switch (payloadID) {
             case HANDSHAKE -> HandshakePayloadToServer.read(buffer);
             case ACTIVE_HAND -> ActiveHandPayloadToServer.read(buffer);