processFile() accessed files_[id - 1] without validating id. When id == 0 (from a crafted network packet), id - 1 = -1 caused out-of-bounds access. Added bounds check: id must be in range [1, files_.size()]. Stops receive and logs error on invalid id.