Array lookup without bounds checking, using data sent to us over the internet.  Could this be exploited?