There are mainly 2 kinds of security issues :
- check the input size is correct before reading anything from the input packet
- when we read an null-terminated string (\0 terminated) at the end of a packet, we should use strndup(ptr, data + input_len - ptr) so that we cannot try to read beyond the packet end if the string is NOT null terminated.