PocketMine-MP before 4.8.1 has improperly handled dye colour IDs in banner NBT, leading to server crash. DyeColorIdMap->fromId() did not account for the possibility that it might be given invalid input. This means that an undefined offset error would occur whenever this happened. This code is indirectly called during Banner->deserializeCompoundTag(), which is invoked when deserializing any item NBT, whether from network or disk. An attacker could use this bug to crash a server by providing NBT with invalid values for pattern colours in an inventory transaction, or by using /give to obtain an item with NBT like this.