From 3e90f109a205024dfc2e70e1e4186a8c25a6f35d Mon Sep 17 00:00:00 2001
From: Zach H <zahalpern+github@gmail.com>
Date: Sun, 8 May 2022 14:26:50 -0400
Subject: [PATCH] Prevent bad access potential for removals by checking bounds
 (#4617)

* Prevent bad access potential for removals by checking bounds
Fix #4616

Switch to removeOne instead of bound checking removeAt

* Revert server cardzone check
---
 cockatrice/src/arrowtarget.h      | 6 ++----
 cockatrice/src/carditem.h         | 2 +-
 cockatrice/src/cardzone.cpp       | 2 +-
 cockatrice/src/deckview.cpp       | 2 +-
 cockatrice/src/gamescene.cpp      | 4 ++--
 cockatrice/src/tab_supervisor.cpp | 4 ++--
 common/server_card.h              | 2 +-
 7 files changed, 10 insertions(+), 12 deletions(-)

diff --git a/cockatrice/src/arrowtarget.h b/cockatrice/src/arrowtarget.h
index bbe0f013..43852db1 100644
--- a/cockatrice/src/arrowtarget.h
+++ b/cockatrice/src/arrowtarget.h
@@ -43,9 +43,8 @@ public:
     }
     void removeArrowFrom(ArrowItem *arrow)
     {
-        arrowsFrom.removeAt(arrowsFrom.indexOf(arrow));
+        arrowsFrom.removeOne(arrow);
     }
-
     const QList<ArrowItem *> &getArrowsTo() const
     {
         return arrowsTo;
@@ -56,8 +55,7 @@ public:
     }
     void removeArrowTo(ArrowItem *arrow)
     {
-        arrowsTo.removeAt(arrowsTo.indexOf(arrow));
+        arrowsTo.removeOne(arrow);
     }
 };
-
 #endif
diff --git a/cockatrice/src/carditem.h b/cockatrice/src/carditem.h
index 5ef2856f..dc09d0d6 100644
--- a/cockatrice/src/carditem.h
+++ b/cockatrice/src/carditem.h
@@ -131,7 +131,7 @@ public:
     }
     void removeAttachedCard(CardItem *card)
     {
-        attachedCards.removeAt(attachedCards.indexOf(card));
+        attachedCards.removeOne(card);
     }
     const QList<CardItem *> &getAttachedCards() const
     {
diff --git a/cockatrice/src/cardzone.cpp b/cockatrice/src/cardzone.cpp
index 438c5de2..ad655f61 100644
--- a/cockatrice/src/cardzone.cpp
+++ b/cockatrice/src/cardzone.cpp
@@ -187,7 +187,7 @@ CardItem *CardZone::takeCard(int position, int cardId, bool /*canResize*/)
 
 void CardZone::removeCard(CardItem *card)
 {
-    cards.removeAt(cards.indexOf(card));
+    cards.removeOne(card);
     reorganizeCards();
     emit cardCountChanged();
     player->deleteCard(card);
diff --git a/cockatrice/src/deckview.cpp b/cockatrice/src/deckview.cpp
index 1d9c41f5..236b3ad2 100644
--- a/cockatrice/src/deckview.cpp
+++ b/cockatrice/src/deckview.cpp
@@ -216,7 +216,7 @@ void DeckViewCardContainer::addCard(DeckViewCard *card)
 
 void DeckViewCardContainer::removeCard(DeckViewCard *card)
 {
-    cards.removeAt(cards.indexOf(card));
+    cards.removeOne(card);
     cardsByType.remove(card->getInfo() ? card->getInfo()->getMainCardType() : "", card);
 }
 
diff --git a/cockatrice/src/gamescene.cpp b/cockatrice/src/gamescene.cpp
index b1be6661..cc5b050c 100644
--- a/cockatrice/src/gamescene.cpp
+++ b/cockatrice/src/gamescene.cpp
@@ -53,7 +53,7 @@ void GameScene::removePlayer(Player *player)
             zone->close();
         }
     }
-    players.removeAt(players.indexOf(player));
+    players.removeOne(player);
     removeItem(player);
     rearrange();
 }
@@ -178,7 +178,7 @@ void GameScene::addRevealedZoneView(Player *player,
 
 void GameScene::removeZoneView(ZoneViewWidget *item)
 {
-    zoneViews.removeAt(zoneViews.indexOf(item));
+    zoneViews.removeOne(item);
     removeItem(item);
 }
 
diff --git a/cockatrice/src/tab_supervisor.cpp b/cockatrice/src/tab_supervisor.cpp
index e87a8592..a96b2787 100644
--- a/cockatrice/src/tab_supervisor.cpp
+++ b/cockatrice/src/tab_supervisor.cpp
@@ -442,7 +442,7 @@ void TabSupervisor::replayLeft(TabGame *tab)
     if (tab == currentWidget())
         emit setMenu();
 
-    replayTabs.removeAt(replayTabs.indexOf(tab));
+    replayTabs.removeOne(tab);
 }
 
 TabMessage *TabSupervisor::addMessageTab(const QString &receiverName, bool focus)
@@ -508,7 +508,7 @@ void TabSupervisor::deckEditorClosed(TabDeckEditor *tab)
     if (tab == currentWidget())
         emit setMenu();
 
-    deckEditorTabs.removeAt(deckEditorTabs.indexOf(tab));
+    deckEditorTabs.removeOne(tab);
     removeTab(indexOf(tab));
 }
 
diff --git a/common/server_card.h b/common/server_card.h
index 14f09fba..c921f86e 100644
--- a/common/server_card.h
+++ b/common/server_card.h
@@ -181,7 +181,7 @@ public:
     }
     void removeAttachedCard(Server_Card *card)
     {
-        attachedCards.removeAt(attachedCards.indexOf(card));
+        attachedCards.removeOne(card);
     }
 
     void resetState();