From 8c35071d7e89df1c92888d40d6b9ad65d4d2bade Mon Sep 17 00:00:00 2001
From: Kashargul <144968721+Kashargul@users.noreply.github.com>
Date: Sun, 3 Nov 2024 19:59:16 +0100
Subject: [PATCH] prevent out of index access on tgui spamming the rd console
 (#16552)

* prevent out of index access on tgui spam

* prevent multi register and unregister

* this needs to be grouped for the execution order
---
 code/game/machinery/partslathe_vr.dm    | 5 +++--
 code/game/objects/structures/railing.dm | 2 +-
 code/modules/research/circuitprinter.dm | 5 +++--
 code/modules/research/protolathe.dm     | 5 +++--
 code/modules/tgui/modules/overmap.dm    | 9 +++++++--
 5 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/code/game/machinery/partslathe_vr.dm b/code/game/machinery/partslathe_vr.dm
index cc277d70d24..8693642de76 100644
--- a/code/game/machinery/partslathe_vr.dm
+++ b/code/game/machinery/partslathe_vr.dm
@@ -174,8 +174,9 @@
 	return
 
 /obj/machinery/partslathe/proc/removeFromQueue(var/index)
-	queue.Cut(index, index + 1)
-	return
+	if(queue.len >= index)
+		queue.Cut(index, index + 1)
+		return
 
 /obj/machinery/partslathe/proc/canBuild(var/datum/category_item/partslathe/D)
 	for(var/M in D.resources)
diff --git a/code/game/objects/structures/railing.dm b/code/game/objects/structures/railing.dm
index 7f7f57c1f00..69167f859cf 100644
--- a/code/game/objects/structures/railing.dm
+++ b/code/game/objects/structures/railing.dm
@@ -222,7 +222,7 @@
 
 	// Install
 	if(W.has_tool_quality(TOOL_SCREWDRIVER))
-		user.visible_message(span_info(anchored ? span_bold("\The [user]") + " begins unscrewing \the [src]." : span_bold("\The [user]") + "begins fasten \the [src]." ))
+		user.visible_message(span_info((anchored ? (span_bold("\The [user]") + " begins unscrewing \the [src].") : (span_bold("\The [user]") + "begins fasten \the [src]."))))
 		playsound(src, W.usesound, 75, 1)
 		if(do_after(user, 10, src))
 			to_chat(user, (anchored ? span_notice("You have unfastened \the [src] from the floor.") : span_notice("You have fastened \the [src] to the floor.")))
diff --git a/code/modules/research/circuitprinter.dm b/code/modules/research/circuitprinter.dm
index 75f4fb1cacb..745dcf8dfc5 100644
--- a/code/modules/research/circuitprinter.dm
+++ b/code/modules/research/circuitprinter.dm
@@ -168,8 +168,9 @@ using metal and glass, it uses glass and reagents (usually sulphuric acid).
 	return
 
 /obj/machinery/r_n_d/circuit_imprinter/proc/removeFromQueue(var/index)
-	queue.Cut(index, index + 1)
-	return
+	if(queue.len >= index)
+		queue.Cut(index, index + 1)
+		return
 
 /obj/machinery/r_n_d/circuit_imprinter/proc/canBuild(var/datum/design/D)
 	for(var/M in D.materials)
diff --git a/code/modules/research/protolathe.dm b/code/modules/research/protolathe.dm
index e6f87f61180..0fc4de44c62 100644
--- a/code/modules/research/protolathe.dm
+++ b/code/modules/research/protolathe.dm
@@ -184,8 +184,9 @@
 	return
 
 /obj/machinery/r_n_d/protolathe/proc/removeFromQueue(var/index)
-	queue.Cut(index, index + 1)
-	return
+	if(queue.len >= index)
+		queue.Cut(index, index + 1)
+		return
 
 /obj/machinery/r_n_d/protolathe/proc/canBuild(var/datum/design/D)
 	for(var/M in D.materials)
diff --git a/code/modules/tgui/modules/overmap.dm b/code/modules/tgui/modules/overmap.dm
index ed2f166c6a2..0661d4b146a 100644
--- a/code/modules/tgui/modules/overmap.dm
+++ b/code/modules/tgui/modules/overmap.dm
@@ -2,6 +2,7 @@
 	var/obj/effect/overmap/visitable/ship/linked
 	var/list/viewers
 	var/extra_view = 0
+	var/map_view_used = FALSE
 
 /datum/tgui_module/ship/New()
 	. = ..()
@@ -77,13 +78,17 @@
 		user.reset_view(linked)
 	user.set_viewsize(world.view + extra_view)
 	user.AddComponent(/datum/component/recursive_move)
-	RegisterSignal(user, COMSIG_OBSERVER_MOVED, /datum/tgui_module/ship/proc/unlook)
+	if(!map_view_used)
+		RegisterSignal(user, COMSIG_OBSERVER_MOVED, /datum/tgui_module/ship/proc/unlook)
+		map_view_used = TRUE
 	LAZYDISTINCTADD(viewers, WEAKREF(user))
 
 /datum/tgui_module/ship/proc/unlook(var/mob/user)
 	user.reset_view()
 	user.set_viewsize() // reset to default
-	UnregisterSignal(user, COMSIG_OBSERVER_MOVED)
+	if(map_view_used)
+		UnregisterSignal(user, COMSIG_OBSERVER_MOVED)
+		map_view_used = FALSE
 	LAZYREMOVE(viewers, WEAKREF(user))
 
 /datum/tgui_module/ship/proc/viewing_overmap(mob/user)