index() allows out-of-bound read and remove() has off-by-one error