Some commands of bitcoin-tx accept an index of an existing input/output, e.g. delin or delout. And while the index is checked for being out-of-bounds, garbage (non-numeral characters) are happily accepted. All of the following are fine:
$ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=
$ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=foobar
$ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=0blaI think all of them should throw an error instead of silently treating the index as zero.
The reason for this is that internally, atoi is called - and that by design discards anything after the first non-numeric character (and may just return zero if there are no numerals at all).
A possible fix would be to use strtol instead and to verify that the returned endptr is actually the end of the input string. Alternatively, one could convert the integer back to a string and require that it matches the input string exactly.
