Some commands of `bitcoin-tx` accept an index of an existing input/output, e.g. `delin` or `delout`.  And while the index is checked for being out-of-bounds, garbage (non-numeral characters) are happily accepted.  All of the following are fine:

    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=
    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=foobar
    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=0bla

I think all of them should throw an error instead of silently treating the index as zero.

The reason for this is that internally, `atoi` is called - and that by design discards anything after the first non-numeric character (and may just return zero if there are no numerals at all).

A possible fix would be to use `strtol` instead and to verify that the returned `endptr` is actually the end of the input string.  Alternatively, one could convert the integer back to a string and require that it matches the input string exactly.
{
    
    std::vector<std::string> vStrInputParts;
    boost::split(vStrInputParts, strInput, boost::is_any_of(":"));
    if (vStrInputParts.size() < 2 || vStrInputParts.size() > 3)
        throw std::runtime_error("TX output missing or too many separators");
    
    CAmount value = ExtractAndValidateValue(vStrInputParts[0]);
    
    CPubKey pubkey(ParseHex(vStrInputParts[1]));
    if (!pubkey.IsFullyValid())
        throw std::runtime_error("invalid TX output pubkey");
    CScript scriptPubKey = GetScriptForRawPubKey(pubkey);
    
    bool bSegWit = false;
    bool bScriptHash = false;
    if (vStrInputParts.size() == 3) {
        std::string flags = vStrInputParts[2];
        bSegWit = (flags.find('W') != std::string::npos);
        bScriptHash = (flags.find('S') != std::string::npos);
    }
    if (bSegWit) {
        if (!pubkey.IsCompressed()) {
            throw std::runtime_error("Uncompressed pubkeys are not useable for SegWit outputs");
        }
        
        scriptPubKey = GetScriptForWitness(scriptPubKey);
    }