Some commands of `bitcoin-tx` accept an index of an existing input/output, e.g. `delin` or `delout`.  And while the index is checked for being out-of-bounds, garbage (non-numeral characters) are happily accepted.  All of the following are fine:

    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=
    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=foobar
    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=0bla

I think all of them should throw an error instead of silently treating the index as zero.

The reason for this is that internally, `atoi` is called - and that by design discards anything after the first non-numeric character (and may just return zero if there are no numerals at all).

A possible fix would be to use `strtol` instead and to verify that the returned `endptr` is actually the end of the input string.  Alternatively, one could convert the integer back to a string and require that it matches the input string exactly.
{
    std::vector<std::string> vStrInputParts;
    boost::split(vStrInputParts, strInput, boost::is_any_of(":"));
    
    if (vStrInputParts.size()<2)
        throw std::runtime_error("TX input missing separator");
    
    std::string strTxid = vStrInputParts[0];
    if ((strTxid.size() != 64) || !IsHex(strTxid))
        throw std::runtime_error("invalid TX input txid");
    uint256 txid(uint256S(strTxid));
    static const unsigned int minTxOutSz = 9;
    static const unsigned int maxVout = MAX_BLOCK_WEIGHT / (WITNESS_SCALE_FACTOR * minTxOutSz);
    
    std::string strVout = vStrInputParts[1];
    int vout = atoi(strVout);
    if ((vout < 0) || (vout > (int)maxVout))
        throw std::runtime_error("invalid TX input vout");
    
    uint32_t nSequenceIn=std::numeric_limits<unsigned int>::max();
    if (vStrInputParts.size() > 2)
        nSequenceIn = std::stoul(vStrInputParts[2]);
    
    CTxIn txin(txid, vout, CScript(), nSequenceIn);
    tx.vin.push_back(txin);
}
static void MutateTxAddOutAddr(CMutableTransaction& tx, const std::string& strInput)