Some commands of `bitcoin-tx` accept an index of an existing input/output, e.g. `delin` or `delout`.  And while the index is checked for being out-of-bounds, garbage (non-numeral characters) are happily accepted.  All of the following are fine:

    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=
    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=foobar
    $ bitcoin-tx -create outaddr=1:1M72Sfpbz1BPpXFHz9m3CdqATR44Jvaydd delout=0bla

I think all of them should throw an error instead of silently treating the index as zero.

The reason for this is that internally, `atoi` is called - and that by design discards anything after the first non-numeric character (and may just return zero if there are no numerals at all).

A possible fix would be to use `strtol` instead and to verify that the returned `endptr` is actually the end of the input string.  Alternatively, one could convert the integer back to a string and require that it matches the input string exactly.
{
    flags = 0;
    for (unsigned int i = 0; i < N_SIGHASH_OPTS; i++) {
        if (flagStr == sighashOptions[i].flagStr) {
            flags = sighashOptions[i].flags;
            return true;
        }
    }
    return false;
}
static CAmount AmountFromValue(const UniValue& value)
{
    if (!value.isNum() && !value.isStr())
        throw std::runtime_error("Amount is not a number or string");
    CAmount amount;
    if (!ParseFixedPoint(value.getValStr(), 8, &amount))
        throw std::runtime_error("Invalid amount");
    if (!MoneyRange(amount))
        throw std::runtime_error("Amount out of range");
    return amount;
}
static void MutateTxSign(CMutableTransaction& tx, const std::string& flagStr)
{
    int nHashType = SIGHASH_ALL;
    if (flagStr.size() > 0)
        if (!findSighashFlags(nHashType, flagStr))
            throw std::runtime_error("unknown sighash flag/sign option");