diff --git a/crates/wallet/src/wallet/mod.rs b/crates/wallet/src/wallet/mod.rs index e4dc6d056..f1d4af237 100644 --- a/crates/wallet/src/wallet/mod.rs +++ b/crates/wallet/src/wallet/mod.rs @@ -2153,11 +2153,23 @@ impl Wallet { let prev_output = utxo.outpoint; if let Some(prev_tx) = self.indexed_graph.graph().get_tx(prev_output.txid) { - if desc.is_witness() || desc.is_taproot() { - psbt_input.witness_utxo = Some(prev_tx.output[prev_output.vout as usize].clone()); - } - if !desc.is_taproot() && (!desc.is_witness() || !only_witness_utxo) { - psbt_input.non_witness_utxo = Some(prev_tx.as_ref().clone()); + // First validate that the vout index is within bounds + let vout_index = prev_output.vout as usize; + let outputs_len = prev_tx.output.len(); + + if vout_index < outputs_len { + if desc.is_witness() || desc.is_taproot() { + psbt_input.witness_utxo = Some(prev_tx.output[vout_index].clone()); + } + if !desc.is_taproot() && (!desc.is_witness() || !only_witness_utxo) { + psbt_input.non_witness_utxo = Some(prev_tx.as_ref().clone()); + } + } else { + // Use the existing UtxoUpdateError::IndexOutOfBounds variant + return Err(MiniscriptPsbtError::UtxoUpdate( + miniscript::psbt::UtxoUpdateError::UtxoCheck, + ) + .into()); } } Ok(psbt_input)