From a646d9e7c33e1c3354542aa45402bdf9d1f28dc8 Mon Sep 17 00:00:00 2001
From: Cole Munz <Munzzyy1@proton.me>
Date: Fri, 31 Jul 2026 23:30:26 -0500
Subject: [PATCH] wallet2: clamp export_outputs start to the number of
 transfers

export_outputs() says start and count are allowed to go past the valid range,
and that nothing is returned when they do. The loop honours that, but offset
does not: with all=true it takes start unchecked, so a start past the end makes
m_transfers.size() - offset underflow and reserve() gets a value near SIZE_MAX.
vector::reserve throws std::length_error on that, which is where the
"vector::reserve" error in issue #8625 comes from.

Clamping offset also keeps the returned offset usable. import_outputs throws
when offset is past the total, so leaving offset at start would only move the
failure from export to import.
---
 src/wallet/wallet2.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wallet/wallet2.cpp b/src/wallet/wallet2.cpp
index 19ba99172..496a3169b 100644
--- a/src/wallet/wallet2.cpp
+++ b/src/wallet/wallet2.cpp
@@ -14014,7 +14014,7 @@ std::tuple<uint64_t, uint64_t, std::vector<tools::wallet2::exported_transfer_det
     while (offset < m_transfers.size() && (m_transfers[offset].m_key_image_known && !m_transfers[offset].m_key_image_request))
       ++offset;
   else
-    offset = start;
+    offset = std::min<size_t>(start, m_transfers.size());
 
   outs.reserve(m_transfers.size() - offset);
   for (size_t n = offset; n < m_transfers.size() && n - offset < count; ++n)