java: fix output type for psbt_get_output_amount
What the developer wrote
Authored by Jon Griffiths
java: fix output type for psbt_get_output_amount
Reported-by: Efstratios Kaplanellis (@5tratan) of Almamater Technologies
What changed, and why it matters
This commit fixes a Java language binding bug where a function that reads a Bitcoin transaction output amount was incorrectly declared to return a 'size' type (a memory/length value) instead of an unsigned 64-bit integer. Output amounts in Bitcoin are 64-bit integers, so the wrong return type could cause the returned value to be truncated, misinterpreted, or trigger type-conversion errors in Java applications using libwally-core. The fix is a one-line change in the SWIG interface file used to generate Java wrappers.
Review other %returns_size_t declarations in the SWIG interface to ensure monetary or uint64_t values are not similarly mis-typed, and add tests that verify large output amounts round-trip correctly through the Java bindings.
Security signals we found
Incorrect JNI/SWIG return type for cryptographic/monetary value
Potential integer truncation of PSBT output amount
Type confusion between size_t and uint64_t in language bindings
Evidence from the diff
In src/swig_java/swig.i, the SWIG macro for wally_psbt_get_output_amount was changed from %returns_size_t to %returns_uint64. The underlying C API returns uint64_t (the maximum output amount is ~21 million BTC expressed in satoshis, fitting in 64 bits). Using %returns_size_t would expose the value through a Java ‘long’ or similar sized type that may not correctly represent the full uint64_t range, potentially causing truncation on platforms where size_t is 32 bits, or at minimum incorrect JNI type mapping and loss of semantic correctness. The commit message credits Efstratios Kaplanellis of Almamater Technologies for the report.
Changed components
src/swig_java/swig.iJava bindings for wally_psbt_get_output_amountInspect captured patch +1 / −1
### src/swig_java/swig.i
@@ -845,7 +845,7 @@ static jobjectArray create_jstringArray(JNIEnv *jenv, char **p, size_t len) {
%returns_size_t(wally_psbt_get_locktime);
%returns_size_t(wally_psbt_get_num_inputs);
%returns_size_t(wally_psbt_get_num_outputs);
-%returns_size_t(wally_psbt_get_output_amount);
+%returns_uint64(wally_psbt_get_output_amount);
%returns_size_t(wally_psbt_get_output_asset);
%returns_size_t(wally_psbt_get_output_asset_len);
%returns_size_t(wally_psbt_get_output_asset_blinding_surjectionproof);Why this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.