simplewallet: validate get_outs response size

What changed, and why it matters

This commit adds a safety check in Monero's command-line wallet. When the wallet asks the network node (daemon) for details about certain transaction outputs, it now verifies that the daemon actually returned the same number of results that were requested. Without this check, a malicious or buggy daemon could return fewer (or conceivably different) output records than expected, which might cause the wallet to misread ring member data when displaying or analyzing transactions. The patch is small and defensive; it does not by itself prove an exploitable vulnerability, but it closes a trust boundary gap between the wallet and the daemon.

Security signals we found

Evidence from the diff

Changed components

diff --git a/src/simplewallet/simplewallet.cpp b/src/simplewallet/simplewallet.cpp
index e5b82d6..f3ceb3f 100644
--- a/src/simplewallet/simplewallet.cpp
+++ b/src/simplewallet/simplewallet.cpp
@@ -6098,6 +6098,11 @@ bool simple_wallet::process_ring_members(const std::vector<tools::wallet2::pendi
         fail_msg_writer() << tr("failed to get output: ") << err;
         return false;
       }
+      if (res.outs.size() != req.outputs.size())
+      {
+        fail_msg_writer() << tr("daemon returned an invalid number of outputs");
+        return false;
+      }
       // make sure that returned block heights are less than blockchain height
       for (auto& res_out : res.outs)
       {