From 4d8cdf0390dba157152e0f20344c393e5f397af5 Mon Sep 17 00:00:00 2001
From: ara <226676426+ara-stock@users.noreply.github.com>
Date: Thu, 8 Oct 2026 10:06:24 +0900
Subject: [PATCH] interface: Reject batch instructions with more than 255
 accounts

`batch` writes each inner instruction's account count as a `u8` with
`as u8`, so an inner instruction with 256 or more accounts was silently
encoded with a wrapped count (256 became 0) while all of its account
metas were still appended. The resulting instruction misaligns the
accounts of every following inner instruction.

Return `InvalidInstructionData` instead, matching the existing check for
inner instruction data longer than 255 bytes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 interface/src/instruction.rs | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/interface/src/instruction.rs b/interface/src/instruction.rs
index deab7afe..faab5d6d 100644
--- a/interface/src/instruction.rs
+++ b/interface/src/instruction.rs
@@ -1638,6 +1638,10 @@ pub fn batch(
             return Err(ProgramError::IncorrectProgramId);
         }
 
+        if instruction.accounts.len() > u8::MAX as usize {
+            return Err(ProgramError::InvalidInstructionData);
+        }
+
         data.push(instruction.accounts.len() as u8);
 
         if instruction.data.len() > u8::MAX as usize {
@@ -1940,6 +1944,27 @@ mod test {
         assert_eq!(unpacked, check);
     }
 
+    #[test]
+    fn test_batch_rejects_too_many_accounts() {
+        let program_id = crate::id();
+        let account = AccountMeta::new_readonly(Pubkey::new_unique(), false);
+        let mut instruction = Instruction {
+            program_id,
+            accounts: vec![account.clone(); u8::MAX as usize],
+            data: TokenInstruction::SyncNative.pack(),
+        };
+
+        let batched = batch(&program_id, &[instruction.clone()]).unwrap();
+        assert_eq!(batched.data, vec![255, u8::MAX, 1, 17]);
+        assert_eq!(batched.accounts.len(), u8::MAX as usize);
+
+        instruction.accounts.push(account);
+        assert_eq!(
+            batch(&program_id, &[instruction]).unwrap_err(),
+            ProgramError::InvalidInstructionData
+        );
+    }
+
     #[test]
     fn test_instruction_unpack_panic() {
         for i in 0..255u8 {