fix: createProgramAddress now throws on an invalid seed length

web3.js/src/index.js

@@ -6,7 +6,7 @@ export {Connection} from './connection';
 export {Loader} from './loader';
 export {Message} from './message';
 export {NonceAccount, NONCE_ACCOUNT_LENGTH} from './nonce-account';
-export {PublicKey} from './publickey';
+export {MAX_SEED_LENGTH, PublicKey} from './publickey';
 export {
   STAKE_CONFIG_ID,
   Authorized,

web3.js/src/publickey.js

@@ -10,6 +10,11 @@ let naclLowLevel = nacl.lowlevel;
 
 type PublicKeyNonce = [PublicKey, number]; // This type exists to workaround an esdoc parse error
 
+/**
+ * Maximum length of derived pubkey seed
+ */
+export const MAX_SEED_LENGTH = 32;
+
 /**
  * A public key
  */
@@ -97,6 +102,9 @@ export class PublicKey {
   ): Promise<PublicKey> {
     let buffer = Buffer.alloc(0);
     seeds.forEach(function (seed) {
+      if (seed.length > MAX_SEED_LENGTH) {
+        throw new Error(`Max seed length exceeded`);
+      }
       buffer = Buffer.concat([buffer, Buffer.from(seed)]);
     });
     buffer = Buffer.concat([