sdk/ts: guard flexAlgoNodeSegments loop against pre-RFC-18 mainnet accounts

Author: ben-malbeclabs

sdk/serviceability/typescript/serviceability/state.ts

@@ -550,6 +550,10 @@ function deserializeInterface(r: DefensiveReader): DeviceInterface {
     const segCount = r.readU32();
     const flexAlgoNodeSegments: FlexAlgoNodeSegment[] = [];
     for (let i = 0; i < segCount; i++) {
+      // Break early if there isn't enough data for a full segment. On pre-RFC-18
+      // mainnet accounts, segCount reads garbage bytes from the next field, so
+      // without this guard the loop runs hundreds of thousands of times.
+      if (r.remaining < 34) break; // 32 (pubkey) + 2 (u16)
       flexAlgoNodeSegments.push({
         topology: readPubkey(r),
         nodeSegmentIdx: r.readU16(),