nanopb is vulnerable to invalid freeing of memory. The vulnerability possible when it calls the function free()
on a pointer value that comes from uninitialized memory and when the following conditions are met: 1. compile with PB_ENABLE_MALLOC
and 2. message to be decoded contains a repeated string, bytes or message field and 3. realloc() runs out of memory when expanding the array