Function pb_fields_bounded 

pub fn pb_fields_bounded(
    b: &[u8],
    max: usize,
) -> Result<Vec<(u32, PbValue<'_>)>>

pb_fields, refusing a message with more than max fields before collecting them, so a peer cannot turn a few megabytes of two-byte fields into a vector many times larger.