Fix crash in pb_release() if called twice on same message.

There was a double-free bug in pb_release() because it didn't set size fields
to zero after deallocation. Most commonly this happens if pb_decode() fails,
internally calls pb_release() and then application code also calls pb_release().

pb_decode.c

@@ -962,16 +962,20 @@ void pb_release(const pb_field_t fields[], void *dest_struct)
                     pb_free(*pItem);
                     *pItem++ = NULL;
                 }
+                *(pb_size_t*)iter.pSize = 0;
             }
             else if (PB_LTYPE(type) == PB_LTYPE_SUBMESSAGE)
             {
                 /* Release fields in submessages */
                 void *pItem = *(void**)iter.pData;
-                size_t count = (pItem ? 1 : 0);
+                if (pItem)
+                {
+                    pb_size_t count = 1;
                     
                     if (PB_HTYPE(type) == PB_HTYPE_REPEATED)
                     {
-                    count = *(size_t*)iter.pSize;   
+                        count = *(pb_size_t*)iter.pSize;
+                        *(pb_size_t*)iter.pSize = 0;
                     }
                     
                     while (count--)
@@ -980,6 +984,7 @@ void pb_release(const pb_field_t fields[], void *dest_struct)
                         pItem = (uint8_t*)pItem + iter.pos->data_size;
                     }
                 }
+            }
             
             /* Release main item */
             pb_free(*(void**)iter.pData);