3 files changed, 37 insertions, 0 deletions
diff --git a/tests/regression/issue_205/SConscript b/tests/regression/issue_205/SConscript
new file mode 100644
index 00000000..ed8899dd
--- /dev/null
+++ b/tests/regression/issue_205/SConscript
@@ -0,0 +1,14 @@
+# Check that pb_release() correctly handles corrupted size fields of
+# static arrays.
+
+Import('env', 'malloc_env')
+
+env.NanopbProto('size_corruption')
+
+p = malloc_env.Program(["size_corruption.c",
+                         "size_corruption.pb.c",
+                         "$COMMON/pb_decode_with_malloc.o",
+                         "$COMMON/pb_common_with_malloc.o",
+                         "$COMMON/malloc_wrappers.o"])
+env.RunTest(p)
+
diff --git a/tests/regression/issue_205/size_corruption.c b/tests/regression/issue_205/size_corruption.c
new file mode 100644
index 00000000..08cef457
--- /dev/null
+++ b/tests/regression/issue_205/size_corruption.c
@@ -0,0 +1,12 @@
+#include "size_corruption.pb.h"
+#include <pb_decode.h>
+
+int main()
+{
+    MainMessage msg = MainMessage_init_zero;
+    msg.bar_count = (pb_size_t)-1;
+    pb_release(MainMessage_fields, &msg);
+    
+    return 0;
+}
+
diff --git a/tests/regression/issue_205/size_corruption.proto b/tests/regression/issue_205/size_corruption.proto
new file mode 100644
index 00000000..6c9c2453
--- /dev/null
+++ b/tests/regression/issue_205/size_corruption.proto
@@ -0,0 +1,11 @@
+syntax = "proto2";
+import 'nanopb.proto';
+
+message SubMessage {
+    repeated int32 foo = 1 [(nanopb).type = FT_POINTER];
+}
+
+message MainMessage {
+    repeated SubMessage bar = 1 [(nanopb).max_count = 5];
+}
+