This is not regarding this pull request specifically, but just want to make record of it. Reading varints in this way could potentially provide an attack vector by sending huge varints. I think Google limits them to 64 bits in their code. If you take a look at their [CodedInputStream](https://developers.google.com/protocol-buffers/docs/reference/cpp/google.protobuf.io.coded_stream#CodedInputStream) you'll see a ReadVarint32 and ReadVarint64, but not an open-ended ReadVarint. This may be because they have to read them into fixed types, but it's worth considering limiting it.