IIUC, the failure is due to byte_size being 12000072 = 500003 (len) * 24 (mem::size_of::<$type>):

                let byte_size = (len as usize)
                                    .checked_mul(mem::size_of::<$type>())
                                    .ok_or(self::Error::ParseFailed("Invalid length"))?;
                if byte_size > MAX_VEC_SIZE {
                    return Err(self::Error::OversizedVectorAllocation { requested: byte_size, max: MAX_VEC_SIZE })
                }

and indeed the witness definition has changed between 0.27.1 and 0.28.0:

diff --git a/src/blockdata/transaction.rs b/src/blockdata/transaction.rs
index 4ecac18..445da7d 100644
--- a/src/blockdata/transaction.rs
+++ b/src/blockdata/transaction.rs
@@ -196,7 +198,7 @@ pub struct TxIn {
     /// Encodable/Decodable, as it is (de)serialized at the end of the full
     /// Transaction. It *is* (de)serialized with the rest of the TxIn in other
     /// (de)serialization routines.
-    pub witness: Vec<Vec<u8>>
+    pub witness: Witness
 }

The fix was introduced in 2fd0125.

Damn, ideally this kind of thing would have been addressed through #1023.

Ah, this is about rust-bitcoin 0.28, the above landed in 0.29 (according to github). So hopefully we have a substantially more robust answer to these kinds of bugs in 0.29 already.

AFAIU even 0.28 is unaffected. This PR just adds test out of caution.

I could not foresee the impact when I opened #997. It also lists other potential ways in which block decoding could fail, but all of them required the miner to specifically craft a non-standard tx. Perhaps, this is a lesson for us for back-porting all bug fixes related to decoding/encoding even if they "require miner assistance to deploy".

Upon more investigation, this issue is not completely fixed in 0.28. The PR that changes Witness only accidentally fixes it for 0.28 while decoding things with a large Witness. #997 lists other things that are still possible to crash with 0.28. This is cleanly fixed in 0.29 with #1023.

I have created #1360 as a backport for 0.28 users.