Merge of IOTSSL-476 - Random malloc in pem_read()
diff --git a/ChangeLog b/ChangeLog
index 63cedaa..2aa7a21 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -16,6 +16,10 @@
but might be in other uses. On 32 bit machines, requires reading a string
of close to or larger than 1GB to exploit; on 64 bit machines, would require
reading a string of close to or larger than 2^62 bytes.
+ * Fix potential random memory allocation in mbedtls_pem_read_buffer()
+ on crafted PEM input data. Found an fix provided by Guid Vranken.
+ Not triggerable remotely in TLS. Triggerable remotely if you accept PEM
+ data from an untrusted source.
Changes
* Added checking of hostname length in mbedtls_ssl_set_hostname() to ensure
