From 320fd18555255dae4c5ac4fd338da0769b86464b Mon Sep 17 00:00:00 2001 From: Johnson Ajibi Date: Fri, 2 Oct 2026 22:03:28 +0100 Subject: [PATCH] changelog: list every affected API explicitly per review feedback Previous wording only named the four low-level update() functions directly touched by the fix. mpg pointed out a normal user calling mbedtls_md_update(), psa_hash_compare(), or any of the one-shot wrappers (mbedtls_md5(), mbedtls_sha256(), psa_hash_compute(), etc.) has no way to tell from that wording whether they are affected, and that SHA-224 should be listed explicitly even though it shares mbedtls_sha256_update() under the hood, since that implementation detail should not be something a ChangeLog reader needs to already know. Signed-off-by: Johnson Ajibi --- ChangeLog.d/sha256-update-ilen-over-4gib.txt | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/ChangeLog.d/sha256-update-ilen-over-4gib.txt b/ChangeLog.d/sha256-update-ilen-over-4gib.txt index cad065a107..efbb7b4dc5 100644 --- a/ChangeLog.d/sha256-update-ilen-over-4gib.txt +++ b/ChangeLog.d/sha256-update-ilen-over-4gib.txt @@ -1,5 +1,12 @@ Bugfix - * Fix mbedtls_md5_update(), mbedtls_sha1_update(), - mbedtls_sha256_update() and mbedtls_ripemd160_update() computing the - wrong digest when a single call is passed 4GiB or more of input on a - 64-bit platform. Reported by TimothyPMann in #10964. + * Fix MD5, SHA1, SHA224, SHA256 and RIPEMD160 computing the wrong + digest when 4GiB of data or more are processed in a single call. + That can happen either when using the one-shot APIs + (psa_hash_compute(), psa_hash_compare(), mbedtls_md(), + mbedtls_md5(), mbedtls_sha1(), mbedtls_ripemd160(), + mbedtls_sha256()) with more than 4GiB of input, or when using the + streaming API and passing more than 4GiB in a single call to the + update function (psa_hash_update(), mbedtls_md_update(), + mbedtls_md5_update(), mbedtls_sha1_update(), + mbedtls_ripemd160_update(), mbedtls_sha256_update()). Reported by + TimothyPMann in #10964.