mbedTLS/PolarSSL -- DoS and possible remote code execution

ARM Limited reports:

When the client creates its ClientHello message, due to
insufficient bounds checking it can overflow the heap-based buffer
containing the message while writing some extensions. Two extensions in
particular could be used by a remote attacker to trigger the overflow:
the session ticket extension and the server name indication (SNI)
extension.