Expand todo for CVE-2019-14655

This needs likely to be rejected according to current knowledge.
Reporter of the issue did reached same conclusion that there is no
heap-based buffer oveflow actually but still able to reproduce some
infinite loop.

Let's monitor that CVE later on and look if MITRE rejects it.