diff --git a/ChangeLog.txt b/ChangeLog.txt
index 4860d73e72..d804e4cc96 100644
--- a/ChangeLog.txt
+++ b/ChangeLog.txt
@@ -9,6 +9,7 @@ Broker:
   again.
 - Will topic isn't truncated by one byte when using a mount_point any more.
 - Network errors are printed correctly on Windows.
+- Fix incorrect $SYS heap memory reporting when using ACLs.
 
 Client library:
 - Fix the case where a message received just before the keepalive timer
diff --git a/src/security_default.c b/src/security_default.c
index a1d3ec1dff..c64e4568f3 100644
--- a/src/security_default.c
+++ b/src/security_default.c
@@ -278,7 +278,7 @@ int mosquitto_acl_check_default(struct mosquitto_db *db, struct mosquitto *conte
 			ulen = 0;
 			len = tlen + acl_root->ccount*(clen-2);
 		}
-		local_acl = malloc(len+1);
+		local_acl = _mosquitto_malloc(len+1);
 		if(!local_acl) return 1; // FIXME
 		s = local_acl;
 		for(i=0; i<tlen; i++){
@@ -803,7 +803,7 @@ int _base64_decode(char *in, unsigned char **decoded, unsigned int *decoded_len)
 		BIO_free_all(b64);
 		return 1;
 	}
-	*decoded = calloc(strlen(in), 1);
+	*decoded = _mosquitto_calloc(strlen(in), 1);
 	*decoded_len =  BIO_read(b64, *decoded, strlen(in));
 	BIO_free_all(b64);