Update to NSS 3.12.7 and NSPR 4.8.6....

nss/mozilla/security/nss/lib/certhigh/certvfy.c

 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
  * The contents of this file are subject to the Mozilla Public License Version
  * 1.1 (the "License"); you may not use this file except in compliance with
  * the License. You may obtain a copy of the License at
  * http://www.mozilla.org/MPL/
  *
  * Software distributed under the License is distributed on an "AS IS" basis,
  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
@@ skipping 464 matching lines @@
 
     /* if the issuer is not an old fortezza cert, we bail */
     if (key->keyType != fortezzaKey) {
         SECKEY_DestroyPublicKey(key);
         /* CA Cert not fortezza */
         PORT_SetError(SEC_ERROR_NOT_FORTEZZA_ISSUER);
         return SECFailure;
     }
 
     /* get the privilege mask */
-    if (key->u.fortezza.DSSpriviledge.len > 0) {
-        priv = key->u.fortezza.DSSpriviledge.data[0];
+    if (key->u.fortezza.DSSprivilege.len > 0) {
+        priv = key->u.fortezza.DSSprivilege.data[0];
     }
 
     /*
      * make sure the CA's keys are OK
      */
             
     rv = SEC_CheckKRL(handle, key, NULL, t, wincx);
     SECKEY_DestroyPublicKey(key);
     if (rv != SECSuccess) {
         return rv;
@@ skipping 143 matching lines @@
 
         /* Construct a list of names for the current and all previous 
          * certifcates (except leaf (EE) certs, root CAs, and self-issued
          * intermediate CAs) to be verified against the name constraints 
          * extension of the issuer certificate. 
          */
         if (subjectCertIsSelfIssued == PR_FALSE) {
             CERTGeneralName *subjectNameList;
             int subjectNameListLen;
             int i;
-            subjectNameList    = CERT_GetCertificateNames(subjectCert, arena);
+            PRBool getSubjectCN = (!count && certUsage == certUsageSSLServer);
+            subjectNameList = 
+                CERT_GetConstrainedCertificateNames(subjectCert, arena,
+                                                    getSubjectCN);
             if (!subjectNameList)
                 goto loser;
             subjectNameListLen = CERT_GetNamesLength(subjectNameList);
             if (!subjectNameListLen)
                 goto loser;
             if (certsListLen <= namesCount + subjectNameListLen) {
                 CERTCertificate **tmpCertsList;
                 certsListLen = (namesCount + subjectNameListLen) * 2;
                 tmpCertsList = 
                     (CERTCertificate **)PORT_Realloc(certsList, 
@@ skipping 1370 matching lines @@
             return chain;
         }
 
         cert = CERT_FindCertIssuer(cert, time, usage);
     }
 
     /* return partial chain */
     PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
     return chain;
 }