Fix API mismatch between NameConstraints::IsPermittedCert's subjectAltName param and ParseExtension.

net/cert/internal/name_constraints.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/name_constraints.h"
 
 #include <limits.h>
 
 #include "base/strings/string_util.h"
 #include "net/cert/internal/verify_name_match.h"
@@ skipping 378 matching lines @@
     return false;
 
   if (sequence_parser.HasMore())
     return false;
 
   return true;
 }
 
 bool NameConstraints::IsPermittedCert(
     const der::Input& subject_rdn_sequence,
-    const der::Input& subject_alt_name_extnvalue_tlv) const {
+    bool has_subject_alt_name,
+    const der::Input& subject_alt_name_tlv) const {
   // Subject Alternative Name handling:
   //
   // RFC 5280 section 4.2.1.6:
   // id-ce-subjectAltName OBJECT IDENTIFIER ::=  { id-ce 17 }
   //
   // SubjectAltName ::= GeneralNames
   //
   // GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
 
   GeneralNames san_names;
-  if (subject_alt_name_extnvalue_tlv.Length()) {
-    der::Parser extnvalue_parser(subject_alt_name_extnvalue_tlv);
-    der::Input subject_alt_name_tlv;
-    if (!extnvalue_parser.ReadTag(der::kOctetString, &subject_alt_name_tlv))
-      return false;
-
+  if (has_subject_alt_name) {
     der::Parser subject_alt_name_parser(subject_alt_name_tlv);
     der::Parser san_sequence_parser;
     if (!subject_alt_name_parser.ReadSequence(&san_sequence_parser))
       return false;
     // Should not have trailing data after subjectAltName sequence.
     if (subject_alt_name_parser.HasMore())
       return false;
     // The subjectAltName sequence should have at least 1 element.
     if (!san_sequence_parser.HasMore())
       return false;
@@ skipping 33 matching lines @@
       if (!IsPermittedDirectoryName(
               der::Input(directory_name.data(), directory_name.size()))) {
         return false;
       }
     }
 
     for (const auto& ip_address : san_names.ip_addresses) {
       if (!IsPermittedIP(ip_address))
         return false;
     }
+  } else {
+    DCHECK_EQ(0U, subject_alt_name_tlv.Length());
   }
 
   // Subject handling:
 
   // RFC 5280 section 4.2.1.10:
   // Legacy implementations exist where an electronic mail address is embedded
   // in the subject distinguished name in an attribute of type emailAddress
   // (Section 4.1.2.6). When constraints are imposed on the rfc822Name name
   // form, but the certificate does not include a subject alternative name, the
   // rfc822Name constraint MUST be applied to the attribute of type emailAddress
   // in the subject distinguished name.
-  if (!subject_alt_name_extnvalue_tlv.Length() &&
+  if (!has_subject_alt_name &&
       (ConstrainedNameTypes() & GENERAL_NAME_RFC822_NAME)) {
     bool contained_email_address = false;
     if (!NameContainsEmailAddress(subject_rdn_sequence,
                                   &contained_email_address)) {
       return false;
     }
     if (contained_email_address)
       return false;
   }
 
   // RFC 5280 4.1.2.6:
   // If subject naming information is present only in the subjectAltName
   // extension (e.g., a key bound only to an email address or URI), then the
   // subject name MUST be an empty sequence and the subjectAltName extension
   // MUST be critical.
   // This code assumes that criticality condition is checked by the caller, and
   // therefore only needs to avoid the IsPermittedDirectoryName check against an
   // empty subject in such a case.
-  if (subject_alt_name_extnvalue_tlv.Length() &&
-      subject_rdn_sequence.Length() == 0) {
+  if (has_subject_alt_name && subject_rdn_sequence.Length() == 0)
     return true;
-  }
 
   return IsPermittedDirectoryName(subject_rdn_sequence);
 }
 
 bool NameConstraints::IsPermittedDNSName(const std::string& name) const {
   for (const std::string& excluded_name : excluded_subtrees_.dns_names) {
     // When matching wildcard hosts against excluded subtrees, consider it a
     // match if the constraint would match any expansion of the wildcard. Eg,
     // *.bar.com should match a constraint of foo.bar.com.
     if (DNSNameMatches(name, excluded_name, WILDCARD_PARTIAL_MATCH))
@@ skipping 60 matching lines @@
 
   return false;
 }
 
 int NameConstraints::ConstrainedNameTypes() const {
   return (permitted_subtrees_.present_name_types |
           excluded_subtrees_.present_name_types);
 }
 
 }  // namespace net