Fix API mismatch between NameConstraints::IsPermittedCert's subjectAltName param and ParseExtension.

net/cert/internal/name_constraints.cc

Index: net/cert/internal/name_constraints.cc
diff --git a/net/cert/internal/name_constraints.cc b/net/cert/internal/name_constraints.cc
index 2873acabe90d59dc2203da8d19b41ee04ea17949..2ad35dda89df0cea62cf32b87294f7f7bc3c1ec4 100644
--- a/net/cert/internal/name_constraints.cc
+++ b/net/cert/internal/name_constraints.cc
@@ -396,7 +396,8 @@ bool NameConstraints::Parse(const der::Input& extension_value,
 
 bool NameConstraints::IsPermittedCert(
     const der::Input& subject_rdn_sequence,
-    const der::Input& subject_alt_name_extnvalue_tlv) const {
+    bool has_subject_alt_name,
+    const der::Input& subject_alt_name_tlv) const {
   // Subject Alternative Name handling:
   //
   // RFC 5280 section 4.2.1.6:
@@ -407,12 +408,7 @@ bool NameConstraints::IsPermittedCert(
   // GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
 
   GeneralNames san_names;
-  if (subject_alt_name_extnvalue_tlv.Length()) {
-    der::Parser extnvalue_parser(subject_alt_name_extnvalue_tlv);
-    der::Input subject_alt_name_tlv;
-    if (!extnvalue_parser.ReadTag(der::kOctetString, &subject_alt_name_tlv))
-      return false;
-
+  if (has_subject_alt_name) {
     der::Parser subject_alt_name_parser(subject_alt_name_tlv);
     der::Parser san_sequence_parser;
     if (!subject_alt_name_parser.ReadSequence(&san_sequence_parser))
@@ -466,6 +462,8 @@ bool NameConstraints::IsPermittedCert(
       if (!IsPermittedIP(ip_address))
         return false;
     }
+  } else {
+    DCHECK_EQ(0U, subject_alt_name_tlv.Length());
   }
 
   // Subject handling:
@@ -477,7 +475,7 @@ bool NameConstraints::IsPermittedCert(
   // form, but the certificate does not include a subject alternative name, the
   // rfc822Name constraint MUST be applied to the attribute of type emailAddress
   // in the subject distinguished name.
-  if (!subject_alt_name_extnvalue_tlv.Length() &&
+  if (!has_subject_alt_name &&
       (ConstrainedNameTypes() & GENERAL_NAME_RFC822_NAME)) {
     bool contained_email_address = false;
     if (!NameContainsEmailAddress(subject_rdn_sequence,
@@ -496,10 +494,8 @@ bool NameConstraints::IsPermittedCert(
   // This code assumes that criticality condition is checked by the caller, and
   // therefore only needs to avoid the IsPermittedDirectoryName check against an
   // empty subject in such a case.
-  if (subject_alt_name_extnvalue_tlv.Length() &&
-      subject_rdn_sequence.Length() == 0) {
+  if (has_subject_alt_name && subject_rdn_sequence.Length() == 0)
     return true;
-  }
 
   return IsPermittedDirectoryName(subject_rdn_sequence);
 }