Fix GeneralName directoryName parsing in new (unused) name constraints code.

net/cert/internal/name_constraints.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/name_constraints.h"
 
 #include <limits.h>
 
 #include "base/strings/string_util.h"
 #include "net/cert/internal/verify_name_match.h"
@@ skipping 161 matching lines @@
       subtrees->dns_names.push_back(s);
       break;
     }
     // x400Address                     [3]     ORAddress,
     case 3:
       if (!der::IsConstructed(tag))
         return false;
       name_type = GENERAL_NAME_X400_ADDRESS;
       break;
     // directoryName                   [4]     Name,
-    case 4:
+    case 4: {
       if (!der::IsConstructed(tag))
         return false;
       name_type = GENERAL_NAME_DIRECTORY_NAME;
-      subtrees->directory_names.push_back(std::vector<uint8_t>(
-          value.UnsafeData(), value.UnsafeData() + value.Length()));
+      // Name is a CHOICE { rdnSequence  RDNSequence }, therefore the SEQUENCE
+      // tag is explicit. Remove it, since the name matching functions expect
+      // only the value portion.
+      der::Parser name_parser(value);
+      der::Input name_value;
+      if (!name_parser.ReadTag(der::kSequence, &name_value) || parser.HasMore())
+        return false;
+      subtrees->directory_names.push_back(
+          std::vector<uint8_t>(name_value.UnsafeData(),
+                               name_value.UnsafeData() + name_value.Length()));
       break;
+    }
     // ediPartyName                    [5]     EDIPartyName,
     case 5:
       if (!der::IsConstructed(tag))
         return false;
       name_type = GENERAL_NAME_EDI_PARTY_NAME;
       break;
     // uniformResourceIdentifier       [6]     IA5String,
     case 6:
       if (der::IsConstructed(tag))
         return false;
@@ skipping 365 matching lines @@
 
   return false;
 }
 
 int NameConstraints::ConstrainedNameTypes() const {
   return (permitted_subtrees_.present_name_types |
           excluded_subtrees_.present_name_types);
 }
 
 }  // namespace net