Update NSS to NSS_3_16_RC0.

nss/lib/certdb/certdb.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * Certificate handling code
  */
 
 #include "nssilock.h"
 #include "prmon.h"
@@ skipping 1363 matching lines @@
 
             if ( match == 0 ) {
                 rv = SECSuccess;
             } else {
                 PORT_SetError(SSL_ERROR_BAD_CERT_DOMAIN);
                 rv = SECFailure;
             }
             return rv;
         }
     } else {
-        /* New approach conforms to RFC 2818. */
+        /* New approach conforms to RFC 6125. */
         char *wildcard    = PORT_Strchr(cn, '*');
         char *firstcndot  = PORT_Strchr(cn, '.');
         char *secondcndot = firstcndot ? PORT_Strchr(firstcndot+1, '.') : NULL;
         char *firsthndot  = PORT_Strchr(hn, '.');
 
         /* For a cn pattern to be considered valid, the wildcard character...
          * - may occur only in a DNS name with at least 3 components, and
          * - may occur only as last character in the first component, and
-         * - may be preceded by additional characters
+         * - may be preceded by additional characters, and
+         * - must not be preceded by an IDNA ACE prefix (xn--)
          */
         if (wildcard && secondcndot && secondcndot[1] && firsthndot 
-            && firstcndot  - wildcard  == 1
-            && secondcndot - firstcndot > 1
-            && PORT_Strrchr(cn, '*') == wildcard
+            && firstcndot  - wildcard  == 1 /* wildcard is last char in first component */
+            && secondcndot - firstcndot > 1 /* second component is non-empty */
+            && PORT_Strrchr(cn, '*') == wildcard /* only one wildcard in cn */
             && !PORT_Strncasecmp(cn, hn, wildcard - cn)
-            && !PORT_Strcasecmp(firstcndot, firsthndot)) {
+            && !PORT_Strcasecmp(firstcndot, firsthndot)
+               /* If hn starts with xn--, then cn must start with wildcard */
+            && (PORT_Strncasecmp(hn, "xn--", 4) || wildcard == cn)) {
             /* valid wildcard pattern match */
             return SECSuccess;
         }
     }
     /* String cn has no wildcard or shell expression.  
      * Compare entire string hn with cert name. 
      */
     if (PORT_Strcasecmp(hn, cn) == 0) {
         return SECSuccess;
     }
@@ skipping 1852 matching lines @@
     CERTCertificate *cert = NULL;
     SECItem *derCert;
 
     derCert = cert_FindDERCertBySubjectKeyID(subjKeyID);
     if (derCert) {
         cert = CERT_FindCertByDERCert(handle, derCert);
         SECITEM_FreeItem(derCert, PR_TRUE);
     }
     return cert;
 }