Update NSS to NSS_3_16_RC0.

nss/lib/certhigh/certvfy.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 #include "nspr.h"
 #include "secerr.h"
 #include "secport.h"
 #include "seccomon.h"
 #include "secoid.h"
 #include "sslerr.h"
 #include "genname.h"
@@ skipping 531 matching lines @@
                 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
             }
             pathLengthLimit = basicConstraint.pathLenConstraint;
             isca = PR_TRUE;
         }    
         /* make sure that the path len constraint is properly set.*/
         if (pathLengthLimit >= 0 && currentPathLen > pathLengthLimit) {
             PORT_SetError (SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID);
             LOG_ERROR_OR_EXIT(log, issuerCert, count+1, pathLengthLimit);
         }
-        
+
+        /* make sure that the entire chain is within the name space of the
+         * current issuer certificate.
+         */
+        rv = CERT_CompareNameSpace(issuerCert, namesList, certsList,
+                                   arena, &badCert);
+        if (rv != SECSuccess || badCert != NULL) {
+            PORT_SetError(SEC_ERROR_CERT_NOT_IN_NAME_SPACE);
+            LOG_ERROR_OR_EXIT(log, badCert, count + 1, 0);
+            goto loser;
+        }
+
         /* XXX - the error logging may need to go down into CRL stuff at some
          * point
          */
         /* check revoked list (issuer) */
         rv = SEC_CheckCRL(handle, subjectCert, issuerCert, t, wincx);
         if (rv == SECFailure) {
             if (revoked) {
                 *revoked = PR_TRUE;
             }
             LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
@@ skipping 101 matching lines @@
                 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
             }
 
             /* make sure key usage allows cert signing */
             if (CERT_CheckKeyUsage(issuerCert, requiredCAKeyUsage) != SECSuccess) {
                 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
                 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,requiredCAKeyUsage);
             }
         }
 
-        /* make sure that the entire chain is within the name space of the 
-        ** current issuer certificate.
-        */
-        rv = CERT_CompareNameSpace(issuerCert, namesList, certsList, 
-                                   arena, &badCert);
-        if (rv != SECSuccess || badCert != NULL) {
-            PORT_SetError(SEC_ERROR_CERT_NOT_IN_NAME_SPACE);
-            LOG_ERROR_OR_EXIT(log, badCert, count + 1, 0);
-            goto loser;
-        }
         /* make sure that the issuer is not self signed.  If it is, then
          * stop here to prevent looping.
          */
         if (issuerCert->isRoot) {
             PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
             LOG_ERROR(log, issuerCert, count+1, 0);
             goto loser;
         } 
         /* The issuer cert will be the subject cert in the next loop.
          * A cert is self-issued if its subject and issuer are equal and
@@ skipping 1183 matching lines @@
             return chain;
         }
 
         cert = CERT_FindCertIssuer(cert, time, usage);
     }
 
     /* return partial chain */
     PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
     return chain;
 }