Update NSS to NSS_3_16_RC0.

nss/lib/libpkix/pkix/certsel/pkix_certselector.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_certselector.c
  *
  * CertSelector Object Functions
  *
  */
 
@@ skipping 407 matching lines @@
         PKIX_PL_CertNameConstraints *nameConstraints = NULL;
 
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_NameConstraints");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
 
         PKIX_CHECK(PKIX_ComCertSelParams_GetNameConstraints
                 (params, &nameConstraints, plContext),
                 PKIX_COMCERTSELPARAMSGETNAMECONSTRAINTSFAILED);
 
         if (nameConstraints != NULL) {
-
+                /* As only the end-entity certificate should have
+                 * the common name constrained as if it was a dNSName,
+                 * do not constrain the common name when building a
+                 * forward path.
+                 */
                 PKIX_CHECK(PKIX_PL_Cert_CheckNameConstraints
-                    (cert, nameConstraints, plContext),
+                    (cert, nameConstraints, PKIX_FALSE, plContext),
                     PKIX_CERTCHECKNAMECONSTRAINTSFAILED);
         }
 
 cleanup:
         if (PKIX_ERROR_RECEIVED) {
             *pResult = PKIX_FALSE;
         }
 
         PKIX_DECREF(nameConstraints);
         PKIX_RETURN(CERTSELECTOR);
@@ skipping 1183 matching lines @@
         filtered = NULL;
 
 cleanup:
 
         PKIX_DECREF(filtered);
         PKIX_DECREF(candidate);
 
         PKIX_RETURN(CERTSELECTOR);
 
 }