Reduce buggy usage of the registry controlled domain service.

net/cert/cert_verify_proc.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/cert_verify_proc.h"
 
 #include <stdint.h>
 
 #include <algorithm>
 
@@ skipping 513 matching lines @@
 static bool CheckNameConstraints(const std::vector<std::string>& dns_names,
                                  const char domains[][kMaxDomainLength]) {
   for (std::vector<std::string>::const_iterator i = dns_names.begin();
        i != dns_names.end(); ++i) {
     bool ok = false;
     url::CanonHostInfo host_info;
     const std::string dns_name = CanonicalizeHost(*i, &host_info);
     if (host_info.IsIPAddress())
       continue;
 
-    const size_t registry_len = registry_controlled_domains::GetRegistryLength(
-        dns_name,
-        registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES,
-        registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
     // If the name is not in a known TLD, ignore it. This permits internal
     // names.
-    if (registry_len == 0)

[Peter Kasting, 2016/10/22 05:04:20]

We don't need to worry about a behavioral change due to how this used to not
check for npos, do we?

[brettw, 2016/10/24 21:45:24]

No, because the name is canonical (it would be slightly faster to call the
canonical version and get the length, but I think this is more readable).

+    if (!registry_controlled_domains::HostHasRegistryControlledDomain(
+            dns_name, registry_controlled_domains::EXCLUDE_UNKNOWN_REGISTRIES,
+            registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES))
       continue;
 
     for (size_t j = 0; domains[j][0]; ++j) {
       const size_t domain_length = strlen(domains[j]);
       // The DNS name must have "." + domains[j] as a suffix.
       if (i->size() <= (1 /* period before domain */ + domain_length))
         continue;
 
       std::string suffix =
           base::ToLowerASCII(&(*i)[i->size() - domain_length - 1]);
@@ skipping 158 matching lines @@
     return true;
 
   // For certificates issued after 1 April 2015: 39 months.
   if (start >= time_2015_04_01 && month_diff > 39)
     return true;
 
   return false;
 }
 
 }  // namespace net