github bcgit#631 fixed class misalignment on OtherName in name constraints.

Author: dghgit

core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java

@@ -487,7 +487,7 @@ private Set unionDN(Set excluded, ASN1Sequence dn)
             Iterator it = excluded.iterator();
             while (it.hasNext())
             {
-                ASN1Sequence subtree = (ASN1Sequence)it.next();
+                ASN1Sequence subtree = ASN1Sequence.getInstance(it.next());
 
                 if (withinDNSubtree(dn, subtree))
                 {
@@ -513,7 +513,7 @@ private Set intersectOtherName(Set permitted, Set otherNames)
         Set intersect = new HashSet();
         for (Iterator it = otherNames.iterator(); it.hasNext();)
         {
-            Object otName = it.next();
+            Object otName = OtherName.getInstance(((GeneralSubtree)it.next()).getBase().getName());
 
             if (permitted == null)
             {
@@ -865,7 +865,7 @@ private void checkPermittedOtherName(Set permitted, OtherName name)
 
         while (it.hasNext())
         {
-            OtherName str = ((OtherName)it.next());
+            OtherName str = OtherName.getInstance(it.next());
 
             if (otherNameIsConstrained(name, str))
             {
@@ -2169,4 +2169,8 @@ public String toString()
         }
         return temp.toString();
     }
+
+    public static void main(final String[] args) {
+
+    }
 }

prov/src/test/java/org/bouncycastle/jce/provider/test/PKIXNameConstraintsTest.java

@@ -234,6 +234,31 @@ public void performTest() throws Exception
 
         PKIXNameConstraintValidator validator = new PKIXNameConstraintValidator();
         validator.intersectPermittedSubtree(subtree);
+
+        name = new GeneralName(GeneralName.otherName, new OtherName(new ASN1ObjectIdentifier("1.1"), DERNull.INSTANCE));
+        subtree = new GeneralSubtree(name);
+
+        validator = new PKIXNameConstraintValidator();
+        validator.intersectPermittedSubtree(subtree);
+        validator.addExcludedSubtree(subtree);
+
+        try
+        {
+            validator.checkExcluded(name);
+        }
+        catch (PKIXNameConstraintValidatorException e)
+        {
+            isEquals("OtherName is from an excluded subtree.", e.getMessage());
+        }
+
+        try
+        {
+            validator.checkPermitted(name);
+        }
+        catch (PKIXNameConstraintValidatorException e)
+        {
+            fail(e.getMessage());
+        }
     }
 
     /**