PORT_Free(constraintsExtension.data);
CERT_CompareNameSpace(CERTCertificate  *cert,		      CERTGeneralName  *namesList, 		      CERTCertificate **certsList, 		      PRArenaPool      *arena, 		      CERTCertificate **pBadCert){    SECStatus            rv;    SECItem              constraintsExtension;    CERTNameConstraints  *constraints;    CERTGeneralName      *currentName;    int                  count = 0;    CERTNameConstraint  *matchingConstraints;    CERTCertificate      *badCert = NULL;        rv = CERT_FindCertExtension(cert, SEC_OID_X509_NAME_CONSTRAINTS,                                 &constraintsExtension);    if (rv != SECSuccess) {	if (PORT_GetError() == SEC_ERROR_EXTENSION_NOT_FOUND) {	    rv = SECSuccess;	} else {	    count = -1;	}	goto done;    }    /* TODO: mark arena */    constraints = cert_DecodeNameConstraints(arena, &constraintsExtension);    currentName = namesList;    if (constraints == NULL) { /* decode failed */	rv = SECFailure;    	count = -1;	goto done;    }     do { 	if (constraints->excluded != NULL) { 	    rv = CERT_GetNameConstraintByType(constraints->excluded, 	                                      currentName->type,  					      &matchingConstraints, arena); 	    if (rv == SECSuccess && matchingConstraints != NULL) { 		rv = cert_CompareNameWithConstraints(currentName, 		                                     matchingConstraints, 						     PR_TRUE); 	    }	    if (rv != SECSuccess) 		break; 	} 	if (constraints->permited != NULL) { 	    rv = CERT_GetNameConstraintByType(constraints->permited, 	                                      currentName->type,  					      &matchingConstraints, arena);            if (rv == SECSuccess && matchingConstraints != NULL) { 		rv = cert_CompareNameWithConstraints(currentName, 		                                     matchingConstraints, 						     PR_FALSE); 	    }	    if (rv != SECSuccess) 		break; 	} 	currentName = CERT_GetNextGeneralName(currentName); 	count ++;    } while (currentName != namesList);done:    if (rv != SECSuccess) {	badCert = (count >= 0) ? certsList[count] : cert;    }    if (pBadCert)	*pBadCert = badCert;    /* TODO: release back to mark */    return rv;}