RT3662: Allow leading . in nameConstraints

Change by SteveH from original by John Denker (in the RT)
Reviewed-by: NRich Salz <rsalz@openssl.org>

crypto/x509v3/v3_ncons.c

@@ -405,7 +405,7 @@ static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
 	if (dns->length > base->length)
 		{
 		dnsptr += dns->length - base->length;
-		if (dnsptr[-1] != '.')
+		if (*baseptr != '.' && dnsptr[-1] != '.')
 			return X509_V_ERR_PERMITTED_VIOLATION;
 		}