PKIX: refactoring around CertPath validation

- reduced allocations
- improved policy node removal logic

Author: peterdettman

prov/src/main/java/org/bouncycastle/jcajce/PKIXCRLStoreSelector.java

@@ -185,45 +185,44 @@ public boolean match(CRL obj)
         }
 
         X509CRL crl = (X509CRL)obj;
-        ASN1Integer dci = null;
-        try
+
+        // TODO[pkix] Do we always need to parse the Delta CRL Indicator extension?
         {
-            byte[] bytes = crl
-                .getExtensionValue(Extension.deltaCRLIndicator.getId());
-            if (bytes != null)
+            ASN1Integer baseCRLNumber = null;
+            try
             {
-                dci = ASN1Integer.getInstance(ASN1OctetString.getInstance(bytes).getOctets());
+                byte[] dci = crl.getExtensionValue(Extension.deltaCRLIndicator.getId());
+                if (dci != null)
+                {
+                    baseCRLNumber = ASN1Integer.getInstance(ASN1OctetString.getInstance(dci).getOctets());
+                }
             }
-        }
-        catch (Exception e)
-        {
-            return false;
-        }
-        if (isDeltaCRLIndicatorEnabled())
-        {
-            if (dci == null)
+            catch (Exception e)
             {
                 return false;
             }
-        }
-        if (isCompleteCRLEnabled())
-        {
-            if (dci != null)
+
+            if (baseCRLNumber == null)
             {
-                return false;
+                if (isDeltaCRLIndicatorEnabled())
+                {
+                    return false;
+                }
             }
-        }
-        if (dci != null)
-        {
-
-            if (maxBaseCRLNumber != null)
+            else
             {
-                if (dci.getPositiveValue().compareTo(maxBaseCRLNumber) == 1)
+                if (isCompleteCRLEnabled())
+                {
+                    return false;
+                }
+
+                if (maxBaseCRLNumber != null && baseCRLNumber.getPositiveValue().compareTo(maxBaseCRLNumber) == 1)
                 {
                     return false;
                 }
             }
         }
+
         if (issuingDistributionPointEnabled)
         {
             byte[] idp = crl