timeless hotfix (#275)

aptos-labs · Sep 24, 2024 · 46caa9d · 46caa9d
1 parent 04d2a69
commit 46caa9d
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 7 deletions.
diff --git a/types/src/keyless/mod.rs b/types/src/keyless/mod.rs
@@ -141,8 +141,9 @@ impl KeylessSignature {
     }
 
     pub fn verify_expiry(&self, current_time_microseconds: u64) -> anyhow::Result<()> {
-        let block_time = UNIX_EPOCH + Duration::from_micros(current_time_microseconds);
-        let expiry_time = seconds_from_epoch(self.exp_date_secs);
+        let block_time = UNIX_EPOCH.checked_add(Duration::from_micros(current_time_microseconds))
+            .ok_or_else(|| anyhow::anyhow!("Overflowed on UNIX_EPOCH + current_time_microseconds when checking exp_date_secs"))?;
+        let expiry_time = seconds_from_epoch(self.exp_date_secs)?;
 
         if block_time > expiry_time {
             bail!("Keyless signature is expired");
@@ -417,8 +418,10 @@ fn base64url_decode_as_str(b64: &str) -> anyhow::Result<String> {
     Ok(str)
 }
 
-fn seconds_from_epoch(secs: u64) -> SystemTime {
-    UNIX_EPOCH + Duration::from_secs(secs)
+fn seconds_from_epoch(secs: u64) -> anyhow::Result<SystemTime> {
+    Ok(UNIX_EPOCH
+        .checked_add(Duration::from_secs(secs))
+        .ok_or_else(|| anyhow::anyhow!("Overflowed on UNIX_EPOCH + secs in seconds_from_epoch"))?)
 }
 
 #[cfg(test)]

diff --git a/types/src/keyless/openid_sig.rs b/types/src/keyless/openid_sig.rs
@@ -60,9 +60,16 @@ impl OpenIdSig {
     ) -> anyhow::Result<()> {
         let claims: Claims = serde_json::from_str(&self.jwt_payload_json)?;
 
-        let max_expiration_date =
-            seconds_from_epoch(claims.oidc_claims.iat + config.max_exp_horizon_secs);
-        let expiration_date = seconds_from_epoch(exp_timestamp_secs);
+        let max_expiration_date = seconds_from_epoch(
+            claims
+                .oidc_claims
+                .iat
+                .checked_add(config.max_exp_horizon_secs)
+                .ok_or_else(|| {
+                    anyhow::anyhow!("Overflow when adding iat and max_exp_horizon_secs")
+                })?,
+        )?;
+        let expiration_date = seconds_from_epoch(exp_timestamp_secs)?;
 
         ensure!(
             expiration_date < max_expiration_date,