Fix conformance issues around type conversion overflows and duration subtractions

PiperOrigin-RevId: 955074851

Author: l46kok

common/src/main/java/dev/cel/common/CelOptions.java

@@ -118,6 +118,8 @@ public enum ProtoUnsetFieldOptions {
 
   public abstract boolean enableComprehension();
 
+  public abstract boolean enableCanonicalEnumRangeCheck();
+
   public abstract int maxRegexProgramSize();
 
   public abstract Builder toBuilder();
@@ -163,6 +165,7 @@ public static Builder newBuilder() {
         .unwrapWellKnownTypesOnFunctionDispatch(true)
         .fromProtoUnsetFieldOption(ProtoUnsetFieldOptions.BIND_DEFAULT)
         .enableComprehension(true)
+        .enableCanonicalEnumRangeCheck(true)
         .maxRegexProgramSize(-1);
   }
 
@@ -518,6 +521,16 @@ public abstract static class Builder {
      */
     public abstract Builder enableJsonFieldNames(boolean value);
 
+    /**
+     * Enable or disable checking that integer numbers converted to protobuf enum values fall
+     * strictly within the 32-bit signed integer range ({@code [Integer.MIN_VALUE,
+     * Integer.MAX_VALUE]}). Defaults to enabled.
+     *
+     * <p>Disabling this option is an out-of-conformance behavior that allows out-of-range integer
+     * assignments to proto enum fields without throwing an exception.
+     */
+    public abstract Builder enableCanonicalEnumRangeCheck(boolean value);
+
     public abstract CelOptions build();
   }
 }

common/src/main/java/dev/cel/common/internal/ProtoAdapter.java

@@ -325,13 +325,6 @@ private BidiConverter fieldToValueConverter(FieldDescriptor fieldDescriptor) {
             value -> BidiConverter.IDENTITY.backwardConverter().convert(maybeUnwrap(value)));
       case FLOAT:
         return unwrapAndConvert(DOUBLE_CONVERTER);
-      case DOUBLE:
-      case SFIXED64:
-      case SINT64:
-      case INT64:
-        return BidiConverter.of(
-            BidiConverter.IDENTITY.forwardConverter(),
-            value -> BidiConverter.IDENTITY.backwardConverter().convert(maybeUnwrap(value)));
       case BYTES:
         if (celOptions.evaluateCanonicalTypesToNativeValues()) {
           return BidiConverter.<Object, Object>of(
@@ -342,21 +335,27 @@ private BidiConverter fieldToValueConverter(FieldDescriptor fieldDescriptor) {
         return BidiConverter.of(
             BidiConverter.IDENTITY.forwardConverter(),
             value -> BidiConverter.IDENTITY.backwardConverter().convert(maybeUnwrap(value)));
+      case DOUBLE:
+      case SFIXED64:
+      case SINT64:
+      case INT64:
       case STRING:
-        return BidiConverter.of(
-            BidiConverter.IDENTITY.forwardConverter(),
-            value -> BidiConverter.IDENTITY.backwardConverter().convert(maybeUnwrap(value)));
       case BOOL:
         return BidiConverter.of(
             BidiConverter.IDENTITY.forwardConverter(),
             value -> BidiConverter.IDENTITY.backwardConverter().convert(maybeUnwrap(value)));
       case ENUM:
         return BidiConverter.<Object, Long>of(
             value -> (long) ((EnumValueDescriptor) value).getNumber(),
-            number ->
-                fieldDescriptor
-                    .getEnumType()
-                    .findValueByNumberCreatingIfUnknown(number.intValue()));
+            number -> {
+              if (celOptions.enableCanonicalEnumRangeCheck()
+                  && (number > Integer.MAX_VALUE || number < Integer.MIN_VALUE)) {
+                throw new IllegalArgumentException("Enum value out of int32 range: " + number);
+              }
+              return fieldDescriptor
+                  .getEnumType()
+                  .findValueByNumberCreatingIfUnknown(number.intValue());
+            });
       case MESSAGE:
         return BidiConverter.<MessageOrBuilder, Object>of(
             this::adaptProtoToValue,

common/src/main/java/dev/cel/common/internal/ProtoTimeUtils.java

@@ -406,6 +406,10 @@ public static Duration between(Timestamp from, Timestamp to) {
     Instant javaTo = ProtoTimeUtils.toJavaInstant(checkValid(to));
 
     java.time.Duration between = java.time.Duration.between(javaFrom, javaTo);
+    // Call toNanos() to validate 64-bit nanosecond overflow (throws ArithmeticException).
+    // Suppress unused variable warning as the duration object itself is returned.
+    @SuppressWarnings("unused")
+    long unused = between.toNanos();
 
     return ProtoTimeUtils.toProtoDuration(between);
   }

conformance/src/test/java/dev/cel/conformance/BUILD.bazel

@@ -104,16 +104,12 @@ _ALL_TESTS = [
 ]
 
 _TESTS_TO_SKIP_LEGACY = [
+
     # Broken test cases which should be supported.
     # TODO: Support setting / getting enum values out of the defined enum value range.
     "enums/legacy_proto2/select_big,select_neg",
     "enums/legacy_proto2/assign_standalone_int_big,assign_standalone_int_neg",
-    # TODO: Generate errors on enum value assignment overflows for proto3.
-    "enums/legacy_proto3/assign_standalone_int_too_big,assign_standalone_int_too_neg",
-    # TODO: Ensure overflow occurs on conversions of double values which might not work properly on all platforms.
-    "conversions/int/double_int_min_range",
-    # TODO: Duration and timestamp operations should error on overflow.
-    "timestamps/timestamp_range/sub_time_duration_over,sub_time_duration_under",
+
     # TODO: Ensure adding negative duration values is appropriately supported.
     "timestamps/timestamp_arithmetic/add_time_to_duration_nanos_negative",
 
@@ -154,15 +150,6 @@ _TESTS_TO_SKIP_PLANNER = [
     # TODO: Check behavior for go/cpp
     "basic/functions/unbound_is_runtime_error",
 
-    # TODO: Ensure overflow occurs on conversions of double values which might not work properly on all platforms.
-    "conversions/int/double_int_min_range",
-    "enums/legacy_proto3/assign_standalone_int_too_big",
-    "enums/legacy_proto3/assign_standalone_int_too_neg",
-
-    # TODO: Duration and timestamp operations should error on overflow.
-    "timestamps/timestamp_range/sub_time_duration_over",
-    "timestamps/timestamp_range/sub_time_duration_under",
-
     # Skip until fixed.
     "parse/receiver_function_names",
 

runtime/src/main/java/dev/cel/runtime/RuntimeHelpers.java

@@ -391,7 +391,7 @@ public static Optional<UnsignedLong> doubleToUnsignedChecked(double v) {
   public static Optional<Long> doubleToLongChecked(double v) {
     // getExponent of NaN or Infinite values will return a Double.MAX_EXPONENT + 1 (or 128)
     int exp = Math.getExponent(v);
-    if (exp >= 63 && v != Math.scalb(-1.0, 63)) {
+    if (exp >= 63) {
       return Optional.empty();
     }
     return Optional.of((long) v);

runtime/src/main/java/dev/cel/runtime/standard/IntFunction.java

@@ -82,7 +82,7 @@ public enum IntOverload implements CelStandardOverload {
                     return RuntimeHelpers.doubleToLongChecked(arg)
                         .orElseThrow(
                             () ->
-                    new CelNumericOverflowException("double is out of range for int"));
+                                new CelNumericOverflowException("double is out of range for int"));
                   }
                   return arg.longValue();
                 })),

runtime/src/main/java/dev/cel/runtime/standard/SubtractOperator.java

@@ -68,13 +68,30 @@ public enum SubtractOverload implements CelStandardOverload {
                 "subtract_timestamp_timestamp",
                 Instant.class,
                 Instant.class,
-                (Instant i1, Instant i2) -> java.time.Duration.between(i2, i1));
+                (Instant i1, Instant i2) -> {
+                  java.time.Duration between = java.time.Duration.between(i2, i1);
+                  try {
+                    // Call toNanos() to validate 64-bit nanosecond overflow (throws
+                    // ArithmeticException).
+                    @SuppressWarnings("unused")
+                    long unused = between.toNanos();
+                  } catch (ArithmeticException e) {
+                    throw new CelNumericOverflowException(e);
+                  }
+                  return between;
+                });
           } else {
             return CelFunctionBinding.from(
                 "subtract_timestamp_timestamp",
                 Timestamp.class,
                 Timestamp.class,
-                (Timestamp t1, Timestamp t2) -> ProtoTimeUtils.between(t2, t1));
+                (Timestamp t1, Timestamp t2) -> {
+                  try {
+                    return ProtoTimeUtils.between(t2, t1);
+                  } catch (ArithmeticException e) {
+                    throw new CelNumericOverflowException(e);
+                  }
+                });
           }
         }),
     SUBTRACT_TIMESTAMP_DURATION(