Merge pull request #2082 from nikolauspschuetz/fix-changed-time-overflow-panic

Fix panic on out-of-range '@' Unix timestamp in time filters

CHANGELOG.md

@@ -13,6 +13,7 @@
 - Fire the "search pattern contains a path separator" diagnostic for any pattern containing `/`, not just patterns that happen to name an existing directory. Preserves the legacy Windows behaviour that also flags native `\` separators when the pattern resolves to a real directory. See #1873.
 - Also fire the "search pattern contains a path separator" diagnostic for `--and` patterns, not only the primary positional pattern. `--and` patterns are matched against the file name just like the primary pattern, so a path separator in them silently returned zero results. See #1873.
 - Fix bug where passing "-" as a directory argument didn't actually search that directory, see #849 (@Sean-Kenneth-Doherty).
+- Fix panic when `--changed-before`/`--changed-within` is given an out-of-range `@` Unix timestamp; the value is now rejected gracefully, see #2081 (@nikolauspschuetz).
 
 # 10.4.2
 

src/filter/time.rs

@@ -42,7 +42,7 @@ impl TimeFilter {
             )
         } else {
             let timestamp_secs: u64 = s.strip_prefix('@')?.parse().ok()?;
-            Some(UNIX_EPOCH + Duration::from_secs(timestamp_secs))
+            UNIX_EPOCH.checked_add(Duration::from_secs(timestamp_secs))
         }
     }
 
@@ -199,4 +199,12 @@ mod tests {
                 .applies_to(&t1s_later)
         );
     }
+
+    #[test]
+    fn out_of_range_unix_timestamp_is_rejected() {
+        // A '@' timestamp large enough to overflow SystemTime must return
+        // None rather than panicking.
+        assert!(TimeFilter::before(&format!("@{}", u64::MAX)).is_none());
+        assert!(TimeFilter::after(&format!("@{}", u64::MAX)).is_none());
+    }
 }