Enforce bounds on explicit epoch to timestamp conversions

PiperOrigin-RevId: 845617691

Author: l46kok

common/src/main/java/dev/cel/common/internal/DateTimeHelpers.java

@@ -205,7 +205,7 @@ private static ZoneId timeZone(String tz) {
   }
 
   /** Throws an {@link IllegalArgumentException} if the given {@link Timestamp} is not valid. */
-  private static void checkValid(Instant instant) {
+  public static void checkValid(Instant instant) {
     long seconds = instant.getEpochSecond();
 
     if (seconds < TIMESTAMP_SECONDS_MIN || seconds > TIMESTAMP_SECONDS_MAX) {

runtime/src/main/java/dev/cel/runtime/standard/TimestampFunction.java

@@ -81,7 +81,11 @@ public enum TimestampOverload implements CelStandardOverload {
         (celOptions, runtimeEquality) -> {
           if (celOptions.evaluateCanonicalTypesToNativeValues()) {
             return CelFunctionBinding.from(
-                "int64_to_timestamp", Long.class, Instant::ofEpochSecond);
+                "int64_to_timestamp", Long.class, epochSecond -> {
+                  Instant instant = Instant.ofEpochSecond(epochSecond);
+                  DateTimeHelpers.checkValid(instant);
+                  return instant;
+                });
           } else {
             return CelFunctionBinding.from(
                 "int64_to_timestamp", Long.class, ProtoTimeUtils::fromSecondsToTimestamp);